Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why is WebAuthn so slow to take off?

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 182 posts

Re: Ask HN: Why is WebAuthn so slow to take off?

#81

Post by alsdfjkslfheu »

rektide wrote: post #76
alsdfjkslfheu wrote: post #73

Earlier quoted context omitted.

is passkey any better than a password manager, besides losing the option to set your own secure password that you can store offline?

If nothing else, it has more bits of security than a password has & so is less crackable. It's also an official standard that should integrate effortlessly into apps & websites alike. Password Managers are- as far as I know- all bespoke solutions with their own custom implementations. Not having a common interoperable framing for implementation & extension limits user's control & optionality. The other major advantag…

> Standards enable flexibility which enables possibility.

what?! standards are the opposite of flexible. by definition.

here's something that is better than webauthn, published and battle tested since 2018, and nobody cares: https://hacks.mozilla.org/2018/11/firefox-sync-privacy/

it have all the advantages of webauthn, plus it is truly on-device, no middle man, you can easily recover keys simply by having more than one device... no server can read or data. only silly thing is that firefox insists on shipping with the auto-fill option enabled by default.

only feature missing that this thread seems to brings up is support for external usb devices (which i personally don't care for, but is probably on the roadmap)

--

i'm blocked from adding replies, so replying here:

> it does passwords not keys

well, that is what worked on 100% the internet in 2018 (and today, ha!). But it is a data store where you have full control. ironically this is what gives true flexibility, a well designed system with fully open source implementation and apis, not spec by ad vendors as claimed before. anyway, The existing browser implementation does passwords (and bookmarks!!!) but you can extend to be a distributed yubikey if you'd like. nothing is blocking you. as I said, it is something better than a hardware store, better than a cloud broker for your identity, etc... but nobody cares. And now that FIDO has marketing from the big Advertisers everyone wants it yesterday.

Re: Ask HN: Why is WebAuthn so slow to take off?

#82

Post by cvwright »

I don’t know the answer, but this is a pet peeve of mine.

It’s especially frustrating when sites won’t let you enroll for 2FA with a hardware token. Instead they require that you start with some crap “authenticator” app first. Looking at you here, Gitlab and ProtonMail.

Re: Ask HN: Why is WebAuthn so slow to take off?

#83

Post by gtirloni »

rektide wrote: post #76
alsdfjkslfheu wrote: post #73

Earlier quoted context omitted.

is passkey any better than a password manager, besides losing the option to set your own secure password that you can store offline?

If nothing else, it has more bits of security than a password has & so is less crackable. It's also an official standard that should integrate effortlessly into apps & websites alike. Password Managers are- as far as I know- all bespoke solutions with their own custom implementations. Not having a common interoperable framing for implementation & extension limits user's control & optionality. The other major advantag…

1Password has passkeys in beta.

Re: Ask HN: Why is WebAuthn so slow to take off?

#84

Post by watermelon0 »

jameswestgate wrote: post #13
egamirorrim wrote: post #11

I'm not a huge fan of removing the 'two' from 'two factor authentication'. If people can login with just their device, which could be stolen, I don't think it's as secure as a password+device based 2FA alternative

WebAuthn to either a a hardware key protected by a pin, or to a passkey protected by a biometric. Both definitely qualify as 2FA

But there is no password, so we are back to 1FA, with Passkey being the single factor.

This is similar to using password manager, with the exception that malware cannot steal your keys ... however, if it's able to steal passwords from password manager, there is a good chance that malware can also access your browser's cookies.

Re: Ask HN: Why is WebAuthn so slow to take off?

#85

Post by mattrick »

cvwright wrote: post #82

I don’t know the answer, but this is a pet peeve of mine. It’s especially frustrating when sites won’t let you enroll for 2FA with a hardware token. Instead they require that you start with some crap “authenticator” app first. Looking at you here, Gitlab and ProtonMail.

I believe Gitlab has supported hardware keys for years now. At least Gitlab.com, not sure about the self hosted one.

Re: Ask HN: Why is WebAuthn so slow to take off?

#86

Post by gtirloni »

edude03 wrote: post #22

My guess as someone who's been in a position to implement it a few times but haven't gotten to: - "Upstream" Support, For various combinations of stacks I've worked on, there has always been one component that didn't support it cleanly, (Flutter x Ory was my last attempt for example). If it was as easy as "just" enabling it I'm sure it'd be more popular, but when your provider or tech stack doesn't support it out of…

This is it, really. Companies have incentives to adopt this at the moment.

Re: Ask HN: Why is WebAuthn so slow to take off?

#87

Post by tadfisher »

alsdfjkslfheu wrote: post #81
rektide wrote: post #76

Earlier quoted context omitted.

If nothing else, it has more bits of security than a password has & so is less crackable. It's also an official standard that should integrate effortlessly into apps & websites alike. Password Managers are- as far as I know- all bespoke solutions with their own custom implementations. Not having a common interoperable framing for implementation & extension limits user's control & optionality. The other major advantag…

> Standards enable flexibility which enables possibility. what?! standards are the opposite of flexible. by definition. here's something that is better than webauthn, published and battle tested since 2018, and nobody cares: https://hacks.mozilla.org/2018/11/firefox-sync-privacy/ it have all the advantages of webauthn, plus it is truly on-device, no middle man, you can easily recover keys simply by having more than o…

Firefox syncs passwords, not keys. Passwords can be reused, stolen, or leaked, all of which cannot be done to WebAuthn keys.

Re: Ask HN: Why is WebAuthn so slow to take off?

#88

Post by doodlesdev »

mattrick wrote: post #85
cvwright wrote: post #82

I don’t know the answer, but this is a pet peeve of mine. It’s especially frustrating when sites won’t let you enroll for 2FA with a hardware token. Instead they require that you start with some crap “authenticator” app first. Looking at you here, Gitlab and ProtonMail.

I believe Gitlab has supported hardware keys for years now. At least Gitlab.com, not sure about the self hosted one.

Also Protonmail supports both U2F and FIDO2. Introduced october last year [0].

[0]: https://proton.me/blog/security-keys

Re: Ask HN: Why is WebAuthn so slow to take off?

#89

Post by rgreen »

alsdfjkslfheu wrote: post #74
rgreen wrote: post #70

Earlier quoted context omitted.

hard disagree. my favorite workflow for high value accounts is webauthn backed by secure enclave with hardware key backups. it's really low friction from ux perspective and it frustrates me when sites don't support it.

what's your key backup/recovery strategy?

recovery is easy. i'm a customer of all these companies so i have faith i'll be able to convince them i'm me if it comes to that. and i keep a handful of hardware keys to make self-recovery easier if i lose or break one. most of my practices are to mitigate risks i personally know how to mitigate, and doing it while causing myself as little headache as possible. being able to auth using touch id on my personal laptop is great for day to day usage.

Re: Ask HN: Why is WebAuthn so slow to take off?

#90

Post by somat »

Apreche wrote: post #25
egamirorrim wrote: post #11

I'm not a huge fan of removing the 'two' from 'two factor authentication'. If people can login with just their device, which could be stolen, I don't think it's as secure as a password+device based 2FA alternative

Some people, who are not me, say that it's still two because they have to have the device but also have to be able to unlock the device.

I have heard arguments that using a password locked ssh key is two factor authentication for the same reason, that is, what you have(the ssh key) and what you know(the password to unlock it)

However I am not convinced, I think it comes down to dependency of factors in the auth scheme, if one factor unlocks another factor there only really is one factor, all factors must independently lock.

Post reply on HN