11–20 of 76 posts
For people confused about what this is: it's basically the de facto cross-browser standard for U2F security keys like Yubikeys.
Oh, I guess client certs are owned and controlled by the server owner...
Sadly i've got no idea how far away we are from this actually being implemented.
I'm a beginner in this area, but maybe someone can help me out. Would this be a replacement for something like Passport or Auth0?
This is going to be _huge_ for the security of the average web user once it starts getting widespread adoption. Credential phishing, password reuse, credential stuffing, and weak passwords are all about to be a thing of the past, at least insofar as the web is concerned.
Doesn't this mean that if the authenticator is cracked then all of your accounts are revealed and become vulnerable? Compared to the situation today when if one your passwords is cracked they can't immeidately access your other accounts.
Air gapped authenticators are plausible, although they'd be awful from a usability perspective, if you're really that paranoid...
Whereas all your passwords are just bits, and you have to transmit those bits to a remote party every time you authenticate. You can't keep those bits safe, only trust that everybody else is looking out for you and they're all competent. Good luck with that.
Anyone know when the Google websites will start using this? Would love to finally be able to use my Yubikey with Firefox and Google.
Anyone know when the Google websites will start using this? Would love to finally be able to use my Yubikey with Firefox and Google.
you can partialy (password + second factor authentication) use this when using 2FA with your Google account, https://support.yubico.com/support/solutions/articles/150000...
I wonder if you could use those keys also for encrypting content?
Using the same key for unrelated things can result in unpleasant surprises. So it's to be avoided.
If you have a crappy insecure email server that uses SSLv3 still, and uses the same key as your tightly locked down Web server with TLS 1.2 then this bites you really badly, I can use the email server to help me impersonate your web server.
For people confused about what this is: it's basically the de facto cross-browser standard for U2F security keys like Yubikeys.
I wonder if you could use those keys also for encrypting content?
Earlier quoted context omitted.
Doesn't this mean that if the authenticator is cracked then all of your accounts are revealed and become vulnerable? Compared to the situation today when if one your passwords is cracked they can't immeidately access your other accounts.
Stealing Web Authentication keys from a hardware token is a significantly higher bar than phishing you or brute-forcing your password hash from a database leak. At the very _least_ the attacker would first have to compromise your machine with malware, at which point they could easily get access to all your password-protected accounts anyway with a simple keylogger.