Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

W3C approves WebAuthn as the web standard for password-free logins

venturebeat.com

Post reply on HN
Print view View original

31–40 of 154 posts

Re: W3C approves WebAuthn as the web standard for password-free logins

#31

Post by DCKing »

Never change, Hacker News. Finally we have a somewhat credible alternative to the extremely broken current system of everybody and their grandmother having to perform their own password management. A system that solves large parts of the reuse, reversability and replayability of passwords with appropriate technical sophistication as well as buy-in from organizations that will be able to change the system in practice. A system that acknowledges that the vast majority of current and future internet users have appropriate hardware to perform far more secure authentication in their pockets.

And the comments are filled with grumpy contrarians, complaining how it doesn't work for them personally, doesn't work for the general public, or even doesn't work in general. As if what we currently have is even close to fine. Surely WebAuthn is by no means a perfect system, but I sure am happy it exists and hope it has a great future.

Re: W3C approves WebAuthn as the web standard for password-free logins

#32

Post by Freak_NL »

tialaramex wrote: post #17
AnaniasAnanas wrote: post #13

What does this solve exactly? We already have client-side certificates in TLS, am I missing something?

Aside from the awful UX of client certs, which we could imagine being fixed, FIDO tokens are very narrowly conceived to solve the exact second factor problem - and nothing else. If you do client certs you've got this whole identity thing baked into the certs. But the FIDO token doesn't have an identity, it only knows how to prove it's still the same FIDO token you had before. So that's immediately much better. If I u…

Also with a decent WebAuthn implementation (e.g., FIDO U2F hardware tokens, or using a TPM), the private key material cannot be copied by a compromised device, or even by someone with direct access to the hardware (unless they actually disassemble the hardware with quite professional hardware).

Client-side certificates are a great technology, but you can copy the certificates without the owner knowing it. Getting the password is just a matter of social engineering or (further) compromising the device. It beats plain username plus password though!

Re: W3C approves WebAuthn as the web standard for password-free logins

#33

Post by wccrawford »

detaro wrote: post #2

W3C press release: https://www.w3.org/2019/03/pressrelease-webauthn-rec.html

https://www.w3.org/2019/03/pressrelease-webauthn-rec.html.en

English version. (It wasn't originally in English for me, but maybe it was autodetecting something?)

Re: W3C approves WebAuthn as the web standard for password-free logins

#34

Post by wccrawford »

The last time I saw 2fa and fido talked about on here, someone recommended a set of 2 keys, but they ones they recommended are now out of stock.

Does anyone have a recommendation with the reason?

Thanks.

Edit: With the reason. Jeez, what a typo.

Re: W3C approves WebAuthn as the web standard for password-free logins

#35

Post by chrisweekly »

I recently used auth0 to implement passwordless login (via "magic link" emails) for a client project. Auth0's documentation is not great, but some of their blog posts are pretty good. In any case, if you're interested in WebAuthN, you could do worse than reading what Auth0 has to say about it:

https://auth0.com/blog/web-authentication-webauthn-overview-...

Re: W3C approves WebAuthn as the web standard for password-free logins

#36

Post by MrStonedOne »

tl;dr: Every downside to 2fa is out of scope, so this doesn't solve them, and doesn't require sites solve them.

It then suggests using this as both factors.

Most of all is reliability.

all "Something you have" based factors have one key issue, reliability.

Backup codes are not a solution, I'm not going to have those when i'm at a friends house and get an alert the server is dead but i left my token at home.

Customer service is not a solution, its hard getting me to change my address in the millions of places that have it, now I have to call up, to change my token, because I lost it and have no idea where the fuck i put the backup codes? Across the millions of websites I have an account on? Where each provides their own backup codes?

Backup tokens are barely a solution. In that they only work once, lose your backup token and you are back to the above. At the least you now have to buy another one to become the new backup and go and load it on to all of your sites.

