81–90 of 122 posts
I see a lot of comments of people interested to test it out. If you have a hardware token with NFC, you can now test it everywhere: Mac, Windows, Linux (), Android (all browser), iOS (Safari iOS 13.3+). This is a big achievement as less than 1y ago the story was sooo much different. If you do NOT have a hardware token, here are some options: - Windows with TPM or Hello - Mac with touchID sensor, you have to use Chrom…
Earlier quoted context omitted.
Yes, if a service says "we only support Yubikeys for login", you should boycott them.
I hope that principle does establish itself among users of the web, but I suspect that if a bank says "You have to use one of these supported devices to access your account online" people are not going to change their bank because of it. Similarly, if China mandates a government-approved (backdoored?) device when accessing Chinese websites, I don't suppose Chinese citizens are going to boycott those. Other countries…
I see a lot of comments of people interested to test it out. If you have a hardware token with NFC, you can now test it everywhere: Mac, Windows, Linux (), Android (all browser), iOS (Safari iOS 13.3+). This is a big achievement as less than 1y ago the story was sooo much different. If you do NOT have a hardware token, here are some options: - Windows with TPM or Hello - Mac with touchID sensor, you have to use Chrom…
Earlier quoted context omitted.
I hope that principle does establish itself among users of the web, but I suspect that if a bank says "You have to use one of these supported devices to access your account online" people are not going to change their bank because of it. Similarly, if China mandates a government-approved (backdoored?) device when accessing Chinese websites, I don't suppose Chinese citizens are going to boycott those. Other countries…
If those organizations wanted to do what you say, and WebAuthn didn't support attestation, I doubt they'd say "well I guess we just can't do that" and give up, though.
It is rational to not give your adversaries the tools needed to oppress you.
Earlier quoted context omitted.
If those organizations wanted to do what you say, and WebAuthn didn't support attestation, I doubt they'd say "well I guess we just can't do that" and give up, though.
Right now they can't (cheaply) say "You must own a device from this specific list in order to use our website" because there is no way of cryptographically proving that. What WebAuthn has done, by including support for attestation, is make that not only possible but likely, presenting it as something beneficial for security and making it easy to implement. It is rational to not give your adversaries the tools needed…
If my bank wanted to mandate the use of Yubikeys, it would do that, WebAuthn or no. It would sell me the Yubikey, as it now sells me its RSA token. I don't think the protocol the token speaks matters.
This guide focuses on what WebAuthn looks like for the server. What does it look like for the user? As far as I can imagine, it boils down to relying on the possession of a certain piece of hardware instead of knowing a certain password. That is, I have to carry around some kind of USB device and plug it into every computer I want to use. The device holds all my secret keys and does all the magic behind the scenes. B…
Here's a anecdote about phone and required 2FA: I was in Laos needing to pay rent when my phone broke. I was locked out of TransferWise to get my paycheck because their 2FA is behind their proprietary app so I couldn't authenticate on my laptop. Luckily I had just enough cash in my bank account. Too bad the bank only had 2 2FA options; 1) behind their proprietary app which doesn't allow rooted devices (despite root for more privacy tools on Android) or 2) SMS in which I was in another country so I didn't have access to my home SIM.
Because I needed a new phone to fix this issue, I went to buy a new one online. I couldn't pay for it because I needed a working phone to confirm a payment with my bank.
All of this could be solved by allowing TOTP (which doesn't require a phone) or FIDO2 (which I have a key).
This guide focuses on what WebAuthn looks like for the server. What does it look like for the user? As far as I can imagine, it boils down to relying on the possession of a certain piece of hardware instead of knowing a certain password. That is, I have to carry around some kind of USB device and plug it into every computer I want to use. The device holds all my secret keys and does all the magic behind the scenes. B…
The most common use case today is 2FA, where WebAuthn is the standard way to do something U2F defined only for 2FA. In this scenario where it's only a second factor, yes, it relies on you possessing a Security Key, and on the bad guys not possessing it. This matches the threat model, which is typically that bad guys are not your flatmate or your mother they live in another country and will never meet you. WebAuthn (a…
I love FIDO tokens, but I’m not confident in my ability to keep myself from getting locked out of a service I use infrequently, and I’m a fairly technical user.
Earlier quoted context omitted.
Right now they can't (cheaply) say "You must own a device from this specific list in order to use our website" because there is no way of cryptographically proving that. What WebAuthn has done, by including support for attestation, is make that not only possible but likely, presenting it as something beneficial for security and making it easy to implement. It is rational to not give your adversaries the tools needed…
I don't agree. My bank issues its own hardware tokens that I must use, China mandates the use of its equipment and Apple does the same. If someone wants to mandate the use of a specific device, they can just do that. The fact that a similar standard exists doesn't mean much. If my bank wanted to mandate the use of Yubikeys, it would do that, WebAuthn or no. It would sell me the Yubikey, as it now sells me its RSA tok…
I accept your point about the protocol being irrelevant, however. One could even say that, if services are going to require specific pieces of hardware, it makes sense that the requirements are communicated and enforced using an open standard protocol, as that does allow a certain degree of interoperability and Free Software implementation.
The counter-argument, though, is that currently there are barriers to sites implementing such policies (due to the cost of issuing these devices and linking them to a specific account/address). If we set the precedent that every site should be using this technology, and reduce the cost of doing so, we bring about a set of dynamics where individual sites can start to introduce incompatibilities, whether with good intentions, or for anti-competitive reasons, or by accident.
Maybe this won't lead to people needing to carry around five dongles and two phones with them, but it could easily lead to having a lot of power concentrated into the hands of a small number of entities, or even just a single one, like the bad old days of "This site works best in Internet Explorer". Moreover, this is not just a theoretical concern, as it has already started to happen, as the link above explained:
"FIDO does not dismiss these worries and their answer, for the moment, is the metadata service (MDS). Essentially this is a unified root store that all sites checking attestation are supposed to use and update from."
Earlier quoted context omitted.
The most common use case today is 2FA, where WebAuthn is the standard way to do something U2F defined only for 2FA. In this scenario where it's only a second factor, yes, it relies on you possessing a Security Key, and on the bad guys not possessing it. This matches the threat model, which is typically that bad guys are not your flatmate or your mother they live in another country and will never meet you. WebAuthn (a…
Unfortunately for the user experience, those tokens typically can’t be cloned even upon initial setup. The practical result of this is that if you intend to keep a second token as a backup, you need to remember to register the backup token individually for each service you use your primary one for. This is unlikely if you keep the backup at home, and it’s downright impractical if you kept it in e.g. a safe deposit bo…
This right here is what drives me crazy about most 2fa implementations (and now apparently webauthn). I currently store 1 backup token offsite, and carry one with me. The problem is - I have no good way to access the backup device (so I can add it to my account) without having both in my possession, which destroys its abilities as a backup token.
I would love to be able to somehow have 2 fido keys use the same key, but I'm not sure how that's possible without exposing the private key externally, destroying some of the device's security properties.