A Guide to WebAuthn
webauthn.guide
A Guide to WebAuthn
1–10 of 122 posts
Re: A Guide to WebAuthn
#2How are these private keys being stored? It seems to be implied that there is a different public/private key pair for every website so are they stored in the browser? (or at an OS-level?)
Re: A Guide to WebAuthn
#3How are these private keys being stored? It seems to be implied that there is a different public/private key pair for every website so are they stored in the browser? (or at an OS-level?)
They are stored on hardware tokens. There does not seem to be a way to have privately generated software keys, nothing like putty's pageant or .ssh/authorized_keys.
WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem.
Re: A Guide to WebAuthn
#4How are these private keys being stored? It seems to be implied that there is a different public/private key pair for every website so are they stored in the browser? (or at an OS-level?)
They are stored on hardware tokens. There does not seem to be a way to have privately generated software keys, nothing like putty's pageant or .ssh/authorized_keys. WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem.
> WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem.
Can you expand on that?
Re: A Guide to WebAuthn
#5So, I went on the demo website (https://webauthn.io/) to try it with a recent desktop Firefox.
I enter a username, press "Register" and Firefox gives me a prompt to "login [with a security key] and authorize", with only a "Cancel" button. And that's all that happens.
Wait, so I can only use this stuff with a hardware token ? Bummer !
Re: A Guide to WebAuthn
#6What's the story here regarding software tokens? As I understand it, the WebAuthn standard doesn't preclude non-hardware tokens, but doesn't explicitly define support for it either. In particular, I would like to use my phone and its built-in Titan M chip for WebAuthn authentication over the internet, instead of using a hardware token. Is that possible or on the horizon?
Re: A Guide to WebAuthn
#7What's the story here regarding software tokens? As I understand it, the WebAuthn standard doesn't preclude non-hardware tokens, but doesn't explicitly define support for it either. In particular, I would like to use my phone and its built-in Titan M chip for WebAuthn authentication over the internet, instead of using a hardware token. Is that possible or on the horizon?
That will already work right now!
Go to https://webauthn.io on your phone and it will ask for your pin or fingerprint and then use the titan chip for the handshake! If it doesn't work. Select "Platform authenticator" in the drop down
Will also work on iOS 13 beta.
If your computer has a TPM 2.0 chip then it will also work on Microsoft Edge in Windows 10 (and maybe also other browsers. If they implement webauthb Microsoft Hello API )
Website is implemented with the excellent https://github.com/duo-labs/webauthn library by the way
Re: A Guide to WebAuthn
#8How are these private keys being stored? It seems to be implied that there is a different public/private key pair for every website so are they stored in the browser? (or at an OS-level?)
They are stored on hardware tokens. There does not seem to be a way to have privately generated software keys, nothing like putty's pageant or .ssh/authorized_keys. WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem.
There are already open source hardware and software available by the people at SoloKey. Both Nitrokey and SoloKey sell the tokens.
Re: A Guide to WebAuthn
#9What's the story here regarding software tokens? As I understand it, the WebAuthn standard doesn't preclude non-hardware tokens, but doesn't explicitly define support for it either. In particular, I would like to use my phone and its built-in Titan M chip for WebAuthn authentication over the internet, instead of using a hardware token. Is that possible or on the horizon?
That will already work right now! Go to https://webauthn.io on your phone and it will ask for your pin or fingerprint and then use the titan chip for the handshake! If it doesn't work. Select "Platform authenticator" in the drop down Will also work on iOS 13 beta. If your computer has a TPM 2.0 chip then it will also work on Microsoft Edge in Windows 10 (and maybe also other browsers. If they implement webauthb Micro…
*webauthn.io, I assume
EDIT: Disregard the rest of what I wrote here previously, I didn't realize it was Duo Labs's own website.
Re: A Guide to WebAuthn
#10So, I went on the demo website ( https://webauthn.io/ ) to try it with a recent desktop Firefox. I enter a username, press "Register" and Firefox gives me a prompt to "login [with a security key] and authorize", with only a "Cancel" button. And that's all that happens. Wait, so I can only use this stuff with a hardware token ? Bummer !
Firefox lets you enable software tokens, and disable USB tokens: in about:config, set
security.webauth.webauthn_enable_softtoken=true
security.webauth.webauthn_enable_usbtoken=false