# An Internet-Identity-principal is tied to a domain-name? **URL:** \ **Category:** Programs & Applications\ **Created:** [May 30, 2021, 12:21am UTC](https://forum.dfinity.org/t/an-internet-identity-principal-is-tied-to-a-domain-name/4527 "2021-05-30T00:21:29Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![nomeata](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/nomeata/32/733_2.png) [@nomeata](https://forum.dfinity.org/u/nomeata)\ **Post date:** [June 1, 2021, 3:13pm UTC](https://forum.dfinity.org/t/an-internet-identity-principal-is-tied-to-a-domain-name/4527/2 "2021-06-01T15:13:24Z")
There are two independent aspects here worth mentioning: - WebAuth devices (finger print, yubikeys) are bound to the origin (i.e. host name) of the site you are logging into In this case `https://identity.ic0.app`. This is a property of WebAuthentication, and nothing we can change easily. If we move the Internet Identity from `https://identity.ic0.app` to another hostname, there will have to be a manual migration protocol (e.g. using a recovery seed phrase), but you can keep the User Number just fine. - The identity handed out by the Internet Identity is tied to the hostname. It is a deliberate decision in the design to authorize _web application_ (which are identified by hostname) rather than by canister. This is matches the security model of the web in many ways, is more suitable because it’s really web applications (i.e. frontends) talking to each other here. And it’s not like a web application will always have a canister behind them – they may be hosted outside the IC, and there is no reason to not allow the Internet Identity to be used in that case, or there may have multiple canisters associated with this web application, or a single canister may host many web applications (dispatching on the `Host:` header, once we have nice-names-to-canisters). --- _[View the full topic](https://forum.dfinity.org/t/an-internet-identity-principal-is-tied-to-a-domain-name/4527)._