brainchain

> Sure, but then you still need a protocol between user agent and website. Yes of course. Just like you do for passkeys. > Passkeys can in fact be backed by exactly this, i.e. a HMAC-only stateless implementation backed by a single password: https://github.com/lxgr/brainchain No, not quite. It's written on there: > "Login" with your passphrase, and you can create non-discoverable WebAuthN credentials (don't call them passkeys, but definitely be reminded of them) at ~all~ some websites supporting them (...) That's the thing: with passwords, a website/app cannot prevent you from controlling the password yourself. With passkeys and attestation it can.

Sure, but then you still need a protocol between user agent and website. If you just do this in Javascript, you're not protected against phishing sites just forwarding the password entered directly. Passkeys can in fact be backed by exactly this, i.e. a HMAC-only stateless implementation backed by a single password: https://github.com/lxgr/brainchain

How can the "cartel" "blacklist" anyone? The only thing the FIDO alliance can do is not include a vendor's attestation key as trusted in their vendor database, and software solutions aren't on that list to begin with. > The fundamental flaw is that enrolling an authenticator requires it to be present [...] Yes, but that doesn't mean you can't backup the full authenticator state. Here's a toy WebAuthN implementation that is backed by a passphrase that you remember or write on a piece of paper which works on many websites supporting passkeys and not enforcing attestation (which is the vast majority, since Apple, Google, 1Password, and Bitwarden all don't support attestation for synchronized credentials a.k.a. passkeys): https://github.com/lxgr/brainchain > Making it hard/impractical to maintain a reliable backup yourself sure makes those pr

> Generally, authenticators are “something you have.” Shameless plug: Here's one that is "something you know" :) https://github.com/lxgr/brainchain It derives all keypairs from a passphrase, and rederives the private key from the key handle, similar to "stateless" hardware authenticators. Please don't use it for anything important – it's a fundamentally bad idea, similar to "brain wallets"; I only implemented it to figure out whether it was possible, and to improve my own understanding of the WebAuthN and FIDO specifications.