Live data from Hacker News

W3C approves WebAuthn as the web standard for password-free logins

venturebeat.com

51–60 of 154 posts

Re: W3C approves WebAuthn as the web standard for password-free logins

#51

The last time I saw 2fa and fido talked about on here, someone recommended a set of 2 keys, but they ones they recommended are now out of stock. Does anyone have a recommendation with the reason? Thanks. Edit: With the reason. Jeez, what a typo.

> The last time I saw 2fa and fido talked about on here, someone recommended a set of 2 keys, but they ones they recommended are now out of stock.

There isn't really any reason to have a backup 2FA key. Just have TOTP set up on each account as a backup, so that way if you lose your 2FA key you can still log in that way. Then just order a new one. But having an extra 2FA key just sitting in your drawer on the off chance you leave your laptop in a taxi or whatever isn't really necessary.

Right now it's only major sites that support U2F anyway, so basically all of them allow you to have TOTP enabled as a backup. If you want you don't even need to enter the TOTP codes in your phone, you can just store the secret keys encrypted somewhere.

Re: W3C approves WebAuthn as the web standard for password-free logins

#52
post #21

>Users log in with simple methods such as fingerprint readers, cameras, FIDO security keys, or their personal mobile device. Neither of these methods are simple. I don't have a camera or fingerprint reader, idk what is FIDO security key or how to get one, and mobile phone can be lost or cease working at any moment so it's not a reliable method of authentication.

So what is your suggested simple, reliable method of authentication? Does one exist?

A password sent over an encrypted connection and hashed+salted on the backend? It's an extremely reliable and proven method that has been used for decades!

Re: W3C approves WebAuthn as the web standard for password-free logins

#53

What does this solve exactly? We already have client-side certificates in TLS, am I missing something?

Aside from the awful UX of client certs, which we could imagine being fixed, FIDO tokens are very narrowly conceived to solve the exact second factor problem - and nothing else. If you do client certs you've got this whole identity thing baked into the certs. But the FIDO token doesn't have an identity, it only knows how to prove it's still the same FIDO token you had before. So that's immediately much better. If I u…

> FIDO tokens are very narrowly conceived to solve the exact second factor problem - and nothing else.

Well, just that has been done completely flawlessly by smartcards for two decades already.

Introducing a competing standard may just end with neither of them getting enough support.

Re: W3C approves WebAuthn as the web standard for password-free logins

#54

The last time I saw 2fa and fido talked about on here, someone recommended a set of 2 keys, but they ones they recommended are now out of stock. Does anyone have a recommendation with the reason? Thanks. Edit: With the reason. Jeez, what a typo.

I can tell you that I own a couple of off-brand devices and a blue Yubico "Security Key".

But rather than specifically recommend things I will tell you what I believe you should care about:

1. Does it actually connect to things you authenticate on? If you always authenticate a Mac Book Pro with only USB C ports, then the USB-A Security Key is stupid because it'd need an adaptor. For physical connections if it shows the connector you can feel comfortable, this isn't 4Gbps video it either works or it doesn't. But for stuff like Bluetooth, find somebody who has actually seen the thing you want to use working.

2. For the primary device (if you don't have them identical) be sure how you are going to carry it. Will it go on your key ring, or in your wallet? If you have to carry an extra device and you're someone who has never owned an umbrella for more than a month, that's futile, they're too tiny to rely on getting them back but too expensive to throw away - pick something you won't lose.

3. Robustness. Again for the primary device, the Yubico key I have (USB-A one) has good reputation here, with people leaving them in jeans pockets through a wash or dropping them onto concrete floors without trouble. Others, even from Yubico, vary, you may be super clumsy or not.

Beyond that there are some technical things you could decide you really care about, hardware bugs, but none of them are exactly show stoppers that I've seen. And there are extra features, that Yubico device I own does FIDO2, which means it could be a true password _replacement_ not only a second factor. But I think that feature has even less chance of taking off than WebAuthn itself, so I didn't rate this in choosing the device.

Re: W3C approves WebAuthn as the web standard for password-free logins

#55
post #52

Earlier quoted context omitted.

So what is your suggested simple, reliable method of authentication? Does one exist?

A password sent over an encrypted connection and hashed+salted on the backend? It's an extremely reliable and proven method that has been used for decades!

It's not reliable because I have to trust the owner of the site.

Re: W3C approves WebAuthn as the web standard for password-free logins

#57

Does anyone else find these informal specifications difficult to digest? The informative appendices link to papers on TPM and the like but it's hard to find a formal description of the protocol, or at least the sensitive parts, that could be independently validated or verified. Has there been any work to formally verify/validate the design of this protocol that I'm not seeing?

You're not alone. I'm self-taught in english and it's not my first language. Although native english speakers have commended me I still find reading technical texts taxing. They fall in the category of any academic text. Be it from a uni, research group, specfication manual. I did not receive formal education in English so I don't understand those formal words. Every other sentence there's something I have to look up…

They're commending you because your English is terrific =) Learning a language is tough work, but if you didn't say anything I would have had no idea.

Re: W3C approves WebAuthn as the web standard for password-free logins

#58

The last time I saw 2fa and fido talked about on here, someone recommended a set of 2 keys, but they ones they recommended are now out of stock. Does anyone have a recommendation with the reason? Thanks. Edit: With the reason. Jeez, what a typo.

For those into cryptocurrency, the Trezor and Ledger hardware wallets can also be used for fido u2f.

Re: W3C approves WebAuthn as the web standard for password-free logins

#59
post #52

Earlier quoted context omitted.

So what is your suggested simple, reliable method of authentication? Does one exist?

A password sent over an encrypted connection and hashed+salted on the backend? It's an extremely reliable and proven method that has been used for decades!

Totally secure against data breaches and phishing, as we've seen over and over again.

Oh wait...

Post reply on HN