I wonder why I barely see this option on websites altough it seems so perfect to me. Is the WebAuthn protocol complicated to implement or are there any other downsides I might overlook?
Ask HN: Why is WebAuthn so slow to take off?
1–10 of 182 posts
Re: Ask HN: Why is WebAuthn so slow to take off?
#2[deleted]
Re: Ask HN: Why is WebAuthn so slow to take off?
#3[deleted]
Re: Ask HN: Why is WebAuthn so slow to take off?
#4I would say because it relies on an hardware key, which few of your users are going to have anyway. Any tech requiring an hardware component is going to be much slower to deploy.
I know there is still much interest in deploying it for internal/employee authentication in large organizations where you control the app login and the employee hardware. Some organizations that wrongly deployed multi factor auth based on SMS have realized that was a poor choice and are looking for alternatives.
Re: Ask HN: Why is WebAuthn so slow to take off?
#5Not sure everywhere else, but within the Ruby community the ‘devise’ gem is most popular auth plugin.
Discussion are currently underway as to how to refactor the code to make passwords second class citizens. And further whether to factor in design for MFA or just to bypass straight to adding passkey support.
It’s major replumbing to essentially move username/password to be one of many, within the auth framework.
Once this is resolved in devise thousands of Ruby/rails apps could add support overnight, but it seems to be getting a little stuck on the question of the best way forward (and someone to do all that heavy lifting).
Join the conversation if you have something valuable to add:
Re: Ask HN: Why is WebAuthn so slow to take off?
#6I would say because it relies on an hardware key, which few of your users are going to have anyway. Any tech requiring an hardware component is going to be much slower to deploy. I know there is still much interest in deploying it for internal/employee authentication in large organizations where you control the app login and the employee hardware. Some organizations that wrongly deployed multi factor auth based on SM…
> I would say because it relies on an hardware key
This isn’t true on Apple, Google, or Microsoft devices which have a trusted hardware store – I use my MBP’s Secure Enclave for 90% of my logins since it’s just a Touch ID check.
Re: Ask HN: Why is WebAuthn so slow to take off?
#7I'm currently looking into deploying hardware keys for some of our users at work (mostly through Microsoft SSO which is FIDO2 passwordless), and one of the roadblock on our end is the inability to define our own minimum requirements for the PIN. Educating our users about the importance of using a secure PIN is indeed a priority, but it would be nice from a security standpoint of we could enforce some policies on our end to at least eliminate the possibility of settings some obviously weak PIN (0000, 1234, etc)
Re: Ask HN: Why is WebAuthn so slow to take off?
#8I'm currently looking into deploying hardware keys for some of our users at work (mostly through Microsoft SSO which is FIDO2 passwordless), and one of the roadblock on our end is the inability to define our own minimum requirements for the PIN. Educating our users about the importance of using a secure PIN is indeed a priority, but it would be nice from a security standpoint of we could enforce some policies on our…
Why do you require a pin at all?
The point of hardware keys is to protect against online takeover. Physical access is usually game over either way
Re: Ask HN: Why is WebAuthn so slow to take off?
#9It’s not that bad to implement, especially since there are a lot of OSS libraries.
The problem IMO is that it will, for most use cases, unconditionally authenticate you to a browser, not a physical token. And that will confuse a lot of people (and make some security engineers twitch).
Why not a token? Lets be frank, pretty much nobody has a yubikey style token, and getting average users to use their phone as a token over Bluetooth is a recipe for support apocalypse.
For bonus adoption friction, IT has trained a generation or two of users to not click on anything that could possibly compromise a computer. And webauthn requires actions often associated with granting permissions to your computer (Touch ID, Bluetooth access, plugging something into usb, etc).
Re: Ask HN: Why is WebAuthn so slow to take off?
#10I would say because it relies on an hardware key, which few of your users are going to have anyway. Any tech requiring an hardware component is going to be much slower to deploy. I know there is still much interest in deploying it for internal/employee authentication in large organizations where you control the app login and the employee hardware. Some organizations that wrongly deployed multi factor auth based on SM…
> I would say because it relies on an hardware key This isn’t true on Apple, Google, or Microsoft devices which have a trusted hardware store – I use my MBP’s Secure Enclave for 90% of my logins since it’s just a Touch ID check.
Well, there is a hardware key, it's just that it's the device you're using.