Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: WebAuthn – Replace Password or Second Factor?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 39 posts

Re: Ask HN: WebAuthn – Replace Password or Second Factor?

#11

Post by number6 »

twodave wrote: post #6
iwillbenice wrote: post #2

WebAuthn should negate the need for a 2nd factor in the traditional sense (you can't steal/extract the WebAuthn private-key). I suppose you could bolt on some kind of WebAuthn after a user/pass login, but I don't see why you wouldn't want it as the first-class citizen replacing the password entirely.

Overall I agree with this, but I think there's a genuine need for a general self-destruct mechanism. Having a key confiscated or taken by force should be preventable in some way, and even if I have a backup key, there needs to be a low-friction way to make a key unusable and unrecoverable. It would also be nice to have a way to quickly de-register a lost key. Having a back-up is great, but it's still a pain to go de-…

You can Set a PIN for the Token.

Re: Ask HN: WebAuthn – Replace Password or Second Factor?

#13

Post by brightball »

fHr wrote: post #9

2FA is so overused and makes just all workflows taking longer teams/outlook/jira takes 5 minutes to log on and finally starting work. Meanwhile everyone is on slack with no 2FA and on their servers which can/has been breached. Would also be great to not use my private phone for this. Companies already all push their 50 required apps on your private phone...

Yubikeys are so much faster than other 2FA options.

Just a quick tap.

All of the flavors of "type in this code from your app or that we texted you" are a huge pain by comparison.

Re: Ask HN: WebAuthn – Replace Password or Second Factor?

#14

Post by miiiiiike »

WAN will usually require a password and second factor to get to the point where you can enroll your device. For example, if you lose your WAN device or need to login a second one, you’ll need credentials (username/password+second factor) to prove who you are to enroll new devices.

I opted not to use WAN for now because it feels like a lot of hassle to setup and most users aren’t going to bother enrolling. Who here loves getting non-technical users setup with SSH keys? I don’t.

When people are more used to WAN it’s going to be great. Is anyone using it today? I’ve never seen it used in production.

Re: Ask HN: WebAuthn – Replace Password or Second Factor?

#16

Post by vladvasiliu »

miiiiiike wrote: post #14

WAN will usually require a password and second factor to get to the point where you can enroll your device. For example, if you lose your WAN device or need to login a second one, you’ll need credentials (username/password+second factor) to prove who you are to enroll new devices. I opted not to use WAN for now because it feels like a lot of hassle to setup and most users aren’t going to bother enrolling. Who here lo…

> Is anyone using it today? I’ve never seen it used in production

MS AzureAD / Office 365 supports it.

Re: Ask HN: WebAuthn – Replace Password or Second Factor?

#17

Post by webmobdev »

Apple's method of 2FA, where they display the code on one of your Apple devices for secondary confirmation, would be somewhat akin to the scenario of how WebAuthn could work as 2FA by asking for confirmation on supported devices. I find this quite annoying as I don't use an iPhone (a mobile phone is one of the few devices that you always keep with you).

That said, the key thing to consider here is security vs ease of use. The more you opt for ease of use (like writing down your password or saving your password in your browser or WebAuthn passkey or using a password manager), the more you sacrifice security with varying degree (as the risk of password leaking increases). I'd say the proposed passkeys is definitely one of the worse option here (akin to saving your password in your browser) as anyone with access to your device will be able to access all your accounts without even needing to know your credentials.

Re: Ask HN: WebAuthn – Replace Password or Second Factor?

#18

Post by nicoburns »

twodave wrote: post #6
iwillbenice wrote: post #2

WebAuthn should negate the need for a 2nd factor in the traditional sense (you can't steal/extract the WebAuthn private-key). I suppose you could bolt on some kind of WebAuthn after a user/pass login, but I don't see why you wouldn't want it as the first-class citizen replacing the password entirely.

Overall I agree with this, but I think there's a genuine need for a general self-destruct mechanism. Having a key confiscated or taken by force should be preventable in some way, and even if I have a backup key, there needs to be a low-friction way to make a key unusable and unrecoverable. It would also be nice to have a way to quickly de-register a lost key. Having a back-up is great, but it's still a pain to go de-…

I agree that revocation is important, but it's a little tricky. Make it too easy, and the attacker can steal a key and then immediately use it revoke your other keys, locking you out permanently.

Re: Ask HN: WebAuthn – Replace Password or Second Factor?

#19

Post by taf2 »

7steps2much wrote: post #3

In my opinion you should think of WebAuthn as the first factor. If you want additional second factors (of whatever nature they may be) you can still add these of course. Think of it like logging in using a SSH-key.

Thanks, I was thinking of it this way as well... for SSH keys I us a second factor as a hardware device but I can also use a hardware key for WebAuthn so that is where i was thinking maybe it's a 2nd factor... but for the web, I think it makes sense as a alternative to the password.

Re: Ask HN: WebAuthn – Replace Password or Second Factor?

#20

Post by mcstempel »

As usual - it depends.

There have been two main problems with WebAuthn as a primary factor. The first is that the UX experience of WebAuthn as a primary factor - either for "passwordless" or "usernameless" scenarios - has been pretty rough. The WebAuthn W3C group has put together a document that goes into far more detail [1]. One of the items out of that discussion was a standards change [2] that was merged in a few months ago. Now it's up to browser vendors to implement that change over the coming months and years.

The second problem with WebAuthn is that device based authentication has been historically risky for consumer users long-term. It's unreasonable to expect an individual to have access to their phone, yubikey, or laptop over a period of years. In the B2B space, this isn't as big of a deal. Getting an IT admin that works for your company to reset your access and issue a new credential is not a complex problem. Not so in the B2C space. Devices get lost or stolen, and then the service operator needs to build out an alternative recovery method that needs to be as secure as WebAuthn (ideally, without infringing on the user's privacy via KYC methods). New developments like Apple's PassKeys are super interesting and have the potential to really be a game changer for B2C WebAuthn adoption.

In summary, WebAuthn probably can't replace the password for your application today, unless your users are tech savvy and OK with the lock-out risk. However, the space going through some exciting changes and it may be much more feasible in a few years!

[1] https://github.com/w3c/webauthn/wiki/Explainer:-WebAuthn-Con... [2] https://github.com/w3c/webauthn/pull/1576

Post reply on HN