I'm wondering should we be thinking about WebAuthn as a method to replace passwords or should we be thinking of WebAuthn as a easier second factor in the authentication flow?
Ask HN: WebAuthn – Replace Password or Second Factor?
1–10 of 39 posts
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#2WebAuthn should negate the need for a 2nd factor in the traditional sense (you can't steal/extract the WebAuthn private-key). I suppose you could bolt on some kind of WebAuthn after a user/pass login, but I don't see why you wouldn't want it as the first-class citizen replacing the password entirely.
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#3In my opinion you should think of WebAuthn as the first factor. If you want additional second factors (of whatever nature they may be) you can still add these of course.
Think of it like logging in using a SSH-key.
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#4I think eventually, a lot of auth on the web will move to WebAuthn (when SSO isn't used).
However, one could potentially allow users to add 1-N credentials.
For example, a PassKey (WebAuthn) synced across devices, and then a WebAuthn credential stored on a Yubikey.
That way, you'd still need two factors, and hacking the computer alone isn't enough. But there is no "traditional" password involved.
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#5Something overwhelming of WebAuthn/U2F/FIDO2/Passkeys is that it has many different modes and settings [0]
So, my understanding is that you need to find the settings to 'upgrade' the modes from 2FA to a Passwordless alternative. Not all devices are supported.
I like this explanation in Ruby [1] [2] of all the process between the server and the browser. It also has an example you can try on your browser to see if your devices/OS are supported. Look at the bottom the distinction between Passwordless and 2FA.
I'm making a proof of concept of WebAuthn the only login option, for a toy project in PHP [0] with this library [1] It has been an interesting exercise to understand the tricky parts of it.
[0] https://webauthn.lubu.ch/_test/client.html
[1] https://betterprogramming.pub/implement-a-passwordless-authe... [2] https://archive.ph/SyaEW
[2] https://eapl.mx/twtxt/ [3] https://github.com/lbuchs/WebAuthn
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#6WebAuthn should negate the need for a 2nd factor in the traditional sense (you can't steal/extract the WebAuthn private-key). I suppose you could bolt on some kind of WebAuthn after a user/pass login, but I don't see why you wouldn't want it as the first-class citizen replacing the password entirely.
Overall I agree with this, but I think there's a genuine need for a general self-destruct mechanism. Having a key confiscated or taken by force should be preventable in some way, and even if I have a backup key, there needs to be a low-friction way to make a key unusable and unrecoverable.
It would also be nice to have a way to quickly de-register a lost key. Having a back-up is great, but it's still a pain to go de-register the thing on each individual provider's platform. And if I miss one provider it could easily be game over. I'm not a huge fan of centralization but a single registry for dead keys would make a lot of sense for the different providers to cooperate on.
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#7There are 3 modes:
1. WebAuthn as second factor
2. Passwordless login using WebAuthn as first factor
3. Usernameless login using WebAuthn residential keys. AFAIK this is what the new "passkeys" thing is also doing.
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#8WebAuthn should negate the need for a 2nd factor in the traditional sense (you can't steal/extract the WebAuthn private-key). I suppose you could bolt on some kind of WebAuthn after a user/pass login, but I don't see why you wouldn't want it as the first-class citizen replacing the password entirely.
Overall I agree with this, but I think there's a genuine need for a general self-destruct mechanism. Having a key confiscated or taken by force should be preventable in some way, and even if I have a backup key, there needs to be a low-friction way to make a key unusable and unrecoverable. It would also be nice to have a way to quickly de-register a lost key. Having a back-up is great, but it's still a pain to go de-…
Agree completely with your concerns with regards to lost/stolen keys.
Most of the places where I've been able to use my Yubikeys (FIDO2) also offer a very clear list of enrolled/registered keys, along with either a hash or serial number of the key. It makes revoking a key pretty easy in my experience.
I'm less keen on the idea of centralized repo for dead keys - each key is unique to the site in question, so there will be no need to share the existence of that revoked key's identifer with other providers - the data is meaningless to anyone else.
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#92FA is so overused and makes just all workflows taking longer teams/outlook/jira takes 5 minutes to log on and finally starting work. Meanwhile everyone is on slack with no 2FA and on their servers which can/has been breached.
Would also be great to not use my private phone for this. Companies already all push their 50 required apps on your private phone...
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#102FA is so overused and makes just all workflows taking longer teams/outlook/jira takes 5 minutes to log on and finally starting work. Meanwhile everyone is on slack with no 2FA and on their servers which can/has been breached. Would also be great to not use my private phone for this. Companies already all push their 50 required apps on your private phone...
> Companies already all push their 50 required apps on your private phone...
There's a very simple answer to that: "Just say no!". I've told multiple employers over the years I will not put anything remotely close to spyware on my personal phone. If they provide a phone & plan, that's acceptable.
If you're too timid to tell people no, just lie and say you only have a dumb phone or no phone.