Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Guide to WebAuthn

webauthn.guide

Post reply on HN
Print view View original

11–20 of 122 posts

Re: A Guide to WebAuthn

#11

Post by arianvanp »

beefhash wrote: post #9
arianvanp wrote: post #7

Earlier quoted context omitted.

That will already work right now! Go to https://webauthn.io on your phone and it will ask for your pin or fingerprint and then use the titan chip for the handshake! If it doesn't work. Select "Platform authenticator" in the drop down Will also work on iOS 13 beta. If your computer has a TPM 2.0 chip then it will also work on Microsoft Edge in Windows 10 (and maybe also other browsers. If they implement webauthb Micro…

*webauthn.io, I assume EDIT: Disregard the rest of what I wrote here previously, I didn't realize it was Duo Labs's own website.

Website is not by me. I fixed the link. Thanks

But webauthn.io and webauthn.guide are both copyright of Duo Labs and so is the library so I guess they can do whatever they want ;) I assume the two websites and the library are by the same author

Also the library lives on the server side ; not client ; and given the license is not AGPL there is no need to state that they're using it either.

(Edit: original comment was accusing me of copyright infringement for some reason)

Re: A Guide to WebAuthn

#12

Post by beefhash »

arianvanp wrote: post #11
beefhash wrote: post #9

Earlier quoted context omitted.

*webauthn.io, I assume EDIT: Disregard the rest of what I wrote here previously, I didn't realize it was Duo Labs's own website.

Website is not by me. I fixed the link. Thanks But webauthn.io and webauthn.guide are both copyright of Duo Labs and so is the library so I guess they can do whatever they want ;) I assume the two websites and the library are by the same author Also the library lives on the server side ; not client ; and given the license is not AGPL there is no need to state that they're using it either. (Edit: original comment was…

> But webauthn.io and webauthn.guide are both copyright of Duo Labs and so is the library so I guess they can do whatever they want ;)

Yeah, I didn't realize that. Tried to edit it in, but too late.

> Also the library lives on the server side ; not client ; and given the license is not AGPL there is no need to state that they're using it either.

And I didn't notice that. I thought it was JavaScript, but it was Go all along. Doubly my bad.

> (Edit: original comment was accusing me of copyright infringement for some reason)

I was (wrongly) assuming webauthn.io was in violation of the license of the library because I thought it was a client-side library.

Re: A Guide to WebAuthn

#13

Post by the_gipsy »

navaati wrote: post #5

So, I went on the demo website ( https://webauthn.io/ ) to try it with a recent desktop Firefox. I enter a username, press "Register" and Firefox gives me a prompt to "login [with a security key] and authorize", with only a "Cancel" button. And that's all that happens. Wait, so I can only use this stuff with a hardware token ? Bummer !

Firefox mobile allows using fingerprint.

Re: A Guide to WebAuthn

#14

Post by trulyrandom »

arianvanp wrote: post #7
trulyrandom wrote: post #6

What's the story here regarding software tokens? As I understand it, the WebAuthn standard doesn't preclude non-hardware tokens, but doesn't explicitly define support for it either. In particular, I would like to use my phone and its built-in Titan M chip for WebAuthn authentication over the internet, instead of using a hardware token. Is that possible or on the horizon?

That will already work right now! Go to https://webauthn.io on your phone and it will ask for your pin or fingerprint and then use the titan chip for the handshake! If it doesn't work. Select "Platform authenticator" in the drop down Will also work on iOS 13 beta. If your computer has a TPM 2.0 chip then it will also work on Microsoft Edge in Windows 10 (and maybe also other browsers. If they implement webauthb Micro…

Thanks for the info. This is not really 2FA anymore though, is it? Now WebAuthn authentication is happening on the same device as the one I'm using to log into the service. Is there a way to use my phone as a completely separate factor for WebAuthn authentication?

Re: A Guide to WebAuthn

#15

Post by arianvanp »

trulyrandom wrote: post #14
arianvanp wrote: post #7

Earlier quoted context omitted.

