121–130 of 182 posts
Earlier quoted context omitted.
Also Protonmail supports both U2F and FIDO2. Introduced october last year [0]. [0]: https://proton.me/blog/security-keys
Yes, but in order to enable it, they require that you enable an app first. I can only assume that this tactic is usually an attempt to maybe get your phone number, depending on which phone-based method you choose. Which is especially weird for ProtonMail.
Passkeys is a new FIDO standard that will let the private keystore be backed by the cloud. It was added to WebAuthn fairly recently. Having keys tied to specific physical devices was a terrible & frustratingly limited scheme that never had any hope. Now that there's something a little bit looser, there's some small hope WebAuthn starts to become interesting & viable. https://developer.chrome.com/blog/webauthn-conditi…
it still seems pretty bad ui wise, prompting me to scan a QR code on desktop: https://webauthn-conditional-ui-demo.glitch.me/create-accoun... I was ready to give up until I realized that maybe "internal sensor" means Windows Hello on my machine and yep it does. But no real user is going to click through these security sensitive popup dialogs until Windows Hello shows up as an option. My verdict is that it's still cle…
One of my daughters assignments required her to log into an app. At school they do so by scanning a QR code they keep in the classroom. The teacher sent a picture of the QR code.
I found myself in the hilariously absurd situation of needing my laptop to scan a QR code it was displaying on its own screen. I took a picture with my phone and then presented the QR back to the computer.
Your comment reminded me of this.
Passkeys is a new FIDO standard that will let the private keystore be backed by the cloud. It was added to WebAuthn fairly recently. Having keys tied to specific physical devices was a terrible & frustratingly limited scheme that never had any hope. Now that there's something a little bit looser, there's some small hope WebAuthn starts to become interesting & viable. https://developer.chrome.com/blog/webauthn-conditi…
it still seems pretty bad ui wise, prompting me to scan a QR code on desktop: https://webauthn-conditional-ui-demo.glitch.me/create-accoun... I was ready to give up until I realized that maybe "internal sensor" means Windows Hello on my machine and yep it does. But no real user is going to click through these security sensitive popup dialogs until Windows Hello shows up as an option. My verdict is that it's still cle…
But that doesn't sound like something I'd ever want. Obviously I want to be able to log in on my computer too?
Earlier quoted context omitted.
As stated, devices fail, or get stolen. When I’m traveling and robbed, I won’t be able to get the backup device is hidden in my drawer at home
You also won't have access to the TOTP backup of emergency codes.. If you get hit on the head or have the trauma of your life you might not have a password. These are tradeoffs that people use to balance security. Many people will lose to a sim swap despite not needing access to their life savings while on vacation with absolutely no proof of identity and a fallible memory.
I'm not a huge fan of removing the 'two' from 'two factor authentication'. If people can login with just their device, which could be stolen, I don't think it's as secure as a password+device based 2FA alternative
Nearly everyone I know has less tolerance for annoying security than me, so I don't see how WebAuth can possibly succeed.
Earlier quoted context omitted.
it still seems pretty bad ui wise, prompting me to scan a QR code on desktop: https://webauthn-conditional-ui-demo.glitch.me/create-accoun... I was ready to give up until I realized that maybe "internal sensor" means Windows Hello on my machine and yep it does. But no real user is going to click through these security sensitive popup dialogs until Windows Hello shows up as an option. My verdict is that it's still cle…
On Firefox on my Android phone it's phrased much better: "Use this device with screen lock". But that doesn't sound like something I'd ever want. Obviously I want to be able to log in on my computer too?
Or am I misunderstanding you and you want to log in on desktop with the same passkey that you generated on mobile? I think that is never supposed to work, it's supposed to be tied to the device.
Earlier quoted context omitted.
On Apple platforms, a biometric authentication is required to proceed with webauthn, so technically it is 2FA (something you have and something you are).
Which is awesome, but worthless, if others don‘t follow.
Earlier quoted context omitted.
it still seems pretty bad ui wise, prompting me to scan a QR code on desktop: https://webauthn-conditional-ui-demo.glitch.me/create-accoun... I was ready to give up until I realized that maybe "internal sensor" means Windows Hello on my machine and yep it does. But no real user is going to click through these security sensitive popup dialogs until Windows Hello shows up as an option. My verdict is that it's still cle…
My daughter recently had an unplanned "remote learning" day because of snow. One of my daughters assignments required her to log into an app. At school they do so by scanning a QR code they keep in the classroom. The teacher sent a picture of the QR code. I found myself in the hilariously absurd situation of needing my laptop to scan a QR code it was displaying on its own screen. I took a picture with my phone and th…
Earlier quoted context omitted.
As stated, devices fail, or get stolen. When I’m traveling and robbed, I won’t be able to get the backup device is hidden in my drawer at home
You also won't have access to the TOTP backup of emergency codes.. If you get hit on the head or have the trauma of your life you might not have a password. These are tradeoffs that people use to balance security. Many people will lose to a sim swap despite not needing access to their life savings while on vacation with absolutely no proof of identity and a fallible memory.
These are encrypted in my password manager that is sync'd to the cloud. I only have 1 password and 1 backup code I need to memorize.
Earlier quoted context omitted.
Why do you require a pin at all? The point of hardware keys is to protect against online takeover. Physical access is usually game over either way
Because Microsoft's implementation is incredibly boneheaded, and doesn't allow the Google-style mechanism of username+password+Yubikey. They only support U2F/Webauthn as an alternative to a password. I assume Microsoft is hoping to make Windows the main Webauthn provider out there, to tie online identities into the Windows login process for easier tracking/advertising.
https://learn.microsoft.com/en-us/azure/active-directory/aut...
bummer