Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

W3C approves WebAuthn as the web standard for password-free logins

venturebeat.com

Post reply on HN
Print view View original

41–50 of 154 posts

Re: W3C approves WebAuthn as the web standard for password-free logins

#41

Post by smush »

dustinmoris wrote: post #25
deadmetheny wrote: post #11

Earlier quoted context omitted.

Biometrics are just fine as a username or one factor of a MFA, but they are terrible for usage as a password due to the simple fact that if they are ever compromised, they cannot be changed.

The truth is though that everyone is using biometrics to log into their device which controls everything from emails, to password managers and 2FA codes. Does it mean if your fingerprint gets compromised that you'll be unable to use the biometric feature of any device for the rest of your life? It's a good point which you raise, but ultimately biometrics will be the best way to authenticate someone. It might have to…

> The truth is though that everyone is using biometrics to log into their device

Not to be pendantic, but not _everyone_ uses biometrics to log into their device, either due to lack of hardware or due to lack of trust in said hardware.

Re: W3C approves WebAuthn as the web standard for password-free logins

#42

Post by WorldMaker »

mgoetzke wrote: post #4

If only Microsoft hadn't chosen to use the code-name Hailstorm for its authentication proposal back in the days (and generally had a better image and a more open approach etc). Would have alleviated a lot of the pain earlier.

Hailstorm was always just a very early version of what today we see in OAuth/OpenID Connect.

The one that we should be truly sad didn't connect with enterprises/consumers was Vista-era CardSpace (http://en.wikipedia.org/wiki/Windows_CardSpace). That was an early play at what today we are finally seeing in FIDO / Webauthn standards, with a rather good UX to go with it (using the visual metaphor of plastic cards/credit cards for PKI identities).

Albeit with the usual problems that that version of Microsoft only supported Internet Explorer on Windows Vista+. The standards behind it (PKI and SAML) should have been interoperable enough that other implementations would have been possible, but the Microsoft of that era wouldn't have been the one to build it. Had they supported XP, and had they supported Firefox/Chrome maybe more people would have heard about CardSpace at all.

ETA: Wikipedia points out it did ship for XP at least with the giant .NET Framework 3.0 upgrade that almost no one actually installed on XP. I had forgot that.

Re: W3C approves WebAuthn as the web standard for password-free logins

#44

Post by smacktoward »

tofflos wrote: post #40

https://caniuse.com/#search=webauthn

That's... actually not as bad as I was expecting it to be. If you're willing to limit your audience to modern browsers only, the only holdout is Safari; and on that score, what else is new.

Re: W3C approves WebAuthn as the web standard for password-free logins

#45

Post by MrStonedOne »

Freak_NL wrote: post #27
pier25 wrote: post #16

So what happens if you lose one of those USB devices? Can you use multiple USB devices on the same site?

In addition to being able to add multiple devices, there are recovery scenarios that would ostensibly fall outside of the scope of WebAuthn. A service using WebAuthn could give you a set of one time use high-entropy codes that can be printed and stored in a safe location. When you use those code to gain access to an account for which you have lost your token(s), you would of course get an e-mail letting you know that…

webauthn has to solve the problem, or the problem will still exist and will stop mass adoption.

Re: W3C approves WebAuthn as the web standard for password-free logins

#46

Post by MrStonedOne »

Freak_NL wrote: post #32
tialaramex wrote: post #17

Earlier quoted context omitted.

Aside from the awful UX of client certs, which we could imagine being fixed, FIDO tokens are very narrowly conceived to solve the exact second factor problem - and nothing else. If you do client certs you've got this whole identity thing baked into the certs. But the FIDO token doesn't have an identity, it only knows how to prove it's still the same FIDO token you had before. So that's immediately much better. If I u…

Also with a decent WebAuthn implementation (e.g., FIDO U2F hardware tokens, or using a TPM), the private key material cannot be copied by a compromised device, or even by someone with direct access to the hardware (unless they actually disassemble the hardware with quite professional hardware). Client-side certificates are a great technology, but you can copy the certificates without the owner knowing it. Getting the…

You tout it as an upside that it can't be copied.

