Comment

Comment by dathinab

their approach is a one which is fully stateless on the chip (see their documentation for why)

theoretically this is quite desirable but various protocols aren't build in a way enabling it

e.g. TOTP pushes a secret from the server to the client, instead of having some form of deterministic key exchange

similar while FIDO protocols and passkeys could have been designed in a way which can work fully stateless they are not

now it doesn't mean you can't make it work with tkeys but it can get more complex e.g. for TOTP using TKey to guard a local password vault which then does the TOTP instead of having the TOTP on the key directly (but then while TOTP is better then SMS 2FA it's still pretty bad compared to what technically is possible, like much worse then a lot of people realize)

parent dathinab 1 year ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton