Hacker News Reader

For sites that use a resident webauthn token like GitHub, you can list the known sites on the key. The UX for all this is not where it should be, however.

View on HN

Are you sure that GitHub uses resident keys? I'm fairly sure they use non-resident keys.

They do now, but they didn't in the past.

Any idea why this was changed? The big advantage of non-residential keys is that they do not take up any space on the Fido token and thus you can have an unlimited number of them.

They wanted discoverable credentials to enable the magic username-less "sign in with passkey" auth flow.

I really couldn't care less about that. But I do care about the limited space on my fido token.

I've used five RK slots out of 25 available on my daily driver keys. Three of those are for SSO providers that provide access to the majority of the other apps I use. I opt in to "sign in with Google" etc wherever I can.

I don't see this impacting me personally anytime soon, but that might change when more sites start insisting on rolling their own RKs.

Hopefully future Yubikey models will ship with more flash, enabling many more RKs if you so desire.

Reply on news.ycombinator.com