I can't lose, break, forget at home, or otherwise invalidate a password. I can forget it outright, something we know a lot of about, and something we have workflows setup to deal with, some better than others, but I can't just one day lose it and get locked out of everything, I would have to forget all of my passwords simultaneously to do that.

2fa for people who care about it seeing adoption: cloneable tokens. I shouldn't need to re-setup my token across every site when it lose it. Habadab about security all you want, as long as this is a barrier to entry it will stay a barrier.

Also, with fancy crypo, it would be piss easy to make a token key base where each token had its own key and that key can be revoked, but in a way where all tokens work out of the box once you add 1 to a site.

Re: W3C approves WebAuthn as the web standard for password-free logins

#37

Post by deadmetheny »

dustinmoris wrote: post #25
deadmetheny wrote: post #11

Earlier quoted context omitted.

Biometrics are just fine as a username or one factor of a MFA, but they are terrible for usage as a password due to the simple fact that if they are ever compromised, they cannot be changed.

The truth is though that everyone is using biometrics to log into their device which controls everything from emails, to password managers and 2FA codes. Does it mean if your fingerprint gets compromised that you'll be unable to use the biometric feature of any device for the rest of your life? It's a good point which you raise, but ultimately biometrics will be the best way to authenticate someone. It might have to…

>Does it mean if your fingerprint gets compromised that you'll be unable to use the biometric feature of any device for the rest of your life?

No, it just means that it shouldn't be treated as a password in a username+password setup. It's still perfectly usable for a MFA setup.

>if someone is able to reproduce all your unique attributes of who you are then nothing will probably hold them back to reset your password manager, email and what not either

This is exactly why everyone really ought to be using MFA - biometrics are a good identifier and are strongest in conjuncture with a knowledge or physical-item-based authentication. These too can be defeated, but having to nick a physical object, trick the user into revealing a password or similar knowledge-based key, and reproducing a fingerprint/facial/retinal/whatever scan is much more time-consuming.

Re: W3C approves WebAuthn as the web standard for password-free logins

#38

Post by Outpox »

wccrawford wrote: post #33
detaro wrote: post #2

W3C press release: https://www.w3.org/2019/03/pressrelease-webauthn-rec.html

https://www.w3.org/2019/03/pressrelease-webauthn-rec.html.en English version. (It wasn't originally in English for me, but maybe it was autodetecting something?)

It was in my native language (French). According to the "Translation" link[0] it's available in English, Japanese, Chinese and French.

[0] https://www.w3.org/Press/Releases-2019#webauthn-rec

Re: W3C approves WebAuthn as the web standard for password-free logins

#39

Post by acdha »

dustinmoris wrote: post #25
deadmetheny wrote: post #11

Earlier quoted context omitted.

Biometrics are just fine as a username or one factor of a MFA, but they are terrible for usage as a password due to the simple fact that if they are ever compromised, they cannot be changed.

The truth is though that everyone is using biometrics to log into their device which controls everything from emails, to password managers and 2FA codes. Does it mean if your fingerprint gets compromised that you'll be unable to use the biometric feature of any device for the rest of your life? It's a good point which you raise, but ultimately biometrics will be the best way to authenticate someone. It might have to…

> The truth is though that everyone is using biometrics to log into their device which controls everything from emails, to password managers and 2FA codes. Does it mean if your fingerprint gets compromised that you'll be unable to use the biometric feature of any device for the rest of your life?

No, because the device is only using that to protect local storage and anything which leaves the device is using strong keys which can be rotated. If they don't have the device, the fingerprint doesn't matter. If they do have the device (and are within the timeout period, etc.), it's like any other credential compromise: you get a replacement, rotate passwords, etc. but the replay value is sharply capped because at no point is a network service depending on the component which can't be changed.

(If you have an attacker who gets a scan of your fingerprint/face and keeps stealing phones you need a restraining order; that's reasonably outside of the threat model for consumer devices)

This is also important since there's a subset of users who won't be able to use biometrics for some reason and the decoupled approach avoids making it impossible for them to use.

Post reply on HN