I'm not a huge fan of removing the 'two' from 'two factor authentication'. If people can login with just their device, which could be stolen, I don't think it's as secure as a password+device based 2FA alternative
Ask HN: Why is WebAuthn so slow to take off?
11–20 of 182 posts
Re: Ask HN: Why is WebAuthn so slow to take off?
#12I'm not a huge fan of removing the 'two' from 'two factor authentication'. If people can login with just their device, which could be stolen, I don't think it's as secure as a password+device based 2FA alternative
On Apple platforms, a biometric authentication is required to proceed with webauthn, so technically it is 2FA (something you have and something you are).
Re: Ask HN: Why is WebAuthn so slow to take off?
#13I'm not a huge fan of removing the 'two' from 'two factor authentication'. If people can login with just their device, which could be stolen, I don't think it's as secure as a password+device based 2FA alternative
WebAuthn to either a a hardware key protected by a pin, or to a passkey protected by a biometric. Both definitely qualify as 2FA
Re: Ask HN: Why is WebAuthn so slow to take off?
#14I'm not a huge fan of removing the 'two' from 'two factor authentication'. If people can login with just their device, which could be stolen, I don't think it's as secure as a password+device based 2FA alternative
[deleted]
Re: Ask HN: Why is WebAuthn so slow to take off?
#15Earlier quoted context omitted.
> I would say because it relies on an hardware key This isn’t true on Apple, Google, or Microsoft devices which have a trusted hardware store – I use my MBP’s Secure Enclave for 90% of my logins since it’s just a Touch ID check.
Well, there is a hardware key, it's just that it's the device you're using.
In other words, having a hardware key is not a real barrier to use.
Re: Ask HN: Why is WebAuthn so slow to take off?
#16I use it everywhere I can for the stuff I host.
With how even banks rely on SMS for 2FA these days, I think this stuff just isn't on most companies' radars. It adds some convenience but until whoever is in charge of setting out a road map is convinced this is useful or something users may want, there's little benefit to spending the dev time.
I use my phone for this stuff because Linux doesn't really support this stuff without faffing about with command line stuff and these keys are quite expensive (especially considering you need two to be safe).
It's a shame, really.
Re: Ask HN: Why is WebAuthn so slow to take off?
#17It’s not that bad to implement, especially since there are a lot of OSS libraries. The problem IMO is that it will, for most use cases, unconditionally authenticate you to a browser, not a physical token. And that will confuse a lot of people (and make some security engineers twitch). Why not a token? Lets be frank, pretty much nobody has a yubikey style token, and getting average users to use their phone as a token…
Passkeys are deliberately designed to avoid the issues with Bluetooth pairing. This is why a QR code needs to be scanned - devices do not need to be paired.
Re: Ask HN: Why is WebAuthn so slow to take off?
#18I'm not a huge fan of removing the 'two' from 'two factor authentication'. If people can login with just their device, which could be stolen, I don't think it's as secure as a password+device based 2FA alternative
From a practical standpoint, i dont really think it matters.
The real threat 2fa auth solves is the fact people blame the site operator when they are hacked. 90% of the time it is due to reusing a password. The other 10% it is due to phishing. WebAuthn stops both. 2FA works not because it adds another factor, but because it removes choice from the user so they can't screw it up.
Re: Ask HN: Why is WebAuthn so slow to take off?
#19I'm currently looking into deploying hardware keys for some of our users at work (mostly through Microsoft SSO which is FIDO2 passwordless), and one of the roadblock on our end is the inability to define our own minimum requirements for the PIN. Educating our users about the importance of using a secure PIN is indeed a priority, but it would be nice from a security standpoint of we could enforce some policies on our…
Why do you require a pin at all? The point of hardware keys is to protect against online takeover. Physical access is usually game over either way
It adds another factor (something you know), which increases the difficulty of an exploit.
Re: Ask HN: Why is WebAuthn so slow to take off?
#20I'm currently looking into deploying hardware keys for some of our users at work (mostly through Microsoft SSO which is FIDO2 passwordless), and one of the roadblock on our end is the inability to define our own minimum requirements for the PIN. Educating our users about the importance of using a secure PIN is indeed a priority, but it would be nice from a security standpoint of we could enforce some policies on our…
Why do you require a pin at all? The point of hardware keys is to protect against online takeover. Physical access is usually game over either way
2 factors - something you know and something you have. The device is what you have, the pin is something you know, otherwise anyone can pick up your security key and use it