W3C approves WebAuthn as the web standard for password-free logins
1–10 of 154 posts
Re: W3C approves WebAuthn as the web standard for password-free logins
#2W3C press release: https://www.w3.org/2019/03/pressrelease-webauthn-rec.html
Re: W3C approves WebAuthn as the web standard for password-free logins
#3I was saying for a long time that a new protocol for a biometric driven login scheme should become the new default. We use biometrics to log into our phone, then a password manager uses the same biometric to authenticate on the same device to log me into a website by auto populating the username + password for me. Afterwards I'll get a 2FA confirmation on the same device which again I'll have to confirm via the same biometric. Instead of having so many moving parts which all boil down to authenticate via a single vector (my fingerprint or eye) on a single device we might as well have a new auth scheme and get away with insecure passwords and expensive password managers and replace them all with a new biometric driven login scheme.
Yes, there are still some issues that biometrics don't solve, but they should not be a concern to most websites. If everything authenticates me via my AppleID (which uses FaceID or Fingerprint) then I only need to remember one password for Apple - which is just the same as remembering one password for a third party password manager - except it's overall much safer and better for me as a user as I don't have to upload all my online identities to yet another third party that I don't know anything about (= password managers).
Re: W3C approves WebAuthn as the web standard for password-free logins
#4If only Microsoft hadn't chosen to use the code-name Hailstorm for its authentication proposal back in the days (and generally had a better image and a more open approach etc). Would have alleviated a lot of the pain earlier.
Re: W3C approves WebAuthn as the web standard for password-free logins
#5I was saying for a long time that a new protocol for a biometric driven login scheme should become the new default. We use biometrics to log into our phone, then a password manager uses the same biometric to authenticate on the same device to log me into a website by auto populating the username + password for me. Afterwards I'll get a 2FA confirmation on the same device which again I'll have to confirm via the same…
You acknowledge that biometrics have some issues they don't solve. Not being easy to steal is one of them. The problem is that you leave your fingerprint all over the place, including all over your phone, there are likely multiple pictures of you publicly available that can be used to construct a model to fool Face ID etc. Most biometrics only provide really minimal security, and the ones that provide anything more don't provide much and are inconvenient.
I use my fingerprint to prevent people casually browsing my phone if I leave it on the table while I pee, but I wouldn't rely on it for more than that, and neither should other people.
You need something else (a key, password or something) to secure most things as well as just your fingerprint.
Re: W3C approves WebAuthn as the web standard for password-free logins
#6I was saying for a long time that a new protocol for a biometric driven login scheme should become the new default. We use biometrics to log into our phone, then a password manager uses the same biometric to authenticate on the same device to log me into a website by auto populating the username + password for me. Afterwards I'll get a 2FA confirmation on the same device which again I'll have to confirm via the same…
You acknowledge that biometrics have some issues they don't solve. Not being easy to steal is one of them. The problem is that you leave your fingerprint all over the place, including all over your phone, there are likely multiple pictures of you publicly available that can be used to construct a model to fool Face ID etc. Most biometrics only provide really minimal security, and the ones that provide anything more d…
You miss a crucial point though, if you fake my fingerprint you still need my personal device to authenticate with it. You can't just use a copy of my fingerprint and set up a new iPhone with it without confirming at least on one other previously confirmed device or a second factor. So when you need to fake my biometric AND get hold of my personal device then you have to solve the exact same problem asnif I was using a password+ password manager.
Re: W3C approves WebAuthn as the web standard for password-free logins
#7If only Microsoft hadn't chosen to use the code-name Hailstorm for its authentication proposal back in the days (and generally had a better image and a more open approach etc). Would have alleviated a lot of the pain earlier.
2009: https://www.cnet.com/news/microsofts-hailstorm-unleashed/
Seems like an SSO based on Microsoft services (msn.com/hotmail.com). Somehow also seems .NET specific.
Re: W3C approves WebAuthn as the web standard for password-free logins
#8I was saying for a long time that a new protocol for a biometric driven login scheme should become the new default. We use biometrics to log into our phone, then a password manager uses the same biometric to authenticate on the same device to log me into a website by auto populating the username + password for me. Afterwards I'll get a 2FA confirmation on the same device which again I'll have to confirm via the same…
WebAuthn doesn't preclude the use of biometrics locally. Whether you securely store and use a private key in a discrete hardware key like a U2F token, or in a computing device's TPM chip secured (locally!) by a biometric access check; it boils down to the same mechanism WebAuthn describes.
WebAuthn rightly does not push biometrics beyond what you can do with them on a local device. It would be a privacy nightmare!
Re: W3C approves WebAuthn as the web standard for password-free logins
#9Earlier quoted context omitted.
You acknowledge that biometrics have some issues they don't solve. Not being easy to steal is one of them. The problem is that you leave your fingerprint all over the place, including all over your phone, there are likely multiple pictures of you publicly available that can be used to construct a model to fool Face ID etc. Most biometrics only provide really minimal security, and the ones that provide anything more d…
You miss a crucial point though, if you fake my fingerprint you still need my personal device to authenticate with it. You can't just use a copy of my fingerprint and set up a new iPhone with it without confirming at least on one other previously confirmed device or a second factor. So when you need to fake my biometric AND get hold of my personal device then you have to solve the exact same problem asnif I was using…
You can do that with WebAuthn; it's up to Apple to implement it. They seem to be previewing it in Safari this year.
Re: W3C approves WebAuthn as the web standard for password-free logins
#10If only Microsoft hadn't chosen to use the code-name Hailstorm for its authentication proposal back in the days (and generally had a better image and a more open approach etc). Would have alleviated a lot of the pain earlier.
2009: https://www.cnet.com/news/microsofts-hailstorm-unleashed/ Seems like an SSO based on Microsoft services (msn.com/hotmail.com). Somehow also seems .NET specific.
[deleted]