Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why is WebAuthn so slow to take off?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 182 posts

Re: Ask HN: Why is WebAuthn so slow to take off?

#41

Post by alwaysbeconsing »

markkitti wrote: post #32
MattPalmer1086 wrote: post #23

Earlier quoted context omitted.

Interesting take on 2FA. The user not being able to screw up is of course important, but the second factor (something you have) works primarily because it is tied to something physical and therefore local to the user, which is not subject to remote attacks.

Here's the concept. Perhaps we have the order wrong. Maybe the physical factor should be the primary factor. The second factor should never be transmitted, but rather is used to unlock the physical factor.

Requiring a password for a hardware key doesn't add much to the key already being in your pocket or locked in your house/office. It helps against an attack that's specifically targeting you as a person but it's basically just a nuisance for you when considering generalized account attacks.

Re: Ask HN: Why is WebAuthn so slow to take off?

#42

Post by DANmode »

killjoywashere wrote: post #24

We use it at work and for whatever reason every time I get it working one one device, it stops working on another. That and it seems to be fragile across the VPN.

"the" VPN?

I'd be interested to know which proprietary vendor you're referring to.

Re: Ask HN: Why is WebAuthn so slow to take off?

#43

Post by cwalkatron »

I think it's because it's a pain to have one key per device. To solve this, you'd need a service like iCloud Keychain (for Apple devices), but that only works for Safari and other Apple stuff. I think once 3rd party apps (like 1Password - see https://www.future.1password.com/) start supporting the syncing of keys, you'll see more use. Alternatively, if you could use iCloud Keychain with Chrome and Firefox, maybe that would work, too. Looking forward to this future!

Re: Ask HN: Why is WebAuthn so slow to take off?

#46

Post by runarberg »

MattPalmer1086 wrote: post #23
bawolff wrote: post #18

Earlier quoted context omitted.

From a practical standpoint, i dont really think it matters. The real threat 2fa auth solves is the fact people blame the site operator when they are hacked. 90% of the time it is due to reusing a password. The other 10% it is due to phishing. WebAuthn stops both. 2FA works not because it adds another factor, but because it removes choice from the user so they can't screw it up.

Interesting take on 2FA. The user not being able to screw up is of course important, but the second factor (something you have) works primarily because it is tied to something physical and therefore local to the user, which is not subject to remote attacks.

Don’t most people that this this “correctly” use a password manager which stores passwords on the same device as stores the totp token and generates the one time code? Doesn’t this effectively turn your password into a device that you have, effectively turning the first factor (something you know) into something you have, while the second factor (something you have) is the same thing you have from the first factor (your phone)?

Even people that do this incorrectly and reuse passwords, probably also store their passwords in their browser, which is on the same device as their authenticator app. So I would guess by far majority of people are only using something they have twice.

Re: Ask HN: Why is WebAuthn so slow to take off?

#47

Post by guerby »

bawolff wrote: post #18
egamirorrim wrote: post #11

I'm not a huge fan of removing the 'two' from 'two factor authentication'. If people can login with just their device, which could be stolen, I don't think it's as secure as a password+device based 2FA alternative

From a practical standpoint, i dont really think it matters. The real threat 2fa auth solves is the fact people blame the site operator when they are hacked. 90% of the time it is due to reusing a password. The other 10% it is due to phishing. WebAuthn stops both. 2FA works not because it adds another factor, but because it removes choice from the user so they can't screw it up.

Be careful to not lump all 2FA together: only FIDO2/webauthn second factor is immune to phishing.

evilginx will happily steal most other 2FA (TOTP, ...).

Re: Ask HN: Why is WebAuthn so slow to take off?

#49

Post by albertgoeswoof »

It’s easy to implement, the reason it’s not more popular is because services are including support for other 2FA options, and users pick the path of least resistance.

I wrote about this here https://blog.mailpace.com/blog/why-we-use-webauthn-for-2fa/

In short, we should implement webauthn, and only webauthn for 2FA

Re: Ask HN: Why is WebAuthn so slow to take off?

#50

Post by guerby »

cwalkatron wrote: post #43

I think it's because it's a pain to have one key per device. To solve this, you'd need a service like iCloud Keychain (for Apple devices), but that only works for Safari and other Apple stuff. I think once 3rd party apps (like 1Password - see https://www.future.1password.com/ ) start supporting the syncing of keys, you'll see more use. Alternatively, if you could use iCloud Keychain with Chrome and Firefox, maybe tha…

The whole point of a FIDO2 USB key is that the secret in it cannot be copied.

If it can be copied any malware will just copy it and done.

Post reply on HN