W3C approves WebAuthn as the web standard for password-free logins • Hacker News Board

Re: W3C approves WebAuthn as the web standard for password-free logins

#91

Post by ehsankia » Mon, Mar 04, 2019, 11:30 PM UTC

AgentME wrote: post #89

ehsankia wrote: post #86

Earlier quoted context omitted.

Is there a solution for the fact that all of your accounts will be secured by the same "source"? Isn't this almost close to using the same password on every site? I realize a physical secret is better than a password, but if someone gets their hand on your little FIDO device, do they instantly get access to all your accounts?

The big problem with using the same password on multiple sites is that if any of the sites record your password (because of maliciousness or incompetence), they can re-use your password to log in as you on any other site. Using a security token is more like a password manager with random passwords everywhere than that (the attacker needs to get access to your password manager to get access to your accounts; it's not…

That's fair. Although, for my password manager, you need both password and 2FA to access it, whereas a FIDO key would just require stealing the physical key.

Does there exist FIDO key (other than phones) that require a password to "enable"? For example, when it's plugged into a new device, the key locks until you input some master password?

Re: W3C approves WebAuthn as the web standard for password-free logins

#92

Post by eximius » Tue, Mar 05, 2019, 12:04 AM UTC

cm2187 wrote: post #75

How easy will it be to implement? We should keep in mind the most dangerous guys out there store passwords in clear text in databases and other amateurish rookie mistakes. Having easy to use / impossible to f__k up libraries for every major platform is going to be critical.

There are two methods, IIRC. `get` and `create`. Everything is done with Challenge/Response with the browser handling the Private Stuff. It's hard to mess up, at a glance.

You ask the browser to create an asymetric key pair. It returns the public key, which the server saves. On login, you provide a challenge to the browser to sign using the private key from earlier. It returns the signed message and the server verifies the signature.

Re: W3C approves WebAuthn as the web standard for password-free logins

#93

Post by jontro » Tue, Mar 05, 2019, 12:18 AM UTC

ehsankia wrote: post #91

AgentME wrote: post #89

Earlier quoted context omitted.

The big problem with using the same password on multiple sites is that if any of the sites record your password (because of maliciousness or incompetence), they can re-use your password to log in as you on any other site. Using a security token is more like a password manager with random passwords everywhere than that (the attacker needs to get access to your password manager to get access to your accounts; it's not…

That's fair. Although, for my password manager, you need both password and 2FA to access it, whereas a FIDO key would just require stealing the physical key. Does there exist FIDO key (other than phones) that require a password to "enable"? For example, when it's plugged into a new device, the key locks until you input some master password?

The Ledger Nano S requires you to enter a pin code at least

Re: W3C approves WebAuthn as the web standard for password-free logins

#94

Post by mrhappyunhappy » Tue, Mar 05, 2019, 12:26 AM UTC

michaelt wrote: post #80

pier25 wrote: post #16

So what happens if you lose one of those USB devices? Can you use multiple USB devices on the same site?

OK, so here are the options I've seen people deploy for 2FA: 1. Force users to register two U2F tokens. Google's 'advanced protection' requires this. 2. Have users print out one-time-use recovery codes and put them somewhere safe. This is what Google does without 'advanced protection'. 3. Require the user to provide a cell phone number, thus offloading the problem to cell phone companies, introducing all the insecuri…

#2 sounds most appealing. I live in Japan and don’t have a reachable phone #. Wife and I simply FaceTime if we need anything. Otherwise I have no mobile means of authentication. There have been several occasions where I simply couldn’t use the service because I could not authenticate via a phone number. I feel that companies that force this method of authentication have never considered my use case and could care less if they lose me in the signup process. Too bad. I for one actually have the money to pay them, but hey, if you don’t want it that’s fine with me.

Re: W3C approves WebAuthn as the web standard for password-free logins

#95

Post by eximius » Tue, Mar 05, 2019, 12:32 AM UTC

Somewhat random thought: is Challenge-Response sufficient or should it be 'Challenge-Challenge-Response' so that the client only answers a challenge it requested? Otherwise, what's to stop an XSS attack on page A from effectively MITM page B by overriding the event listener for the login on page A, asking to sign for page B, then exfiltrating the response?

EDIT: looks like the dialog attempts to give you some information, but it doesn't say WHICH profile on the domain and people could certainly not pay attention to the domain in that prompt (I had to check if it existed because I hadn't noticed).

Re: W3C approves WebAuthn as the web standard for password-free logins

#96

Post by eikenberry » Tue, Mar 05, 2019, 12:42 AM UTC

arianvanp wrote: post #76

vbezhenar wrote: post #70

I don't understand how does it work. If I'm using just desktop and don't have mobile phone or any specialized hardware, I can't login?

Correct. You'll need a FIDO key to log in in that case

What in the spec precludes this from being implemented in software?

[edit] Reading more of the spec it definitely seems like they meant for it to be possible to implement this in software. So while a physical FIDO device might be preferable, it shouldn't be necessary.

Re: W3C approves WebAuthn as the web standard for password-free logins

#97

Post by dontbenebby » Tue, Mar 05, 2019, 12:49 AM UTC

Canada wrote: post #79

I don't want to let the password go. It gives me the freedom to rightfully access my service if I just know the secret, without any entanglent to some app, device, or other account.

I've avoided getting a Yubikey because there's not an easy way to use it on my iPhone, sticking with TOTP. But that's a bit of an edge case. (iPhones lack NFC chips)

Re: W3C approves WebAuthn as the web standard for password-free logins

#98

Post by agl » Tue, Mar 05, 2019, 1:17 AM UTC

madjam002 wrote: post #56

Still waiting for Google Chrome and Firefox to support User Verification in the form of PIN prompts and Resident Keys for true passwordless login (at the moment WebAuthN in Chrome is basically just 2FA, no option for Passwordless). Hopefully soon!

Early support should be appearing in the coming weeks on Canary channel when run with --enable-features=WebAuthenticationPINSupport

Re: W3C approves WebAuthn as the web standard for password-free logins

#99

Post by SimeVidas » Tue, Mar 05, 2019, 1:25 AM UTC

eikenberry wrote: post #96

arianvanp wrote: post #76

Earlier quoted context omitted.

Correct. You'll need a FIDO key to log in in that case

What in the spec precludes this from being implemented in software? [edit] Reading more of the spec it definitely seems like they meant for it to be possible to implement this in software. So while a physical FIDO device might be preferable, it shouldn't be necessary.

Where would that software run? In the browser or a separate app?

Re: W3C approves WebAuthn as the web standard for password-free logins

#100

Post by ak217 » Tue, Mar 05, 2019, 1:25 AM UTC

dontbenebby wrote: post #97

Canada wrote: post #79

I don't want to let the password go. It gives me the freedom to rightfully access my service if I just know the secret, without any entanglent to some app, device, or other account.

I've avoided getting a Yubikey because there's not an easy way to use it on my iPhone, sticking with TOTP. But that's a bit of an edge case. (iPhones lack NFC chips)

I agree it's annoying. They're working on it, but they should have really enabled it sooner. There's no technical reason, iPhone has the necessary NFC hardware. https://www.wired.com/story/yubikey-lightning-ios-authentica...