Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

There's a TOTP Authenticator option (Authy, Google Auth etc). It doesn't show up on the screen shot because the author already has a TOTP app configured.

login.gov is deprecating the personal key in favor of a better backup 2FA method. But currently it only supports 1 instance of each 2FA type. So because the author already has a TOTP app configured, they can't select that as a replacement for the personal key.



It'll let you have more than one FIDO key.

That happens for two related reasons. Firstly the WebAuthn spec. says to allow this, I haven't read the U2F stuff because it wasn't formalised like WebAuthn, but I expect that instructed implementers to allow multiple keys too.

Secondly, because it's obviously the Right Thing, which is why it's a recommendation in the specification, the U2F and WebAuthn specifications explain how everything works properly with multiple keys.

* When you register a new key, the site provides cookies from any other keys that you've already registered. Your browser asks keys if they recognise those cookies, only a key that doesn't recognise any cookies should register as otherwise you're creating pointless duplicates.

* When you sign-in the site provides as many cookies as you've registered keys - each cookie only works with the key which picked it, but the keys can tell if a cookie is theirs, so whichever FIDO key you've got, it should recognise one of the cookies sent and you're in.

This is probably also true for government ID in the unusual case that somebody has more than one.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: