Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Guide to WebAuthn

webauthn.guide

Post reply on HN
Print view View original

31–40 of 122 posts

Re: A Guide to WebAuthn

#31

Post by StavrosK »

akubera wrote: post #29

So this is like BrowserID/Persona but instead of including the third-party email service to prove identification, the only credentials are on device/in-browser, right? I assume that if you only connect one computer (authenticator) and lose the device, you're either SOL or the service has some workaround where you pre-register an email address or a separate "Login With" service.

No, it's a new standard where the site securely negotiates the login with the browser. What happens after that is the browser's job, all the site cares about is that it sees a correct credential.

Eg your password manager could implement this so all you'd have to do is click "log in" and you'd be in, without usernames or passwords to remember or steal.

Re: A Guide to WebAuthn

#32

Post by Rafert »

sam_lowry_ wrote: post #3
TranquilMarmot wrote: post #2

How are these private keys being stored? It seems to be implied that there is a different public/private key pair for every website so are they stored in the browser? (or at an OS-level?)

They are stored on hardware tokens. There does not seem to be a way to have privately generated software keys, nothing like putty's pageant or .ssh/authorized_keys. WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem.

> They are stored on hardware tokens.

Not necessarily: the WebAuthn spec mentions two other types of authenticators in the introduction section (https://www.w3.org/TR/webauthn-1/#intro): "Broadly, compliant authenticators protect public key credentials, and interact with user agents to implement the Web Authentication API. Implementing compliant authenticators is possible in software executing (a) on a general-purpose computing device, (b) on an on-device Secure Execution Environment, Trusted Platform Module (TPM), or a Secure Element (SE), or (c) off device."

> There does not seem to be a way to have privately generated software keys

A specification is something different than an implementation. On https://github.com/herrjemand/awesome-webauthn you'll find (at the time of writing) two software implementations. https://krypt.co/ can be a third if you want to consider a U2F implementation as well.

Re: A Guide to WebAuthn

#33

Post by StavrosK »

sam_lowry_ wrote: post #27
monocasa wrote: post #4

Earlier quoted context omitted.

> WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem. Can you expand on that?

There is no way to generate your own software key pair as easily as one can do with ssh-keygen. The whole spec is designed with hardware tokens in mind, software tokens are not mentioned anywhere, and WebAuthn spec designers wave their hands when asked about software tokens.

You can just implement the client in software and use it if you want, the protocol doesn't care. Firefox already ships with that functionality and you can enable it.

Re: A Guide to WebAuthn

#34

Post by zaroth »

masklinn wrote: post #10
navaati wrote: post #5

So, I went on the demo website ( https://webauthn.io/ ) to try it with a recent desktop Firefox. I enter a username, press "Register" and Firefox gives me a prompt to "login [with a security key] and authorize", with only a "Cancel" button. And that's all that happens. Wait, so I can only use this stuff with a hardware token ? Bummer !

Firefox lets you enable software tokens, and disable USB tokens: in about:config, set security.webauth.webauthn_enable_softtoken=true security.webauth.webauthn_enable_usbtoken=false then the registration will go through without needing a hardware token.

It’s almost like the designers thought - we are so damn close to killing the password, but, nah, why bother.

Re: A Guide to WebAuthn

#35

Post by Rafert »

ecesena wrote: post #21

I see a lot of comments of people interested to test it out. If you have a hardware token with NFC, you can now test it everywhere: Mac, Windows, Linux (), Android (all browser), iOS (Safari iOS 13.3+). This is a big achievement as less than 1y ago the story was sooo much different. If you do NOT have a hardware token, here are some options: - Windows with TPM or Hello - Mac with touchID sensor, you have to use Chrom…

> An Android phone itself can be used as a bluetooth hardware token, with Chrome on your laptop.

If you're referring to the caBLE (cloud-assisted Bluetooth LE) transport: this is still being worked on (https://github.com/w3c/webauthn/pull/909 but the actual discussion in the FIDO Alliance is non-public) and at the time of writing only works on Google properties.

To add: https://github.com/herrjemand/awesome-webauthn also mentions implementations completely in software. Whether those are a good idea depends on your taste, but for playing around you don't need any kind of hardware.

Re: A Guide to WebAuthn

#36

Post by StavrosK »

I am really excited about WebAuthn finally being the end of usernames/passwords and credential leaks/thefts, so much so that I've implemented a Django library for usernameless authentication with WebAuthn:

https://pypi.org/project/django-webauthin/

It's live on some of my side projects, if you want to try it out:

https://www.pastery.net

https://www.eternum.io

https://www.deadmansswitch.net

Re: A Guide to WebAuthn

#37

Post by zaroth »

Rafert wrote: post #28
tarjei wrote: post #25

What If I got multiple devices? Does the server have to store multiple keys per user?

Yes, that's what is recommended and most sites implement (AFAIK Twitter for some reason only permitting one :-/)

And how do you enroll the second device?

It would have to be something like;

1) Login on primary device

2) Generate a one-time code or link

3) Enter one-time code or click link on 2nd device

4) Click an “Enroll” button on the 2nd device which would generate a second enrollment saved in the account.

You would have to do this for each and every service so that seems like a total non-starter.

Alternatively, a way to share the private keys securely between the devices. But I’m not sure if there are site-specific salts as part of the WebAuthN signing process which would require additional state be sync’d between the devices in order to authenticate to a new service on both devices?

Re: A Guide to WebAuthn

#39

Post by zaroth »

arianvanp wrote: post #7
trulyrandom wrote: post #6

What's the story here regarding software tokens? As I understand it, the WebAuthn standard doesn't preclude non-hardware tokens, but doesn't explicitly define support for it either. In particular, I would like to use my phone and its built-in Titan M chip for WebAuthn authentication over the internet, instead of using a hardware token. Is that possible or on the horizon?

That will already work right now! Go to https://webauthn.io on your phone and it will ask for your pin or fingerprint and then use the titan chip for the handshake! If it doesn't work. Select "Platform authenticator" in the drop down Will also work on iOS 13 beta. If your computer has a TPM 2.0 chip then it will also work on Microsoft Edge in Windows 10 (and maybe also other browsers. If they implement webauthb Micro…

I read that iOS 13.3 supports using a hardware token with WebAuthN. It doesn’t say you can just use TouchID to login without a separate WebAuth token....

> Currently, the WebAuthn second-factor use case (the FIDO U2F user experience) is the only log in flow that is supported. Security key-based biometrics or PIN (without the use of username and password) are not supported yet.

https://www.yubico.com/2019/12/native-support-for-webauthn-a...

Re: A Guide to WebAuthn

#40

Post by C14L »

masklinn wrote: post #10
navaati wrote: post #5

So, I went on the demo website ( https://webauthn.io/ ) to try it with a recent desktop Firefox. I enter a username, press "Register" and Firefox gives me a prompt to "login [with a security key] and authorize", with only a "Cancel" button. And that's all that happens. Wait, so I can only use this stuff with a hardware token ? Bummer !

Firefox lets you enable software tokens, and disable USB tokens: in about:config, set security.webauth.webauthn_enable_softtoken=true security.webauth.webauthn_enable_usbtoken=false then the registration will go through without needing a hardware token.

In other words, I can't use it in production (yet), because I'd need to ask users to change browser settings for it to work. That's disappointing :(
Post reply on HN