Embed Notice

@arcanicanis

>derives a new private/public keypair (in-memory) from the stored master key, using a key derivation function, and presents the generated public key to the service

This sounds reasonable. However,

>U2F

Is hardware token required? Even if the token doesn't leak some metadata or ID to the website, I still need to acquire it somehow. Meanwhile passwords and private keys are free.