That will already work right now! Go to https://webauthn.io on your phone and it will ask for your pin or fingerprint and then use the titan chip for the handshake! If it doesn't work. Select "Platform authenticator" in the drop down Will also work on iOS 13 beta. If your computer has a TPM 2.0 chip then it will also work on Microsoft Edge in Windows 10 (and maybe also other browsers. If they implement webauthb Micro…

Thanks for the info. This is not really 2FA anymore though, is it? Now WebAuthn authentication is happening on the same device as the one I'm using to log into the service. Is there a way to use my phone as a completely separate factor for WebAuthn authentication?

Webauthn is not a 2fa API. It's an authentication API. One of its usecases is to enhance password login (2fa) but can also be used as a single factor.

That is up to the implementor.

The implementor can ask the browser for certain security features of the authentication device. E.g. is the authentication device the same device as where the authentication flow is happening; is there a biometric check on the device or a pin on the device (i.e. the second factor is there but device-local) who is the manufacturer of the device (with consent of the user; given this is privacy-sensirive info) etc. And the implementor can then make a decision whether a device is 'strong' enough for single factor auth. All this information is cryptographically attested by the device.

You can ignore all that and only use it as a second factor always though. That's totally up to you and how you use the authentication primitives that webauthn provides.

Re: A Guide to WebAuthn

#16

Post by trulyrandom »

arianvanp wrote: post #15
trulyrandom wrote: post #14

Earlier quoted context omitted.

Thanks for the info. This is not really 2FA anymore though, is it? Now WebAuthn authentication is happening on the same device as the one I'm using to log into the service. Is there a way to use my phone as a completely separate factor for WebAuthn authentication?

Webauthn is not a 2fa API. It's an authentication API. One of its usecases is to enhance password login (2fa) but can also be used as a single factor. That is up to the implementor. The implementor can ask the browser for certain security features of the authentication device. E.g. is the authentication device the same device as where the authentication flow is happening; is there a biometric check on the device or a…

Thanks again for the info. Sounds like I have some more reading up to do on WebAuthn.

Re: A Guide to WebAuthn

#18

Post by download13 »

navaati wrote: post #5

So, I went on the demo website ( https://webauthn.io/ ) to try it with a recent desktop Firefox. I enter a username, press "Register" and Firefox gives me a prompt to "login [with a security key] and authorize", with only a "Cancel" button. And that's all that happens. Wait, so I can only use this stuff with a hardware token ? Bummer !

If you're using windows I think you need to setup a pin or the hello auth method. Once windows has a quick way to authenticate you it'll offer that when you register

Re: A Guide to WebAuthn

#19

Post by ThePowerOfFuet »

arianvanp wrote: post #7
trulyrandom wrote: post #6

What's the story here regarding software tokens? As I understand it, the WebAuthn standard doesn't preclude non-hardware tokens, but doesn't explicitly define support for it either. In particular, I would like to use my phone and its built-in Titan M chip for WebAuthn authentication over the internet, instead of using a hardware token. Is that possible or on the horizon?

That will already work right now! Go to https://webauthn.io on your phone and it will ask for your pin or fingerprint and then use the titan chip for the handshake! If it doesn't work. Select "Platform authenticator" in the drop down Will also work on iOS 13 beta. If your computer has a TPM 2.0 chip then it will also work on Microsoft Edge in Windows 10 (and maybe also other browsers. If they implement webauthb Micro…

iOS 13.3 is what's required (not "13 beta"), and 13.3 was released a few weeks ago.

Re: A Guide to WebAuthn

#20

Post by ecesena »

TranquilMarmot wrote: post #2

How are these private keys being stored? It seems to be implied that there is a different public/private key pair for every website so are they stored in the browser? (or at an OS-level?)

In a hardware token, there's generally a single master secret and private keys are derived on the fly for each website you register/log into. So you can use 1 single hardware token with an unlimited number of sites (note that you prob want to register at least 2 tokens per site, in case you loose one, but this is a different story).

The standard also define the concept of resident keys (RKs), that you can use for passwordless authentication (typically with a PIN on the token, to avoid theft). In this case of course each key consumes a bit of storage, so the number of sites is limited. For example, a Solo key can currently store 50 resident keys. To the best of my knowledge, apart from demo sites, the only "real" site supporting resident keys is microsoft/outlook.com, so this is currently not a real practical limitation.

Post reply on HN