Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

For U2F I don't believe that's the case for most devices.

Yubikey outlines their method here[1]. They generate a different keypair for each website public key and have the server store an encrypted and authenticated copy of the private key using a single on-device key. So baring breaking the underlying primitives the server will only have a site-specific public key and a site-specific encrypted blob.

[1]: https://developers.yubico.com/U2F/Protocol_details/Key_gener...



They are asking about two user accounts on the same site, not with two websites on the same server. As in two GMail accounts.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: