Aaron Parecki

I have bad news, they just make up whatever numbers they want so that it comes out to getting a refund on your behalf 🙃

Thanks! There's currently no browser API that guarantees the use of secure-element-stored private keys. The best we get now is non-exportable. There's a mention of that here https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps#section-6.3.4.2.2 But as discussed, even hardware-backed keys don't prevent an attacker from starting their own flow in the browser with their own keys.

Thanks! Mostly I'm doing German so I don't completely forget everything I learned in school.

I've been looking forward to this day for a long time