But its really not.

How to prepare for losing tokens is the major barrier to entry for 2fa, and it will be why it never sees mass adoption.

Re: W3C approves WebAuthn as the web standard for password-free logins

#47

Post by smacktoward »

mgoetzke wrote: post #4

If only Microsoft hadn't chosen to use the code-name Hailstorm for its authentication proposal back in the days (and generally had a better image and a more open approach etc). Would have alleviated a lot of the pain earlier.

Hailstorm wasn't really the same thing. It positioned Microsoft as a centralized identity provider, with MS holding all the user data and everyone else just connecting to proprietary Microsoft online services to check if the user was who they said they were. Kind of like Facebook Login, but built around 2000s-era-trendy technologies like XML and SOAP instead of JavaScript and JSON.

It's hard to see how Hailstorm wouldn't have run into the same issues people have today with Facebook Login, the big one being that it's maybe not awesome to have a gigantic, notoriously ethically-challenged competitor sitting directly between you and your users.

Re: W3C approves WebAuthn as the web standard for password-free logins

#48

Post by dan1234 »

smacktoward wrote: post #44
tofflos wrote: post #40

https://caniuse.com/#search=webauthn

That's... actually not as bad as I was expecting it to be. If you're willing to limit your audience to modern browsers only, the only holdout is Safari; and on that score, what else is new.

It’s actually included as an Experimental Feature in the preview version of Safari, so there’s some hope that it will be present in the mainline version before too long.

Re: W3C approves WebAuthn as the web standard for password-free logins

#49

Post by baybal2 »

tialaramex wrote: post #17
AnaniasAnanas wrote: post #13

What does this solve exactly? We already have client-side certificates in TLS, am I missing something?

Aside from the awful UX of client certs, which we could imagine being fixed, FIDO tokens are very narrowly conceived to solve the exact second factor problem - and nothing else. If you do client certs you've got this whole identity thing baked into the certs. But the FIDO token doesn't have an identity, it only knows how to prove it's still the same FIDO token you had before. So that's immediately much better. If I u…

Nothing prevents delaying auth with a client cert until the user enters a login.

That's what a great lot of people don't understand about TLS. Your cert ID don't have to amount to user ID.

You can let your user enter login as usual in a web form, or use a stored cookie for that, and only then look up if client cert matches the user record.

Moreover, for as long as you can be confident about cookie security, you can forego authenticating every connection in favour of using a session cookie once you did a smartcard auth.

One last tip: ensure keepalives are handled properly, so you don't have to reauth TCP connections over and over.

That's the not so secret sauce to fast client side certificate auth.

Re: W3C approves WebAuthn as the web standard for password-free logins

#50

Post by baybal2 »

Freak_NL wrote: post #32
tialaramex wrote: post #17

Earlier quoted context omitted.

Aside from the awful UX of client certs, which we could imagine being fixed, FIDO tokens are very narrowly conceived to solve the exact second factor problem - and nothing else. If you do client certs you've got this whole identity thing baked into the certs. But the FIDO token doesn't have an identity, it only knows how to prove it's still the same FIDO token you had before. So that's immediately much better. If I u…

Also with a decent WebAuthn implementation (e.g., FIDO U2F hardware tokens, or using a TPM), the private key material cannot be copied by a compromised device, or even by someone with direct access to the hardware (unless they actually disassemble the hardware with quite professional hardware). Client-side certificates are a great technology, but you can copy the certificates without the owner knowing it. Getting the…

Well, that has been solved by smartcards for 2 decades already... More importantly, PKCS11 layer is completely independent of the browser internals, and works with just anything relying on common pk crypto: http, imap, smtp, sip...
Post reply on HN