Web Authentication API
developer.mozilla.org
Web Authentication API
1–10 of 76 posts
Re: Web Authentication API
#2I'm a beginner in this area, but maybe someone can help me out. Would this be a replacement for something like Passport or Auth0?
Re: Web Authentication API
#3This is going to be _huge_ for the security of the average web user once it starts getting widespread adoption.
Credential phishing, password reuse, credential stuffing, and weak passwords are all about to be a thing of the past, at least insofar as the web is concerned.
Re: Web Authentication API
#4For people confused about what this is: it's basically the de facto cross-browser standard for U2F security keys like Yubikeys.
Re: Web Authentication API
#5For people confused about what this is: it's basically the de facto cross-browser standard for U2F security keys like Yubikeys.
More than that. Because it's an open standard it can be used with other types of authenticators, like password managers and platform-level security keys. There are also extensions allowing sites to prompt users for explicit authorization for a specific action. (e.g. "do you want to send $20 to xyz?")
In short, this could replace passwords for web authentication entirely.
Re: Web Authentication API
#6This is going to be _huge_ for the security of the average web user once it starts getting widespread adoption. Credential phishing, password reuse, credential stuffing, and weak passwords are all about to be a thing of the past, at least insofar as the web is concerned.
Doesn't this mean that if the authenticator is cracked then all of your accounts are revealed and become vulnerable?
Compared to the situation today when if one your passwords is cracked they can't immeidately access your other accounts.
Re: Web Authentication API
#7Anyone know when the Google websites will start using this? Would love to finally be able to use my Yubikey with Firefox and Google.
Re: Web Authentication API
#8This is going to be _huge_ for the security of the average web user once it starts getting widespread adoption. Credential phishing, password reuse, credential stuffing, and weak passwords are all about to be a thing of the past, at least insofar as the web is concerned.
Doesn't this mean that if the authenticator is cracked then all of your accounts are revealed and become vulnerable? Compared to the situation today when if one your passwords is cracked they can't immeidately access your other accounts.
It's no worse than them breaking into a password manager, and is quite a bit better since they now have to deal with full on private keys.
Most passwords are vulnerable because they are easily guessed, not because somebody breaks your encrypted password store.
Re: Web Authentication API
#9I wonder if you could use those keys also for encrypting content?
Re: Web Authentication API
#10This is going to be _huge_ for the security of the average web user once it starts getting widespread adoption. Credential phishing, password reuse, credential stuffing, and weak passwords are all about to be a thing of the past, at least insofar as the web is concerned.
Doesn't this mean that if the authenticator is cracked then all of your accounts are revealed and become vulnerable? Compared to the situation today when if one your passwords is cracked they can't immeidately access your other accounts.
Stealing Web Authentication keys from a hardware token is a significantly higher bar than phishing you or brute-forcing your password hash from a database leak. At the very _least_ the attacker would first have to compromise your machine with malware, at which point they could easily get access to all your password-protected accounts anyway with a simple keylogger.