Say I have a passkey shared between my laptop and my smartphone. When I log in with the smartphone, the signCount is incremented and the new value is synchronised with the laptop, as suggested in the article.
Now say my passkey is compromised, and an attacker logs in from somewhere else. Won't the signCount just be incremented and synchronised with the smartphone and the laptop? How does signCount prevent that?
I would still like to see big tech passkey providers implement signCount for the following 2 reasons:
1. It helps to push relying parties to implement signCount verification. Right now most relying parties do not implement it as many providers are returning `0` for `signCount`.
2. This would be an odd one, it helps against detecting leaked private keys of passkeys, if a malicious attacker, internal or external, manages to obtain the private key.
The only way I can see it be useful is if you have exactly one instance of the passkey (e.g. a security key), because if `signCount` got incremented without the security key being aware of it, then you have a problem.
Why would you sync a passkey, rather than create a separate one for each device? Seems risky if it's compromised?
But I was assuming that the TooBigTech implementation was somehow sharing the passkeys?
Also, why not.
Again: unless I am missing something, signCount is useless with a shared passkey. If your laptop expects signCount to be "2" and sees "5", it will just believe that your smartphone was used in the meantime. The counter doesn't say "it was used illegally", does it?
> Also, why not.
"Because it's useless" sounds like a good reason to me. Unless you explain why it is not useless, that is.
Say an attacker manages to make a copy C of A. They have the signCount as part of it, right? So they can immediately connect to the server. The server will increment signCount and sync it with A and B, but C is already in and C knows that the signCount is probably lastSignCount+1.
The only way I could imagine signCount to be useful is if somehow the server synchronises it between A and B in a way that C - who got access for a while - cannot access. It would mean that C has access until A or B connects, and after that the next time C connects, it will be out of sync. This does not sound super useful, and it assumes that C cannot access the sync process even though it has unlimited access to the passkey (until A or B is used).
What am I missing? To me signCount doesn't bring anything here...
When A logs in with an unincremented signCount. A and the relying party are now aware of a potential cloned authenticator and disable the compromised passkey.
It seems strictly worse than just sending an email saying "your passkey was used from <IP-based geolocation>, wasn't it you?".