Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

W3C approves WebAuthn as the web standard for password-free logins

venturebeat.com

Post reply on HN
Print view View original

11–20 of 154 posts

Re: W3C approves WebAuthn as the web standard for password-free logins

#11

Post by deadmetheny »

dustinmoris wrote: post #3

I was saying for a long time that a new protocol for a biometric driven login scheme should become the new default. We use biometrics to log into our phone, then a password manager uses the same biometric to authenticate on the same device to log me into a website by auto populating the username + password for me. Afterwards I'll get a 2FA confirmation on the same device which again I'll have to confirm via the same…

Biometrics are just fine as a username or one factor of a MFA, but they are terrible for usage as a password due to the simple fact that if they are ever compromised, they cannot be changed.

Re: W3C approves WebAuthn as the web standard for password-free logins

#14

Post by agentultra »

Does anyone else find these informal specifications difficult to digest?

The informative appendices link to papers on TPM and the like but it's hard to find a formal description of the protocol, or at least the sensitive parts, that could be independently validated or verified.

Has there been any work to formally verify/validate the design of this protocol that I'm not seeing?

Re: W3C approves WebAuthn as the web standard for password-free logins

#15

Post by tlholaday »

MrStonedOne wrote: post #12

https://www.troyhunt.com/heres-why-insert-thing-here-is-not-...

Troy Hunt writes ...

> I'm referring to passwordless solutions that involves things like QR codes, pictorial representations, 3rd party mobile apps, dedicated hardware devices or "magic" links sent via email.

Which of these is AuthN, in your view?

Edit:

Troy Hunt also writes ...

> WebAuthn has the potential to be awesome, not least of which because it's a W3C initiative and not a vendor pushing their cyber thing. But it's also extremely early days and even then, as with [insert things here], it will lead to a change in process that brings with it friction. The difference though - the great hope - is that it might redefine authentication to online services in an open, standardised way and ultimately achieve broad adoption. But that's many years out yet.

.., so perhaps the many years have passed.

Re: W3C approves WebAuthn as the web standard for password-free logins

#17

Post by tialaramex »

AnaniasAnanas wrote: post #13

What does this solve exactly? We already have client-side certificates in TLS, am I missing something?

Aside from the awful UX of client certs, which we could imagine being fixed, FIDO tokens are very narrowly conceived to solve the exact second factor problem - and nothing else.

If you do client certs you've got this whole identity thing baked into the certs. But the FIDO token doesn't have an identity, it only knows how to prove it's still the same FIDO token you had before. So that's immediately much better.

If I use a client cert to sign into GitHub and Facebook, it's a matter of moments for that to be correlated. If I share the client cert with my sister or a colleague, again easily correlated.

But with WebAuthn there's nothing to correlate. The only way to check that Bill and Suzy are using the same FIDO token is to wait until say Bill tries to log in, and ask his token to prove that it's still Suzy's token. This requires a physical interaction (e.g. button press) from Bill. If the guess was wrong you learn nothing but Bill notices it didn't work. So, maybe, if you're nearly certain but just want to be 100% that could work, but ordinarily it's not viable at all.

Re: W3C approves WebAuthn as the web standard for password-free logins

#18

Post by Ysx »

aboutruby wrote: post #7
mgoetzke wrote: post #4

If only Microsoft hadn't chosen to use the code-name Hailstorm for its authentication proposal back in the days (and generally had a better image and a more open approach etc). Would have alleviated a lot of the pain earlier.

2009: https://www.cnet.com/news/microsofts-hailstorm-unleashed/ Seems like an SSO based on Microsoft services (msn.com/hotmail.com). Somehow also seems .NET specific.

It's probably not the .NET you're thinking of: "By 2003, however, the .NET strategy had dwindled into a failed branding campaign"

https://en.wikipedia.org/wiki/Microsoft_.NET_strategy

Re: W3C approves WebAuthn as the web standard for password-free logins

#20

Post by eldridgea »

MrStonedOne wrote: post #12

https://www.troyhunt.com/heres-why-insert-thing-here-is-not-...

Troy specifically addresses WebAuthn in that post but only as a 2fa mechanism (which is an optional way to use it). He doesn't address it as a standard to replace passwords.

His premise of the post is that passwordless mechanisms are non-standard and difficult to use. WebAuthn can be used easily and implemented by anyone as it is now an open standard.

Trpy's article is great, as always, and I'm not invalidating anything he said. But this particular post of his is intentionally a more short-term look at proprietary solutions, not a longer term view of evolving standards.

Post reply on HN