Hacker News Reader

Comment by navigate8310 | Hacker News Reader

One thing to keep in mind before buying their NFC keys is that it can only store up to 10 resident keys

I don't think resident keys are that worthwhile. Relaying party anyway has to remember the user somehow, even if it's just the public key. And it still has to associate the key with the user data.

I think resident keys just complicate things for users and developers.

Resident keys are great, I don't have to remember usernames. I don't care what the RP does, I care that I can sign in with one click.

But you still have to remember what the key unlocks. A username could be just a label for it.

Yubikey 5 can only store 20, which isn't a whole lot better. Are there yet any readily available FIDO devices that can store 100s of resident keys (I have almost 400 logins in bitwarden)?

The new Google Titan keys can store hundreds; sadly not even sure if I can get one here.

Depending on your level of trust in Bitwarden and your security model, you could consider unlocking the Bitwarden vault with a security key, and then using Bitwarden's passkey support to authenticate to websites. It's not really 2FA, but it works around the resident key limitation.

There's also a nifty app that implements CTAP2 on Android Wear, and basically act like an NFC/Bluetooth security key. If you have an Android Wear and don't think your watch will be hacked and rooted, this could be a useful alternative, especially in places where Google doesn't sell their Titan keys.

Ideally self hosted bitwarden (or a local only password manager such as keepassxc with passkey support) using a master password and a security key for the 2nd factor with all the accounts in your vault using passkey makes it so you need to know 1. the master password password, 2. have the security key, and also have 3. access to the vault.

The website being breached and the passkey public key being dumped is meaningless. They are more likely to compromise a site’s admin access that can get into user accounts than ever crack public key cryptography or simultaneously acquire all three factors necessary to gain access to my vault. And no matter what I do on my end (except only use sites that take security seriously) can stop that.

Reply on news.ycombinator.com