Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why is WebAuthn so slow to take off?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 182 posts

Re: Ask HN: Why is WebAuthn so slow to take off?

#91

Post by fatfingerd »

itake wrote: post #72
perlgeek wrote: post #61

Earlier quoted context omitted.

You're listing only the negative aspects, but in truth it's all tradeoffs. What you get is fishing-resistant authentication, that's pretty easy to use. > And adding more devices is not the answer either. Why not? What's your ideal authentication solution? Two things I'd love to see: Something like Mozilla Persona, and maybe SSH key authentication in the browser. No idea how I'd manage and back up my key though. Don't…

As stated, devices fail, or get stolen. When I’m traveling and robbed, I won’t be able to get the backup device is hidden in my drawer at home

You also won't have access to the TOTP backup of emergency codes.. If you get hit on the head or have the trauma of your life you might not have a password.

These are tradeoffs that people use to balance security. Many people will lose to a sim swap despite not needing access to their life savings while on vacation with absolutely no proof of identity and a fallible memory.

Re: Ask HN: Why is WebAuthn so slow to take off?

#92

Post by account-5 »

perlgeek wrote: post #61
account-5 wrote: post #54

I'm glad it's slow, the current "solution" to tie your credentials to a device that can be lost, stolen, or broken with the option to sync them to a cloud controlled by big tech companies is abhorrent. And adding more devices is not the answer either.

You're listing only the negative aspects, but in truth it's all tradeoffs. What you get is fishing-resistant authentication, that's pretty easy to use. > And adding more devices is not the answer either. Why not? What's your ideal authentication solution? Two things I'd love to see: Something like Mozilla Persona, and maybe SSH key authentication in the browser. No idea how I'd manage and back up my key though. Don't…

I really only see the negatives here. This solution offers me nothing over my password manager other that way less control over my own stuff, more ways to be locked out of my accounts, with the slightly added benefit that I don't have to worry about a sites shitty security practices.

> What's your ideal authentication solution?

I've said before as soon as passkeys can be managed offline and aren't tied to devices I'll be all in. Keepassxc is my preferred solution just now.

Re: Ask HN: Why is WebAuthn so slow to take off?

#93

Post by microtonal »

rgreen wrote: post #89
alsdfjkslfheu wrote: post #74

Earlier quoted context omitted.

what's your key backup/recovery strategy?

recovery is easy. i'm a customer of all these companies so i have faith i'll be able to convince them i'm me if it comes to that. and i keep a handful of hardware keys to make self-recovery easier if i lose or break one. most of my practices are to mitigate risks i personally know how to mitigate, and doing it while causing myself as little headache as possible. being able to auth using touch id on my personal laptop…

Also, if you use iCloud for passkeys, Apple has has a procedure to regain iCloud access with a recovery contact:

https://support.apple.com/guide/security/account-recovery-co...

(No, that doesn't mean that the contact has access to your account, the encryption key is split between the contact and Apple by the device.)

Re: Ask HN: Why is WebAuthn so slow to take off?

#94

Post by rektide »

alsdfjkslfheu wrote: post #81
rektide wrote: post #76

Earlier quoted context omitted.

If nothing else, it has more bits of security than a password has & so is less crackable. It's also an official standard that should integrate effortlessly into apps & websites alike. Password Managers are- as far as I know- all bespoke solutions with their own custom implementations. Not having a common interoperable framing for implementation & extension limits user's control & optionality. The other major advantag…

> Standards enable flexibility which enables possibility. what?! standards are the opposite of flexible. by definition. here's something that is better than webauthn, published and battle tested since 2018, and nobody cares: https://hacks.mozilla.org/2018/11/firefox-sync-privacy/ it have all the advantages of webauthn, plus it is truly on-device, no middle man, you can easily recover keys simply by having more than o…

WebAuthn I think proves quite well how a common abstraction can enable constant ongoing growth & expansion. This case alone is a clear win for standards being a way to get the ball rolling.

Web Standards also tend to define what things look like for the page. They're a common interface for the developer. This does come with some constraints (but often some freedom/extensibility points are baked into specs too). What's notable is that implementation is replaceable. Different browsers can do different things, expose things in differnt ways.

Users can also deploy Web Extensions to modify or monkeypatch or polyfill webapis in ways that they want. This is another key advantage of standards, that they create a common target which is user-instrumentable. Without standards, users are forever adrift & subject to the mercy of the various proprietary implementations.

Re: Ask HN: Why is WebAuthn so slow to take off?

#95

Post by weare138 »

Doesn't WebAuthn require a Trusted Platform Module or an equivalent hardware solution, like trusted execution environments, for storing keys? This varies across hardware platforms and vendors which why I'm guessing solutions like WebAuthn haven't become ubiquitous yet.

Re: Ask HN: Why is WebAuthn so slow to take off?

#96

Post by fulafel »

weare138 wrote: post #95

Doesn't WebAuthn require a Trusted Platform Module or an equivalent hardware solution, like trusted execution environments, for storing keys? This varies across hardware platforms and vendors which why I'm guessing solutions like WebAuthn haven't become ubiquitous yet.

Its a per browser implementation decision, not required by the protocol. Chrome family browsers even ship a pure SW one but it's in the dev tools side.

Re: Ask HN: Why is WebAuthn so slow to take off?

#98

Post by ljm »

xoa wrote: post #78
alsdfjkslfheu wrote: post #73

Earlier quoted context omitted.

is passkey any better than a password manager, besides losing the option to set your own secure password that you can store offline?

Fully managed passkeys will always have the max needed entropy without any need for KDFs, never be reused, are amenable to a smooth path to hardware backing, and most importantly/fundamentally aren't symmetric factors. You don't need to share the private key with the website, and that in turn means that even if you stored it in plain text on your own computer you're still immune to the most common form of leaks which…

As I recall it, this is more or less what Mozilla wanted to do with Persona back in the day. That didn’t take off, but the approach with WebAuthN is perhaps an evolution of it especially in terms of making public key crypto user-friendly. Of course, the challenge is different in a multi-device world when you want your phone, tablet and laptop to all use the same login without using a hardware key.

Re: Ask HN: Why is WebAuthn so slow to take off?

#99

Post by flangola7 »

watermelon0 wrote: post #84
jameswestgate wrote: post #13

Earlier quoted context omitted.

WebAuthn to either a a hardware key protected by a pin, or to a passkey protected by a biometric. Both definitely qualify as 2FA

But there is no password, so we are back to 1FA, with Passkey being the single factor. This is similar to using password manager, with the exception that malware cannot steal your keys ... however, if it's able to steal passwords from password manager, there is a good chance that malware can also access your browser's cookies.

It is still 2FA. Something you have (passkey on a device) and something you are (LIDAR map of your face and pulse).

Re: Ask HN: Why is WebAuthn so slow to take off?

#100

Post by turnsout »

mszary wrote: post #62
turnsout wrote: post #36

Earlier quoted context omitted.

I'm honestly considering changing banks because my bank only supports SMS 2FA, and it triggers for every login. They need to at least adopt old school TOTP. In 2023, relying on SMS feels irresponsible for a side project let alone a bank.

Authentication is one thing. When it comes to banking - the authorization is the key (no pun intended ;) Believe it or not, SMS is still one of the best ways to authorize sensitive transactions, even when compared to other popular options like TOTP or FIDO. The cool thing about SMS is that it gives you more context about what you're authorizing, so you're not blindly accepting requests from the bank without understan…

I hear you, but the not so cool thing about SMS is how trivially easy it is to clone a SIM. My level of trust for information passing through the SMS channel is near-zero.
Post reply on HN