It's fine for services that use the web. But please don't try forcing it into non-web protocols like the megacorps are doing with their unique OAuth2 implementations and imap.
Ask HN: WebAuthn – Replace Password or Second Factor?
21–30 of 39 posts
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#22I, personally, will not be using WebAuthn by choice. I have a password manager that provides similar benefits, with universal compatibility. If forced, I will find a password manager that provides a simulated WebAuthn device.
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#23Passwords were a bad idea to begin with, they were just the least-bad option at the time. WebAuthn should be the first factor.
What is the recovery story with these 2fa, because it seems to be either but a second that you now also have to secure, or tough luck, have fun with 20+ support teams retaining access if you lose it and it's the first factor for login.
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#24I, personally, will not be using WebAuthn by choice. I have a password manager that provides similar benefits, with universal compatibility. If forced, I will find a password manager that provides a simulated WebAuthn device.
> If forced, I will find a password manager that provides a simulated WebAuthn device.
I don't think this is a workaround as much as it will be the default use case. Password managers are in a perfect position to keep custody of your private keys across devices, which provides acceptable security for the average person.
Even the password-less-ness of it is not actually entirely free from passwords. Both your iPhone cold booting and your password manager will require a master passphrase/password/pin to unlock your vault (and then use pin/face id for subsequent auth). The difference against a regular pw is that an attacker can replay an intercepted password for session renewal but a public key challenge cannot be replayed. It also means that you need a pw manager integrated all the way into the app/browser, and can't copy paste passwords. This is probably the biggest challenge.
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#25Passwords were a bad idea to begin with, they were just the least-bad option at the time. WebAuthn should be the first factor.
What is the recovery story with these 2fa, because it seems to be either but a second that you now also have to secure, or tough luck, have fun with 20+ support teams retaining access if you lose it and it's the first factor for login.
Recovery processes aren’t really affected by what you choose as an authentication factor.
Either someone successfully passes an authentication challenge, and you trust them, or they don't pass the challenge, and you don't trust them. And when you don't trust someone who claims to have legitimate access, you must find an alternative way to verify their identity outside of your normal authentication flow.
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#26Neither. If you want adoption then it needs to be; a parallel option to a password, and more convenient than a password.
You don't want to; add more layers to a work flow, or implement a system where the user can lock themselves out of their account trying to set up a new authentication process.
The people that want to explain why the above is bad security are not representative of the average computer user.
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#27As usual - it depends. There have been two main problems with WebAuthn as a primary factor. The first is that the UX experience of WebAuthn as a primary factor - either for "passwordless" or "usernameless" scenarios - has been pretty rough. The WebAuthn W3C group has put together a document that goes into far more detail [1]. One of the items out of that discussion was a standards change [2] that was merged in a few…
> New developments like Apple's PassKeys
Note that passkeys come out of the collaboration of many industry partners within FIDO and WebAuthn. I.e. it's not "Apple PassKeys" -- just "passkeys".
See for example https://fidoalliance.org/passkeys/
(disclaimer/context: I work on passkeys at Google)
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#28As usual - it depends. There have been two main problems with WebAuthn as a primary factor. The first is that the UX experience of WebAuthn as a primary factor - either for "passwordless" or "usernameless" scenarios - has been pretty rough. The WebAuthn W3C group has put together a document that goes into far more detail [1]. One of the items out of that discussion was a standards change [2] that was merged in a few…
> New developments like Apple's PassKeys Note that passkeys come out of the collaboration of many industry partners within FIDO and WebAuthn. I.e. it's not "Apple PassKeys" -- just "passkeys". See for example https://fidoalliance.org/passkeys/ (disclaimer/context: I work on passkeys at Google)
Ah yes, good call out! Didn't mean to exclude Google's contributions to this step forward in auth. I was super excited to read those additional details in Google announcement earlier this week. For those that haven't seen it: https://android-developers.googleblog.com/2022/10/bringing-p...
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#292FA is so overused and makes just all workflows taking longer teams/outlook/jira takes 5 minutes to log on and finally starting work. Meanwhile everyone is on slack with no 2FA and on their servers which can/has been breached. Would also be great to not use my private phone for this. Companies already all push their 50 required apps on your private phone...
> Companies already all push their 50 required apps on your private phone... There's a very simple answer to that: "Just say no!". I've told multiple employers over the years I will not put anything remotely close to spyware on my personal phone. If they provide a phone & plan, that's acceptable. If you're too timid to tell people no, just lie and say you only have a dumb phone or no phone.
Next employer I will just tell them I only own a nokia 6810 or something haha
Re: Ask HN: WebAuthn – Replace Password or Second Factor?
#30WAN will usually require a password and second factor to get to the point where you can enroll your device. For example, if you lose your WAN device or need to login a second one, you’ll need credentials (username/password+second factor) to prove who you are to enroll new devices. I opted not to use WAN for now because it feels like a lot of hassle to setup and most users aren’t going to bother enrolling. Who here lo…
Using an acronym no-one else in the thread is using, is not in common usage (this comment is 5:th for a google search for "WAN WebAuthN" and the other results do not use the acronym) and without defining it at the first usage is a bit confusing.