Yubico and Microsoft Introduce Passwordless Login
1–10 of 218 posts
Re: Yubico and Microsoft Introduce Passwordless Login
#2Can someone remind me why we don't use public key cryptography for authentication on websites?
Re: Yubico and Microsoft Introduce Passwordless Login
#3More specifically, they're introducing passwordless login with FIDO2, as Windows had had passwordless logins with certs and CAC cards for ages.
Re: Yubico and Microsoft Introduce Passwordless Login
#4Can someone remind me why we don't use public key cryptography for authentication on websites?
The browser UI is terrible and there's been very little incentive to improve it. The largest user of client-side crypto that I'm aware of is the US DoD with the Common Access Card program, and they just train people on how to use the crappy UI.
Re: Yubico and Microsoft Introduce Passwordless Login
#5Can someone remind me why we don't use public key cryptography for authentication on websites?
Key management.
Re: Yubico and Microsoft Introduce Passwordless Login
#6Glad to see greater adoption of Yubikeys, however there is still a long way to go. Speaking from experience writing a u2f_auth client library, browser support is still nascent and hacky. Edge, safari, and AWS would need to adopt it before I would truly consider it mainstream.
If anyone is considering adopting Yubikeys in their organization using a language that is not supported by one of their client libraries my email is in my profile and I would glad to help out to the best of my ability.
Re: Yubico and Microsoft Introduce Passwordless Login
#7So my biggest question here is: Is this Azure only? Each announcement about it seems to indicate that I might not be able to use this key with my local account PC.
Specifically, I have one use case computer where I have no screen, and getting through Windows login without it can be troublesome. I'd love to use this key to unlock it instead, but it's an offline machine.
I had this plan with Yubikey for Windows Hello, which has been out a while, and I bought a Yubikey, and discovered it could only unlock my Windows machine if it was locked (not logged out), which defeated the purpose entirely.
Re: Yubico and Microsoft Introduce Passwordless Login
#8Ad companies that specialize in re-targeting are going to have an absolute blast with this!
Re: Yubico and Microsoft Introduce Passwordless Login
#9Two things - is there really need for them to be this large? They also look vulnerable? Maybe its just the look, but the blue one looks like it won't survive proper stress test...
And second thing - is exposing connector safe against mechanical damage? Will it withstand constantly being scratched by keys?
Re: Yubico and Microsoft Introduce Passwordless Login
#10Correct me if I am wrong, but passwordless login is a single-factor authentication and less secure than MFA. Depending on whenever hardware key is more or less secure than the password, the mass adoption of this could make things LESS secure.