What If I got multiple devices? Does the server have to store multiple keys per user?
It would have to be something like;
1) Login on primary device
2) Generate a one-time code or link
3) Enter one-time code or click link on 2nd device
4) Click an “Enroll” button on the 2nd device which would generate a second enrollment saved in the account.
You would have to do this for each and every service so that seems like a total non-starter.
Alternatively, a way to share the private keys securely between the devices. But I’m not sure if there are site-specific salts as part of the WebAuthN signing process which would require additional state be sync’d between the devices in order to authenticate to a new service on both devices?
This seems like a huge blocker for adoption. I currently run into this issue with FIDO for 2fa - I store my backup key offsite, which means enrolling the second device requires me to make a special trip to retrieve the device. My current approach is to retrieve the backup token every few months and add it to all of the new services I have enrolled in, but I don't have a good system for remembering all of these services, so I inevitably forget one (despite only using the key on a few services)...
Yes, you'd have to use some other way to authenticate as yourself on a second or subsequent platform device. If you have a separate FIDO token (like a Yubikey or any of their cheaper Security Key products or dozens of others) that would be the obvious first choice to enroll.