Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why is WebAuthn so slow to take off?

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 182 posts

Re: Ask HN: Why is WebAuthn so slow to take off?

#141

Post by crote »

rektide wrote: post #38

Passkeys is a new FIDO standard that will let the private keystore be backed by the cloud. It was added to WebAuthn fairly recently. Having keys tied to specific physical devices was a terrible & frustratingly limited scheme that never had any hope. Now that there's something a little bit looser, there's some small hope WebAuthn starts to become interesting & viable. https://developer.chrome.com/blog/webauthn-conditi…

So instead of having a physical device you own act as a second factor, you are now vendor-locked to a proprietary authentication solution for the entire login process. No thank you!

The entire point of two-factor authentication is to have, well, two factors: something you know and something you have. Using the PC itself as token was already problematic enough as it has a massive code base and runs all sorts of untrusted code so it is likely to be compromised at some point - but at least that was somewhat excusable due to convenience making it accessible to way more people. But getting rid of the rest of the credential and solely relying on the OS is just insanity.

Re: Ask HN: Why is WebAuthn so slow to take off?

#142

Post by crote »

tadfisher wrote: post #87
alsdfjkslfheu wrote: post #81

Earlier quoted context omitted.

> Standards enable flexibility which enables possibility. what?! standards are the opposite of flexible. by definition. here's something that is better than webauthn, published and battle tested since 2018, and nobody cares: https://hacks.mozilla.org/2018/11/firefox-sync-privacy/ it have all the advantages of webauthn, plus it is truly on-device, no middle man, you can easily recover keys simply by having more than o…

Firefox syncs passwords, not keys. Passwords can be reused, stolen, or leaked, all of which cannot be done to WebAuthn keys.

If I am not mistaken, all Passkeys implementations allow keys to be synced between multiple devices. This means it is by definition possible for them to be stolen or leaked.

Webauthn keys are only secure against stealing & leaking if they are backed by a proper separate token like a Yubikey, but it seems the People That Be want us to get rid of those ASAP.

Re: Ask HN: Why is WebAuthn so slow to take off?

#143

Post by crote »

rgreen wrote: post #89
alsdfjkslfheu wrote: post #74

Earlier quoted context omitted.

what's your key backup/recovery strategy?

recovery is easy. i'm a customer of all these companies so i have faith i'll be able to convince them i'm me if it comes to that. and i keep a handful of hardware keys to make self-recovery easier if i lose or break one. most of my practices are to mitigate risks i personally know how to mitigate, and doing it while causing myself as little headache as possible. being able to auth using touch id on my personal laptop…

So I assume you do not consider, say, your Github or Google account to be high-value? Plenty of tech companies have simply started to refuse recovery if you lose all your 2FA keys.

Re: Ask HN: Why is WebAuthn so slow to take off?

#144

Post by crote »

Nathanba wrote: post #120
account-5 wrote: post #92

Earlier quoted context omitted.

I really only see the negatives here. This solution offers me nothing over my password manager other that way less control over my own stuff, more ways to be locked out of my accounts, with the slightly added benefit that I don't have to worry about a sites shitty security practices. > What's your ideal authentication solution? I've said before as soon as passkeys can be managed offline and aren't tied to devices I'l…

It seems that they are set up to be like this already. At least Chrome+Android treat these passkeys like any password and they can be synced and accessed via API. I already see my passkeys in Chrome btw. https://developers.google.com/identity/passkeys/supported-en... This sounds pretty good to me, this is therefore like a regular old password except it's a cryptographic key that I don't have to remember and it's secu…

> this is therefore like a regular old password

Well that's part of the problem, isn't it? It is being treated as if it is 2FA, but in practice it is barely more secure than a cloud-synced password.

Re: Ask HN: Why is WebAuthn so slow to take off?

#145

Post by crote »

runarberg wrote: post #46
MattPalmer1086 wrote: post #23

Earlier quoted context omitted.

Interesting take on 2FA. The user not being able to screw up is of course important, but the second factor (something you have) works primarily because it is tied to something physical and therefore local to the user, which is not subject to remote attacks.

