0

I would like to build an authentication system where a user can not provide any information (no username, email, etc.) and simply use their U2F device to identify themselves as well as authenticate.

From what I can tell from looking at the Web Authentication API, it appears that the U2F device will create a new public key every time create() or get() is called.

Is there a way to get a stable id from a U2F device that can be used for identification?

David Barratt
  • 546
  • 1
  • 6
  • 24

1 Answers1

1

No, this will not work. Because U2F can be used with multiple identities.
WebAuthn proves that you are a specific identity. So you have to provide this information.

Markus
  • 512
  • 1
  • 4
  • 21