Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Guide to WebAuthn

webauthn.guide

Post reply on HN
Print view View original

51–60 of 122 posts

Re: A Guide to WebAuthn

#51

Post by sam_lowry_ »

Rafert wrote: post #32
sam_lowry_ wrote: post #3

Earlier quoted context omitted.

They are stored on hardware tokens. There does not seem to be a way to have privately generated software keys, nothing like putty's pageant or .ssh/authorized_keys. WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem.

> They are stored on hardware tokens. Not necessarily: the WebAuthn spec mentions two other types of authenticators in the introduction section ( https://www.w3.org/TR/webauthn-1/#intro ): "Broadly, compliant authenticators protect public key credentials, and interact with user agents to implement the Web Authentication API. Implementing compliant authenticators is possible in software executing (a) on a general-purp…

The section https://github.com/herrjemand/awesome-webauthn#software-auth... talks about using Android phones or Wear OS to webauthn with Bluetooth. The section title is misleading. It's not about software tokens, but about turning one's phone or a smart watch into a hardware token.

Re: A Guide to WebAuthn

#52

Post by sam_lowry_ »

nickray wrote: post #47
sam_lowry_ wrote: post #26

Earlier quoted context omitted.

Sell? Bingo! That's what I was talking about.

SoloKeys person here ;) You can implement software authenticators (listening on local USB port), I imagine some password manager people will do so eventually, or have a direct way to hook into requests. Krypton did this for U2F. Hardware keys are for if you want hardware security, obviously they can't be free unless you want someone with a different business model to subsidise them.

Listening to local USB port? Hm... Why should I listen to a local USB port to exchange keys in a PKI? This only proves my point that WebAuthn is about hardware replacing passwords.

Re: A Guide to WebAuthn

#53

Post by nickray »

sam_lowry_ wrote: post #45
StavrosK wrote: post #33

Earlier quoted context omitted.

You can just implement the client in software and use it if you want, the protocol doesn't care. Firefox already ships with that functionality and you can enable it.

>Firefox already ships with that functionality >and you can enable it. I can't find anything like that, can you point us to the docs/examples? OTOH, I see that someone right now posted a reply to https://github.com/w3c/webauthn/issues/1175#issuecomment-570... trying to downplay the issue of purely software tokens Funnily, https://github.com/herrjemand/awesome-webauthn#software-auth... is not about software tokens but…

The point is that ssh keys lying around on your laptop aren't the greatest idea either. Where is the root of trust? The password you type to terminal if you encrypt them?

FIDO2 starts with the idea of safe defaults, where either client devices (Android, laptop TPM,...) store the keys safely, or dongle vendors (like us, SoloKeys). These have a business interest in doing their job properly.

But there's nothing preventing software implementations, it's an open standard in that respect (I do have other issues with it but your specific concern is unfounded imho).

Re: A Guide to WebAuthn

#54

Post by haecceity »

combatentropy wrote: post #44

This guide focuses on what WebAuthn looks like for the server. What does it look like for the user? As far as I can imagine, it boils down to relying on the possession of a certain piece of hardware instead of knowing a certain password. That is, I have to carry around some kind of USB device and plug it into every computer I want to use. The device holds all my secret keys and does all the magic behind the scenes. B…

There's usually a pin or a fingerprint reader on the usb device so that it's not usable except by the owner.

Re: A Guide to WebAuthn

#55

Post by tmikaeld »

combatentropy wrote: post #44

This guide focuses on what WebAuthn looks like for the server. What does it look like for the user? As far as I can imagine, it boils down to relying on the possession of a certain piece of hardware instead of knowing a certain password. That is, I have to carry around some kind of USB device and plug it into every computer I want to use. The device holds all my secret keys and does all the magic behind the scenes. B…

You can use psychical, TPM or biometric authentication, like fingerprint. The specs require one to be able to reset a login if device is lost, like with email and code or SMS.

Re: A Guide to WebAuthn

#56

Post by StavrosK »

combatentropy wrote: post #50
stavros wrote: post #46

Earlier quoted context omitted.

