Hacker News Reader

"24 words written on paper."

That's cool, I didn't realise it was possible to backup the webauthn secret this way.

I googled but couldn't find any documentation on how to set this up, could you let me know how you set this up?

Not being able to make backup of the Webauthn secret is why I have stuck with TOTP so far.

It's not exactly part of the webauthn standard. Or at least not a described part, it falls under the 'roaming authenticator' and 'backup credentials' mentioned in the spec, effectively it's a function that generates a crypto key where the key matter is the 24 randomly chosen words. It's basically just _another_ key that a service can setup and store for your, but encrypted with the secret they share with you up front in the form of those words.

The Ledger hardware wallet can act as a FIDO U2F (probably other hardware wallets as well). And to back up a hardware wallet you write down the 24 words…

Reply on news.ycombinator.com