I wonder if this approach has a bit of planned obsolesence stuck to it. You'll have to constantly boost encryption algorithms for this to work, would you not? (Just like old versions of SSL are currently advised against) This will mean that older devices will eventually be unable to log in with webauthn, due to lacking processing power to generate new keys, or even not receiving related software updates. And, in general, would that work with less-powerful devices (i. e., feature phones)?
Newer devices will use attestation key and they are hard coded in the respective mobile device/ laptop processor. That way your pvt key for every other application will be fixed.
I wonder if this approach has a bit of planned obsolesence stuck to it.
You'll have to constantly boost encryption algorithms for this to work, would you not? (Just like old versions of SSL are currently advised against)
This will mean that older devices will eventually be unable to log in with webauthn, due to lacking processing power to generate new keys, or even not receiving related software updates.
And, in general, would that work with less-powerful devices (i. e., feature phones)?
Newer devices will use attestation key and they are hard coded in the respective mobile device/ laptop processor. That way your pvt key for every other application will be fixed.
It seems like `Welcome to the future`