Don’t most people that this this “correctly” use a password manager which stores passwords on the same device as stores the totp token and generates the one time code? Doesn’t this effectively turn your password into a device that you have, effectively turning the first factor ( something you know ) into something you have , while the second factor ( something you have ) is the same thing you have from the first fact…

I'm not sure about "most people", but I for one never stored 2FA tokens on the same device as my passwords. My password manager is only on my desktop/laptop, and my 2FA tokens only live on my smartphone/Yubikey.

Storing both on one device sounds like a pretty stupid thing to do. Sure, it's convenient, but you are putting a looooot of trust into the assumption that your single device will never be compromised.

Re: Ask HN: Why is WebAuthn so slow to take off?

#146

Post by crote »

m-p-3 wrote: post #33
shawabawa3 wrote: post #8

Earlier quoted context omitted.

Why do you require a pin at all? The point of hardware keys is to protect against online takeover. Physical access is usually game over either way

Since Microsoft's implementation of FIDO2 is passwordless, you NEED to use a PIN, which is the "something you know" part, the key being "something you have". And if the PIN is complex enough, bruteforcing or guessing won't work as I believe the default behavior is to wipe the secure element storage after 8 incorrect attempts (with 3 attempts per key being initialized at a time).

Those bruteforce protections aren't really worth a lot in practice. If you have physical access to the device, you will eventually be able to find a way to glitch it - as things like Cellebrite have already proven for the iPhone.

Re: Ask HN: Why is WebAuthn so slow to take off?

#147

Post by mrjin »

rektide wrote: post #38

Passkeys is a new FIDO standard that will let the private keystore be backed by the cloud. It was added to WebAuthn fairly recently. Having keys tied to specific physical devices was a terrible & frustratingly limited scheme that never had any hope. Now that there's something a little bit looser, there's some small hope WebAuthn starts to become interesting & viable. https://developer.chrome.com/blog/webauthn-conditi…

Wow, the main reason to use a dedicated device is to avoid someone else get access to the keys without physically accessing the device. And now the key is voluntarily surrendered.

Re: Ask HN: Why is WebAuthn so slow to take off?

#148

Post by mrjin »

crote wrote: post #141
rektide wrote: post #38

Passkeys is a new FIDO standard that will let the private keystore be backed by the cloud. It was added to WebAuthn fairly recently. Having keys tied to specific physical devices was a terrible & frustratingly limited scheme that never had any hope. Now that there's something a little bit looser, there's some small hope WebAuthn starts to become interesting & viable. https://developer.chrome.com/blog/webauthn-conditi…

So instead of having a physical device you own act as a second factor, you are now vendor-locked to a proprietary authentication solution for the entire login process. No thank you! The entire point of two-factor authentication is to have, well, two factors: something you know and something you have . Using the PC itself as token was already problematic enough as it has a massive code base and runs all sorts of untru…

Not only that. It defeats the purpose of using a dedicated device.

Re: Ask HN: Why is WebAuthn so slow to take off?

#149

Post by [deleted] »

vdelitz wrote: post #136
edude03 wrote: post #22

My guess as someone who's been in a position to implement it a few times but haven't gotten to: - "Upstream" Support, For various combinations of stacks I've worked on, there has always been one component that didn't support it cleanly, (Flutter x Ory was my last attempt for example). If it was as easy as "just" enabling it I'm sure it'd be more popular, but when your provider or tech stack doesn't support it out of…

What was the issue with Flutter and Ory?

[deleted]

Re: Ask HN: Why is WebAuthn so slow to take off?

#150

Post by GoblinSlayer »

xoa wrote: post #78
alsdfjkslfheu wrote: post #73

Earlier quoted context omitted.

is passkey any better than a password manager, besides losing the option to set your own secure password that you can store offline?

Fully managed passkeys will always have the max needed entropy without any need for KDFs, never be reused, are amenable to a smooth path to hardware backing, and most importantly/fundamentally aren't symmetric factors. You don't need to share the private key with the website, and that in turn means that even if you stored it in plain text on your own computer you're still immune to the most common form of leaks which…

If the password is properly managed, how does it matter if its hash leaks?
Post reply on HN