We’re rewarding the question askers & reputations are being recalculated! Read more.

New answers tagged


The argument is that, if you supply your own key material, the key manufacturer has no way to verify that the key material is sufficiently random, not stored elsewhere, etc. Imagine if you are the victim of a sophisticated targeted attack, and you generate the key material on a computer that has malware on it which exfiltrates it to the attacker. Or perhaps ...


They could allow you to change your own key but it would eliminate the point in trusting them as an authentication authority. TLDR; The whole purpose of using a FIDO2 authenticator is 'trusting the vendor'. That is what you are paying for when you buy it. They are selling a product saying we have a trusted server technology. Just like a browser operates ...

Top 50 recent answers are included