W3C approves WebAuthn as the web standard for password-free logins • Hacker News Board

Re: W3C approves WebAuthn as the web standard for password-free logins

#71

Post by michaelt » Mon, Mar 04, 2019, 10:05 PM UTC

zanny wrote: post #67

smacktoward wrote: post #44

Earlier quoted context omitted.

That's... actually not as bad as I was expecting it to be. If you're willing to limit your audience to modern browsers only, the only holdout is Safari; and on that score, what else is new.

Its not just whether the API is available but whether its practical to use. I'm not sure which browsers recognize or support fingerprint readers, though all the implementations seem to support usb u2f. Feels like a total failure to launch that the spec doesn't recommend the use of browser accounts as credential providers. Every single major browser has an associated web account with it (Firefox Account, Google accoun…

That would make it difficult to change browsers, wouldn't it? Or indeed to use different mobile and desktop browsers?

Re: W3C approves WebAuthn as the web standard for password-free logins

#72

Post by gsnedders » Mon, Mar 04, 2019, 10:12 PM UTC

Outpox wrote: post #38

wccrawford wrote: post #33

Earlier quoted context omitted.

https://www.w3.org/2019/03/pressrelease-webauthn-rec.html.en English version. (It wasn't originally in English for me, but maybe it was autodetecting something?)

It was in my native language (French). According to the "Translation" link[0] it's available in English, Japanese, Chinese and French. [0] https://www.w3.org/Press/Releases-2019#webauthn-rec

It uses HTTP content negotiation, based on the Accept-Language header.

Re: W3C approves WebAuthn as the web standard for password-free logins

#73

Post by Ajedi32 » Mon, Mar 04, 2019, 10:12 PM UTC

Almost there; now we just need some cross-platform implementations with synced credentials, and support from a couple major sites. Ideally some password managers will step in and implement support, and Google will add support to their own login flow as a primary authentication factor.

Re: W3C approves WebAuthn as the web standard for password-free logins

#74

Post by gsnedders » Mon, Mar 04, 2019, 10:13 PM UTC

smacktoward wrote: post #44

tofflos wrote: post #40

https://caniuse.com/#search=webauthn

That's... actually not as bad as I was expecting it to be. If you're willing to limit your audience to modern browsers only, the only holdout is Safari; and on that score, what else is new.

It's unsurprising this is the case: to be published as a Recommendation you have to demonstrate interoperable implementation experience.

The implementation report is at https://www.w3.org/2019/01/webauthn-report.html and shows Safari passing most of it, AFAICT. (Though it's based on Safari Technology Preview and is yet to ship.)

Re: W3C approves WebAuthn as the web standard for password-free logins

#75

Post by cm2187 » Mon, Mar 04, 2019, 10:18 PM UTC

How easy will it be to implement? We should keep in mind the most dangerous guys out there store passwords in clear text in databases and other amateurish rookie mistakes. Having easy to use / impossible to f__k up libraries for every major platform is going to be critical.

Re: W3C approves WebAuthn as the web standard for password-free logins

#76

Post by arianvanp » Mon, Mar 04, 2019, 10:26 PM UTC

vbezhenar wrote: post #70

I don't understand how does it work. If I'm using just desktop and don't have mobile phone or any specialized hardware, I can't login?

Correct. You'll need a FIDO key to log in in that case

Re: W3C approves WebAuthn as the web standard for password-free logins

#77

Post by Spone » Mon, Mar 04, 2019, 10:27 PM UTC

vbezhenar wrote: post #70

I don't understand how does it work. If I'm using just desktop and don't have mobile phone or any specialized hardware, I can't login?

https://webauthn.guide is a quite good overview of the spec

Re: W3C approves WebAuthn as the web standard for password-free logins

#78

Post by mgiannopoulos » Mon, Mar 04, 2019, 10:33 PM UTC

Grue3 wrote: post #52

mgiannopoulos wrote: post #22

Earlier quoted context omitted.

So what is your suggested simple, reliable method of authentication? Does one exist?

A password sent over an encrypted connection and hashed+salted on the backend? It's an extremely reliable and proven method that has been used for decades!

You need to remember the password though. Quite more possible to forget the password than losing your mobile device.

Re: W3C approves WebAuthn as the web standard for password-free logins

#79

Post by Canada » Mon, Mar 04, 2019, 10:37 PM UTC

I don't want to let the password go. It gives me the freedom to rightfully access my service if I just know the secret, without any entanglent to some app, device, or other account.

Re: W3C approves WebAuthn as the web standard for password-free logins

#80

Post by michaelt » Mon, Mar 04, 2019, 10:40 PM UTC

pier25 wrote: post #16

So what happens if you lose one of those USB devices? Can you use multiple USB devices on the same site?

OK, so here are the options I've seen people deploy for 2FA:

1. Force users to register two U2F tokens. Google's 'advanced protection' requires this.

2. Have users print out one-time-use recovery codes and put them somewhere safe. This is what Google does without 'advanced protection'.

3. Require the user to provide a cell phone number, thus offloading the problem to cell phone companies, introducing all the insecurities that result from that. This is what Apple does (as far as I can tell)

4. AWS is similar, but requires both an e-mail and an automated phone call.

5. Github delegates 2FA recovery to Facebook, via their "Recover Accounts Elsewhere"

6. Facebook allows the user to designate 'trusted contacts' who can get a code they can give to the user in person or over the phone.

7. Have the customer contact customer services, who follow a process companies are cagey about disclosing.

8. In corporate settings, just have them visit helpdesk in person.