Hacker News Reader

Is this like Client Certs without the connection to the SSL cert?

Oh, I guess client certs are owned and controlled by the server owner...

Sorta, Client Certs but the Client generates and authenticates them, the Server only stores the fingerprint and authenticates them on it's side.

And with a better UI and flow since you don't need it to establish connection.

Yeah, and a separate keypair is generated for each site.

Lack of sleep makes it a bad time for me to read this. But if the client generates the key does it mean it's stored on the browser or something like that? It means that I will need a sync/copy procedure if I'm going to use it in another machine/browser?

Essentially yes. You'll need something like Firefox Sync or providers will have to implement a way of adding devices.

However the WebAuthn API also leaves options for password managers and other endpoints managing the actual secrets.

Reply on news.ycombinator.com