W3C approves WebAuthn as the web standard for password-free logins

Post by rkeene2 » Tue, Mar 05, 2019, 1:28 AM UTC

ehsankia wrote: post #91

AgentME wrote: post #89

Earlier quoted context omitted.

The big problem with using the same password on multiple sites is that if any of the sites record your password (because of maliciousness or incompetence), they can re-use your password to log in as you on any other site. Using a security token is more like a password manager with random passwords everywhere than that (the attacker needs to get access to your password manager to get access to your accounts; it's not…

That's fair. Although, for my password manager, you need both password and 2FA to access it, whereas a FIDO key would just require stealing the physical key. Does there exist FIDO key (other than phones) that require a password to "enable"? For example, when it's plugged into a new device, the key locks until you input some master password?

Post by akerl_ » Tue, Mar 05, 2019, 2:00 AM UTC

eikenberry wrote: post #96

arianvanp wrote: post #76

Earlier quoted context omitted.

Correct. You'll need a FIDO key to log in in that case

What in the spec precludes this from being implemented in software? [edit] Reading more of the spec it definitely seems like they meant for it to be possible to implement this in software. So while a physical FIDO device might be preferable, it shouldn't be necessary.

Post by velosol » Tue, Mar 05, 2019, 2:13 AM UTC

ak217 wrote: post #100

dontbenebby wrote: post #97

Earlier quoted context omitted.

I've avoided getting a Yubikey because there's not an easy way to use it on my iPhone, sticking with TOTP. But that's a bit of an edge case. (iPhones lack NFC chips)

I agree it's annoying. They're working on it, but they should have really enabled it sooner. There's no technical reason, iPhone has the necessary NFC hardware. https://www.wired.com/story/yubikey-lightning-ios-authentica...

Post by judge2020 » Tue, Mar 05, 2019, 2:26 AM UTC

akerl_ wrote: post #103

eikenberry wrote: post #96

Earlier quoted context omitted.

What in the spec precludes this from being implemented in software? [edit] Reading more of the spec it definitely seems like they meant for it to be possible to implement this in software. So while a physical FIDO device might be preferable, it shouldn't be necessary.

It looks like https://github.com/github/SoftU2F would work for that. I believe Chrome’s dev channel also has experimental soft webauthn support.

Post by ak217 » Tue, Mar 05, 2019, 2:33 AM UTC

velosol wrote: post #105

ak217 wrote: post #100

Earlier quoted context omitted.

I agree it's annoying. They're working on it, but they should have really enabled it sooner. There's no technical reason, iPhone has the necessary NFC hardware. https://www.wired.com/story/yubikey-lightning-ios-authentica...

Their main page for mobile heavily implies they are already there with iPhone/NFC. https://www.yubico.com/products/yubikey-for-mobile/