Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Guide to WebAuthn

webauthn.guide

Post reply on HN
Print view View original

101–110 of 122 posts

Re: A Guide to WebAuthn

#101

Post by thayne »

tomashubelbauer wrote: post #97
arianvanp wrote: post #96

Earlier quoted context omitted.

Gets worse. Some of it is ASN.1 inside CBOR too. Some of it is custom binary format containing CBOR The answer is as far as I know: Backwards compatibility with bad decisions made in U2F Also; relying on base64url is odd as there are no built in functions in JavaScript to encode and decode it.

> Also; relying on base64url is odd as there are no built in functions in JavaScript to encode and decode it. I'm probably missing something, but aren't window.atob and window.btoa just that? It's not available in Node though.

btoa is base64 not base64url. And even if it was base64url, it takes a "binary string", so using it on, say, a Uint8Array is non-trivial.

Re: A Guide to WebAuthn

#102

Post by tialaramex »

hamandcheese wrote: post #99

> After the PublicKeyCredential has been obtained, it is sent to the server for validation. The WebAuthn specification describes a 19-point procedure to validate the registration data 19 points?! I haven’t dug too deep into the details, but so far everything I’ve seen re: implementing WebAuthn seems so... over complicated? Compared to implementing, say, TOTP based 2FA, which is very straightforward.

Complicated certainly. But over-complicated would imply that there's a significantly simpler way to do it.

The nice thing about software is that it can be copied, so the complicated part only needs to be done once by somebody suitably skilled in the art.

Re: A Guide to WebAuthn

#103

Post by tialaramex »

xur17 wrote: post #91
nickray wrote: post #43

Earlier quoted context omitted.

There's an ascending signature counter that's intended to prevent cloned devices (replay attacks are prevented seperately with server generated challenge). One way around it is clone (backup key) having very high initial signature counter set, so first use invalidates original (on loss). But yeah it's a UX problem that hopefully will find a better/non-hacky solution than "register multiple keys for each site".

> But yeah it's a UX problem that hopefully will find a better/non-hacky solution than "register multiple keys for each site". This seems like a huge blocker for adoption. I currently run into this issue with FIDO for 2fa - I store my backup key offsite, which means enrolling the second device requires me to make a special trip to retrieve the device. My current approach is to retrieve the backup token every few mont…

Write the services down. You don't need to keep the fact that you have FIDO tokens secret unless you're keeping them somewhere otherwise unsafe like under a rock in your garden. So a list titled "Services I've enabled for FIDO" with check columns for the tokens gets it done.

Re: A Guide to WebAuthn

#104

Post by tomashubelbauer »

thayne wrote: post #101
tomashubelbauer wrote: post #97

Earlier quoted context omitted.

> Also; relying on base64url is odd as there are no built in functions in JavaScript to encode and decode it. I'm probably missing something, but aren't window.atob and window.btoa just that? It's not available in Node though.

btoa is base64 not base64url. And even if it was base64url, it takes a "binary string", so using it on, say, a Uint8Array is non-trivial.

Thank you, I didn't realize the URL safe variant of Base64 had a name and that it was this!

Re: A Guide to WebAuthn

#107

Post by latchkey »

StavrosK wrote: post #36

I am really excited about WebAuthn finally being the end of usernames/passwords and credential leaks/thefts, so much so that I've implemented a Django library for usernameless authentication with WebAuthn: https://pypi.org/project/django-webauthin/ It's live on some of my side projects, if you want to try it out: https://www.pastery.net https://www.eternum.io https://www.deadmansswitch.net

I love DMS! Thank you for implementing this on it. =)

Re: A Guide to WebAuthn

#108

Post by StavrosK »

latchkey wrote: post #107
StavrosK wrote: post #36

I am really excited about WebAuthn finally being the end of usernames/passwords and credential leaks/thefts, so much so that I've implemented a Django library for usernameless authentication with WebAuthn: https://pypi.org/project/django-webauthin/ It's live on some of my side projects, if you want to try it out: https://www.pastery.net https://www.eternum.io https://www.deadmansswitch.net

I love DMS! Thank you for implementing this on it. =)

Thanks, I'm glad you like it!

Re: A Guide to WebAuthn

#109

Post by adyavanapalli »

thayne wrote: post #92
adyavanapalli wrote: post #80

Earlier quoted context omitted.

Can you clarify whether you mean only the `attestationObject` should be sent to the server or that everything should be encoded as a single CBOR object and then sent to the server?

I mean why are ther multiple objects that have to be sent instead of a single cbor object. And why is some of it cbor and some of it json?

There are two complementary parts participating in the registration and authentication ceremonies, WebAuthn and CTAP. The response from the authenticator, as per the CTAP protocol standard, is encoded as CBOR. We need the JSON parts from the WebAuthn browser API for the parts in the ceremony that talk to the relying party (particularly for relaying the challenge responses, and allowed authenticator algorithms and behaviors).

Re: A Guide to WebAuthn

#110

Post by xur17 »

tialaramex wrote: post #103
xur17 wrote: post #91

Earlier quoted context omitted.

> But yeah it's a UX problem that hopefully will find a better/non-hacky solution than "register multiple keys for each site". This seems like a huge blocker for adoption. I currently run into this issue with FIDO for 2fa - I store my backup key offsite, which means enrolling the second device requires me to make a special trip to retrieve the device. My current approach is to retrieve the backup token every few mont…

Write the services down. You don't need to keep the fact that you have FIDO tokens secret unless you're keeping them somewhere otherwise unsafe like under a rock in your garden. So a list titled "Services I've enabled for FIDO" with check columns for the tokens gets it done.

That's my current approach, but I'm not as disciplined about writing them down as I should be.
Post reply on HN