I know that in terms of security it is not good idea (as explained here: https://github.com/Yubico/libu2f-host/issues/45#issuecomment-337013420). But we can live with that.

Is there any extension of U2F or may be some version/manufacturer of security keys which allow to do that?

The feature our customer wants to have is simple. User have the same device for several accounts. The device gets stolen. User notifies administrator of the site about that and the admin needs to act on all the accounts where the stolen key was used. We need a feature on the key which would allow us to do that.

Currently we use Yubikey keys.

  • why would the user name not be sufficient to track this down through your authentication backends? – LvB Jan 16 at 13:37
  • @LvB, User can create several accounts with one U2F device, then several with other device and then forget on which account he used which key. He can even forget account names. – alehro Jan 16 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.