How is this related to this:
https://www.w3.org/TR/webauthn/
?
EDIT: found this relevant comment (I think) from yesterday's discussion: https://news.ycombinator.com/item?id=17030302
Web Authentication API
21–30 of 76 posts
Re: Web Authentication API
#22Earlier quoted context omitted.
Stealing Web Authentication keys from a hardware token is a significantly higher bar than phishing you or brute-forcing your password hash from a database leak. At the very _least_ the attacker would first have to compromise your machine with malware, at which point they could easily get access to all your password-protected accounts anyway with a simple keylogger.
What happens if you lose your hardware token (or it gets stolen, ec.)? Is there a way for then to access your accounts?
backup/recovery codes and/or "forgot your password (authenticator)" recovery
Re: Web Authentication API
#23Finally! I have a design concept that I wanted to propose but never got around it which would be very similar or even the complement, but without all the security details that I do not know how to do and that this API is strong on: https://jsfiddle.net/franciscop/qj4g3rz8/
The browser could store several data points for each field so you can choose from a dropdown OR different user profiles so you can switch from "Francisco the freelancer" to "Francisco the open source guy" in the drop of a beat. Or per window to do both at the same time if that's your thing.
But anyway, this new Web Authentication API is really, really awesome to remove passwords forever. Now we need the last one, which would be closer to my design concept to even remove the manually adding all those fields: Web Identity API.
Re: Web Authentication API
#24For people confused about what this is: it's basically the de facto cross-browser standard for U2F security keys like Yubikeys.
Can it also be used for SSH logins without much bending of the concepts?
And does it allow extensions, e.g. secure login through a smartwatch + NFC, and similar ideas?
Re: Web Authentication API
#25For people confused about what this is: it's basically the de facto cross-browser standard for U2F security keys like Yubikeys.
Is this like Client Certs without the connection to the SSL cert? Oh, I guess client certs are owned and controlled by the server owner...
Sorta, Client Certs but the Client generates and authenticates them, the Server only stores the fingerprint and authenticates them on it's side.
And with a better UI and flow since you don't need it to establish connection.
Re: Web Authentication API
#26Earlier quoted context omitted.
you can partialy (password + second factor authentication) use this when using 2FA with your Google account, https://support.yubico.com/support/solutions/articles/150000...
Doesn't work with Firefox yet AFAIK. That page mentions requiring Google Chrome.
It works with Firefox 60, Google however sometimes relies on Chrome quirks not specified in the standard which may not make it usable in Firefox. (Last I checked)
Re: Web Authentication API
#27For people confused about what this is: it's basically the de facto cross-browser standard for U2F security keys like Yubikeys.
Can it also be used for SSH logins without much bending of the concepts? And does it allow extensions, e.g. secure login through a smartwatch + NFC, and similar ideas?
Yes it can, I used U2F in CLI apps to sign HTTP requests: https://developers.yubico.com/U2F/Libraries/Using_a_library....
There is also pam-u2f: https://developers.yubico.com/pam-u2f/
and https://github.com/bluecmd/openssh-u2f (not in upstream)
Re: Web Authentication API
#28Earlier quoted context omitted.
Doesn't work with Firefox yet AFAIK. That page mentions requiring Google Chrome.
It works with Firefox 60, Google however sometimes relies on Chrome quirks not specified in the standard which may not make it usable in Firefox. (Last I checked)
It does not, and Google does not yet even attempt to use WebAuthn. They're still using the (now legacy) U2F authentication mechanism, which firefox does not fully support. It works in some sites if you enable it in about:config, but not all. Like google.com.
Re: Web Authentication API
#29For people confused about what this is: it's basically the de facto cross-browser standard for U2F security keys like Yubikeys.
Thanks, interesting subject. Are there any worthy DIY Yubikey-like tutorials out there?
The spec hasn't been finalized yet, IIRC, but you will be able to roll your own when it does, as it'll be an open protocol.
Re: Web Authentication API
#30How is this related to this: https://www.w3.org/TR/webauthn/ ? EDIT: found this relevant comment (I think) from yesterday's discussion: https://news.ycombinator.com/item?id=17030302
The first sentence in TFA:
> The Web Authentication API (also referred to as WebAuthn)