You use some method of authentication, of course. How do you keep someone who has your unlocked password manager from using it? You just make sure nobody is ever in that situation. The big win is that, with WebAuthn, you don't need to also hide your authentication from site operators, your OS, key loggers, phishers, etc etc.

Thanks. Like you said, this is safer, even if a password remains somewhere in the chain, like a master password for your computer. An advantage is that websites are not storing passwords (hashed or otherwise, because it's hard to do well).

I use a Yubikey, so there's no password for me (just a PIN that wipes the key if it's entered incorrectly a few times). You can also use a fingerprint scanner, face ID, etc.

Re: A Guide to WebAuthn

#57

Post by sam_lowry_ »

masklinn wrote: post #10
navaati wrote: post #5

So, I went on the demo website ( https://webauthn.io/ ) to try it with a recent desktop Firefox. I enter a username, press "Register" and Firefox gives me a prompt to "login [with a security key] and authorize", with only a "Cancel" button. And that's all that happens. Wait, so I can only use this stuff with a hardware token ? Bummer !

Firefox lets you enable software tokens, and disable USB tokens: in about:config, set security.webauth.webauthn_enable_softtoken=true security.webauth.webauthn_enable_usbtoken=false then the registration will go through without needing a hardware token.

Err... and how is my software token generated? Where is it stored? Can I move it around browsers, e.g. use it with my Mobile Firefox after I generated in on the desktop?

Re: A Guide to WebAuthn

#58

Post by sam_lowry_ »

sam_lowry_ wrote: post #45
StavrosK wrote: post #33

Earlier quoted context omitted.

You can just implement the client in software and use it if you want, the protocol doesn't care. Firefox already ships with that functionality and you can enable it.

>Firefox already ships with that functionality >and you can enable it. I can't find anything like that, can you point us to the docs/examples? OTOH, I see that someone right now posted a reply to https://github.com/w3c/webauthn/issues/1175#issuecomment-570... trying to downplay the issue of purely software tokens Funnily, https://github.com/herrjemand/awesome-webauthn#software-auth... is not about software tokens but…

@nickray, with ssh, I manage the root of thrust. With Webauthn, someone else manages it for me, be it Yubico or Intel or Apple.

This is a fundamental difference.

Re: A Guide to WebAuthn

#59

Post by StavrosK »

sam_lowry_ wrote: post #58
sam_lowry_ wrote: post #45

Earlier quoted context omitted.

>Firefox already ships with that functionality >and you can enable it. I can't find anything like that, can you point us to the docs/examples? OTOH, I see that someone right now posted a reply to https://github.com/w3c/webauthn/issues/1175#issuecomment-570... trying to downplay the issue of purely software tokens Funnily, https://github.com/herrjemand/awesome-webauthn#software-auth... is not about software tokens but…

@nickray, with ssh, I manage the root of thrust. With Webauthn, someone else manages it for me, be it Yubico or Intel or Apple. This is a fundamental difference.

You're wrong. You can manage your own keys. You don't need any big corporation for WebAuthn.

Re: A Guide to WebAuthn

#60

Post by nickray »

combatentropy wrote: post #44

This guide focuses on what WebAuthn looks like for the server. What does it look like for the user? As far as I can imagine, it boils down to relying on the possession of a certain piece of hardware instead of knowing a certain password. That is, I have to carry around some kind of USB device and plug it into every computer I want to use. The device holds all my secret keys and does all the magic behind the scenes. B…

In FIDO-speak, "platform" authenticators are your laptop or phone, using their contained secure storage, vs "roaming" authnrs like our SoloKeys. Most people assume that the former will be the main way to use WebAuthn. Consumers using keys are mostly enthusiasts/early adopters/special needs.

Mainly in a corporate setting, a separate hardware key may provide a root of trust (and audit trail if the key is modified to be trackable) , with which you can then unlock your devices in a self-service manner.

You're right that software authnrs are a bad idea.

For services that don't want the security to be pierced by such unsafe fallbacks, initial key attestation can whitelist the acceptable authenticators.

One thing that is too infrequently highlighted is that FIDO2 is decentral authentication between you and the services, unlike "login with big-corp".

Post reply on HN