Hacker News Reader

Comment by onli | Hacker News Reader

Ssh keys are files that can be moved easily from device to device. That's very different to using e.g. your proprietary macbook internals as your login key. Completely different lock-in.

View on HN

You can just enroll multiple keys from different devices, just like you do with SSH, that's the recommended way. But even then, there are software implementations of WebAuthn, like 1Password. You can then use the local TPM as a "last mile" authentication mechanism to quickly and effectively unlock your local encrypted password database and then get the needed key material to do WebAuthn. I use this across all my devices e.g. to login to GitHub, even on my iPhone.

You could accomplish something fairly similar to this for SSH keys actually (an encrypted sync layer + deriving master keys from a local trusted source), but I don't think anyone has done this to the same level of polish.

You can do passkeys in software too:

https://keepassxc.org/docs/KeePassXC_UserGuide#_passkeys

A passkey is a synced, discoverable WebAuthn credential. While many implementations protect the private keys with additional security measures like secure enclaves or TPMs, it's not required. If you want to use an implementation that doesn't use those types of lock-ins, even when they're there to protect your credentials, you can. Multiple software-only implementations exist.

Until they start trying to enforce attestation. Then your only choice will be giving a large corporation control over your online access.

Reply on news.ycombinator.com