Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Guide to WebAuthn

webauthn.guide

Post reply on HN
Print view View original

21–30 of 122 posts

Re: A Guide to WebAuthn

#21

Post by ecesena »

I see a lot of comments of people interested to test it out.

If you have a hardware token with NFC, you can now test it everywhere: Mac, Windows, Linux (), Android (all browser), iOS (Safari iOS 13.3+). This is a big achievement as less than 1y ago the story was sooo much different.

If you do NOT have a hardware token, here are some options:

- Windows with TPM or Hello

- Mac with touchID sensor, you have to use Chrome

- Android phone, Chrome mobile, should work with fingerprint and face recognition

- An Android phone itself can be used as a bluetooth hardware token, with Chrome on your laptop.

Hope this list helps, please add if I forgot anything.

Re: A Guide to WebAuthn

#22

Post by StavrosK »

the_gipsy wrote: post #13
navaati wrote: post #5

So, I went on the demo website ( https://webauthn.io/ ) to try it with a recent desktop Firefox. I enter a username, press "Register" and Firefox gives me a prompt to "login [with a security key] and authorize", with only a "Cancel" button. And that's all that happens. Wait, so I can only use this stuff with a hardware token ? Bummer !

Firefox mobile allows using fingerprint.

I recently implemented this in a library (https://pypi.org/project/django-webauthin/), and Firefox mobile (at least for me) won't log you in if you're using resident keys. Registering the key works, but not authenticating. It's odd.

Re: A Guide to WebAuthn

#23

Post by stavros »

ecesena wrote: post #20
TranquilMarmot wrote: post #2

How are these private keys being stored? It seems to be implied that there is a different public/private key pair for every website so are they stored in the browser? (or at an OS-level?)

In a hardware token, there's generally a single master secret and private keys are derived on the fly for each website you register/log into. So you can use 1 single hardware token with an unlimited number of sites (note that you prob want to register at least 2 tokens per site, in case you loose one, but this is a different story). The standard also define the concept of resident keys (RKs), that you can use for pas…

Correction, resident keys are used for usernameless authentication (you don't need resident keys for passwordless).

I recently (last week) wrote a Django library for WebAuthn (https://pypi.org/project/django-webauthin/) and use it on a few of my sites (https://www.pastery.net, https://www.eternum.io and https://www.deadmansswitch.net, if you want to try it out).

Re: A Guide to WebAuthn

#24

Post by StavrosK »

ecesena wrote: post #21

I see a lot of comments of people interested to test it out. If you have a hardware token with NFC, you can now test it everywhere: Mac, Windows, Linux (), Android (all browser), iOS (Safari iOS 13.3+). This is a big achievement as less than 1y ago the story was sooo much different. If you do NOT have a hardware token, here are some options: - Windows with TPM or Hello - Mac with touchID sensor, you have to use Chrom…

Chrome beta on mobile didn't work for me with either fingerprint or any other method, the call to navigator.credentials.create just fails. Firefox half-works.

Re: A Guide to WebAuthn

#26

Post by sam_lowry_ »

arianvanp wrote: post #8
sam_lowry_ wrote: post #3

Earlier quoted context omitted.

They are stored on hardware tokens. There does not seem to be a way to have privately generated software keys, nothing like putty's pageant or .ssh/authorized_keys. WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem.

There are already open source hardware and software available by the people at SoloKey. Both Nitrokey and SoloKey sell the tokens.

Sell? Bingo! That's what I was talking about.

Re: A Guide to WebAuthn

#27

Post by sam_lowry_ »

monocasa wrote: post #4
sam_lowry_ wrote: post #3

Earlier quoted context omitted.

They are stored on hardware tokens. There does not seem to be a way to have privately generated software keys, nothing like putty's pageant or .ssh/authorized_keys. WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem.

> WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem. Can you expand on that?

There is no way to generate your own software key pair as easily as one can do with ssh-keygen.

The whole spec is designed with hardware tokens in mind, software tokens are not mentioned anywhere, and WebAuthn spec designers wave their hands when asked about software tokens.

Re: A Guide to WebAuthn

#28

Post by Rafert »

tarjei wrote: post #25

What If I got multiple devices? Does the server have to store multiple keys per user?

Yes, that's what is recommended and most sites implement (AFAIK Twitter for some reason only permitting one :-/)

Re: A Guide to WebAuthn

#29

Post by akubera »

So this is like BrowserID/Persona but instead of including the third-party email service to prove identification, the only credentials are on device/in-browser, right?

I assume that if you only connect one computer (authenticator) and lose the device, you're either SOL or the service has some workaround where you pre-register an email address or a separate "Login With" service.

Re: A Guide to WebAuthn

#30

Post by [deleted] »

sam_lowry_ wrote: post #27
monocasa wrote: post #4

Earlier quoted context omitted.

> WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem. Can you expand on that?

There is no way to generate your own software key pair as easily as one can do with ssh-keygen. The whole spec is designed with hardware tokens in mind, software tokens are not mentioned anywhere, and WebAuthn spec designers wave their hands when asked about software tokens.

[deleted]
Post reply on HN