21–30 of 46 posts
It worked fine on Mac, curious how does it work on Windows?
I do wonder what the macOS workflow looks like, especially if you don't have a fingerprint reader on your keyboard.
I'm confused how this works. I tried the demo and Bitwarden asked me if I wanted to save the passkey. From a UX experience, this felt weird.. Why do I need to create an account, and save that account? Why is passkey storage prevent bots? Just that bots haven't added that automation yet?
The benefit of this approach is that a bot doesn't have the private key.
Of course you want to be sure that webauthn on boarding can't be botted.
Honestly I just want government backed digital ID for this stuff. I know the concerns. I no longer care. The benefits outweight the costs, imho. I want to be able to tell a site "yes I'm Martin here's proof either ban me or let me in but stop making me jump through hoops to prove ID. And so that social sites I use will no longer have to deal with undesired non-unique accounts for bot swarms and sockpuppets and the li…
Earlier quoted context omitted.
there is attestation of the registration device in webauthn so you can tell that a token was signed by an official yubikey, apple secure enclave, tpm, etc for yubikeys the attestation signing certificate is shared between devices, but this number is limited so you could rate limit... just it would be a horrible experience when you are limited
I don’t see that in the code. But you’re right that there is something heuristic you can do.
I'm confused how this works. I tried the demo and Bitwarden asked me if I wanted to save the passkey. From a UX experience, this felt weird.. Why do I need to create an account, and save that account? Why is passkey storage prevent bots? Just that bots haven't added that automation yet?
Passkey can be thought of as software emulation of a smartcard (aka hard token aka Yubikey). When it asks you to save it, that's when it creates the virtual smartcard in some reasonably secure local storage (possibly TPM-secured or at least kernel-secured). The benefit of this approach is that a bot doesn't have the private key. Of course you want to be sure that webauthn on boarding can't be botted.
But, also.. A hardcoded “what’s 7\1=“ would also achieve the same outcome.
Barrier to beat is “can the attacker put together a webauthn emulator”. Low, but will work for many organisations for a long time.
This is neither a new idea or a good one. Cloudflare did a PR launch of pretty much the same thing a few years back, and that you haven't actually seen it in the wild probably tells you all you need to know about how useful it is. Webauthn is not an integrity attestation; it doesn't tell you anything about how trustworthy the client is. Nor is it a uniqueness attestation; an attacker can mint an arbitrary number of d…
there is attestation of the registration device in webauthn so you can tell that a token was signed by an official yubikey, apple secure enclave, tpm, etc for yubikeys the attestation signing certificate is shared between devices, but this number is limited so you could rate limit... just it would be a horrible experience when you are limited
As other commenters have said, a better solution needs to be something that is prohibitively difficult for bots to mint. I’m sure there are a few contenders in the space but one I’m aware of is [worldcoin]( https://world.org/ )
Worldcoin has always creeped me out since this: https://d1sr9z1pdl3mb7.cloudfront.net/wp-content/uploads/202...
This is neither a new idea or a good one. Cloudflare did a PR launch of pretty much the same thing a few years back, and that you haven't actually seen it in the wild probably tells you all you need to know about how useful it is. Webauthn is not an integrity attestation; it doesn't tell you anything about how trustworthy the client is. Nor is it a uniqueness attestation; an attacker can mint an arbitrary number of d…
there is attestation of the registration device in webauthn so you can tell that a token was signed by an official yubikey, apple secure enclave, tpm, etc for yubikeys the attestation signing certificate is shared between devices, but this number is limited so you could rate limit... just it would be a horrible experience when you are limited
Earlier quoted context omitted.
there is attestation of the registration device in webauthn so you can tell that a token was signed by an official yubikey, apple secure enclave, tpm, etc for yubikeys the attestation signing certificate is shared between devices, but this number is limited so you could rate limit... just it would be a horrible experience when you are limited
What about for software implementations like 1Password and Bitwarden?