Hacker News Reader

TPM-based like...Windows Hello?

Both Windows and Mac support host-based FIDO keys. Of course, the downside here is that you...can't move them to a new computer. So they're sort of hard to use on their own, hence people still turn to portable (but less secure) solutions like TOTP and SMS.

View on HN

Fair point, I’m not super familiar with hello. The problem of cross-computer access is solvable* - add cryptographic trusts to transport encrypted data across insecure hardware.

*I didn’t say it’d be great user experience though.

Yep, Apple solves this by moving FIDO key material around via iCloud, I believe. But it requires a good syncing mechanism like that.

In principle it's similar to the password manager problem, which is a bit ironic: if everyone used password managers, most of the same security issues would be resolved. (There are a few cases where a FIDO key is better than a password manager, but not many!)

Reply on news.ycombinator.com