Earlier quoted context omitted.
> Same reason how signCount is useful in a non-shared passkey. Again: unless I am missing something, signCount is useless with a shared passkey. If your laptop expects signCount to be "2" and sees "5", it will just believe that your smartphone was used in the meantime. The counter doesn't say "it was used illegally", does it? > Also, why not. "Because it's useless" sounds like a good reason to me. Unless you explain…
signCount would need to be synchronised as well as the passkey by whatever method you elect to use. If your synchronisation method has been persistently compromised you're hosed, but if the passkey is cloned as a one off, the server would continue to increment signCount everytime either copy is used, while the passkey in your possession would only increment when used by you ie. half as often. You'd run into trouble i…
Say an attacker manages to make a copy C of A. They have the signCount as part of it, right? So they can immediately connect to the server. The server will increment signCount and sync it with A and B, but C is already in and C knows that the signCount is probably lastSignCount+1.
The only way I could imagine signCount to be useful is if somehow the server synchronises it between A and B in a way that C - who got access for a while - cannot access. It would mean that C has access until A or B connects, and after that the next time C connects, it will be out of sync. This does not sound super useful, and it assumes that C cannot access the sync process even though it has unlimited access to the passkey (until A or B is used).
What am I missing? To me signCount doesn't bring anything here...