Hacker News Reader

The blog post is misconstruing things; WebAuthn is not totally backwards compatible with U2F. Specifically, WebAuthn doesn't support the U2F trusted facets functionality, which allowed for a U2F credential to be used on a cross-origin basis. https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fid...

View on HN

Is anybody actually doing that? To me it looks like something that's astoundingly fragile and unwieldy and I'd expect that most "users" of this feature were either opening themselves up to a vulnerability they hadn't considered or were in fact attackers targeting such a vulnerability. Yuck.

Reply on news.ycombinator.com