HACKER Q&A
📣 EGreg

Can WebAuthn ensure one person one account?


Hey, with Apple’s recent announcement that they support WebAuthn, and Google supporting it, does this kind of mean that we can finally protect against sybil attacks on the Web?

I mean, for real elections or UBI we probably need more verification like WebRTC with the actual person and having them provide a hash of their biometrics or something, and then pick a token out of a hat. Like we have registration to vote in real life. But in what ways can a person open multiple accounts now, and is it an expensive proposition to do so with Apple and Google?

  👤 noodlesUK Accepted Answer ✓
Surely not, as I can own multiple apple or google devices, each with their own Apple IDs or google accounts. I don’t know if they are one device one account though. Additionally, I personally do own multiple yubikeys, which are absolutely not one person one account.
👤 detaro
As far a I know, there is absolutely nothing in WebAuthn that prevents creating as many accounts as you want. It's no different than allowing signups with username/password in that regard