151–160 of 274 posts
https://gitlab.com/stavros/django-webauthin
You can see a demo login here: https://www.pastery.net/
It allows the user to log in without a username or a password (untested on any Apple device as I don't have any, please file bugs if it doesn't work).
My company recently started using Okta. This is the first time I've heard of webAuthn. Is there any relationship between Okta and WebAuthn?
So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people…
It'd be really nice to see this working with iCloud Keychain at some point too - so you can have FIDO working as a secure platform thing but with syncing and dealing with the problem of effectively losing your keys over time etc
General advice: If worried about losing a device, try to register more than one. Even iCloud Keychain requires other hardware for authentication... same problem applies.
Only way out is having a backup like taking ID to an Apple Store as a way to regain access... that varies right now by provider, but who knows. Maybe Login with Apple will go WebAuthn-compatible in future? (Haven’t watched this video yet.)
If you’re an enterprise and worried about key authenticity or varying WebAuthN standards, you can look for specific types of keys or even request specific serial numbers of FIDO2 dongles from the web browser, etc.
Earlier quoted context omitted.
To think we could have had this a decade+ ago with TLS client certificates, if web browsers weren't perpetually stuck in the past.
You have the blame misattributed: almost nobody used client certificates because they cost money ($100+/year). That meant there was little demand outside of a few spaces like government and absent usage there was not much pressure on the UI improvements. Client certificates are also worse for privacy and phishing resistance: with a certificate, if I can convince you to click on a link I get your identity. From the si…
Earlier quoted context omitted.
Apple sells between 10-20% of smartphones per quarter[1], that implies Android makes up 80+% and Windows/Blackberry a neglible amount. How can Apple be a monopolist from such a small position, or have a "stranglehold" when they are outsold 4-8x by the competition? [1] https://www.statista.com/statistics/216459/global-market-sha...
So you are comparing Android vs iOS. You cannot see how that is Apples Vs Oranges? Just because something is based on Android doesn't make Everything Android vs iOS a direct comparison. Try Google Phones Vs Apple phones or Huawei vs Apple.
Interesting, Apple is letting you change your default web browser with this new iOS version, but also adding Face ID and Touch ID to Safari. Why would anyone want to build these features if they're so platform / browser specific? Does anyone know if these auth features might work on other browsers on iPhone?
Earlier quoted context omitted.
WebAuthn is less phishing resistant than it should be. The original intent was that WebAuthn + token binding would ensure that, even if an attacker obtained a fraudulent certificate for a victim site and had an MITM position on the network, the attacker still couldn’t steal a WebAuthn protected session. Alas, Chrome removes its token binding implementation, and WebAuthn no longer has this property. If you authenticat…
This is true, but it does prevent replay. So you are vulnerable to an active MITM, but they don't actually acquire any private secrets to be used to create their own sessions. MITM with passwords OTOH, gives the attacker your password.
So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people…
Webauthn actually fully supports this model as "platform authenticators", ie hardware security modules built into the client system. You see this on the windows side too where "Windows Hello" integrates with the TPM and acts as a platform authenticator as well. No need to speak roughly.
Earlier quoted context omitted.
It'd be really nice to see this working with iCloud Keychain at some point too - so you can have FIDO working as a secure platform thing but with syncing and dealing with the problem of effectively losing your keys over time etc
WebAuthn is generally about device authentication with credentials that can’t leave the device, though that could change depending on where and how the hardware gets/stores it’s tokens. Or if you rely on a third-party, like Apple, to store the tokens for you and use OAuth with an mfa indicator in the attestation? General advice: If worried about losing a device, try to register more than one. Even iCloud Keychain req…
But for normal people, we do need to get more of the balance into the usability side I think. The thing with iCloud Keychain is it can comfortably be recovered without breaking the end-to-end encryption with only a single remaining device, and many Apple users have as many as 3-4 devices in the circle of trust
It seems ideally some kind of "roaming platform" additional option would be good in the webauthn standard
So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people…