3 ms·
That's actually quite cool. The use case in the spec indicates a really smooth user experience while providing great security. https://www.w3.org/TR/webauthn/#u
by danieka 10y ago
That's actually quite cool. The use case in the spec indicates a really smooth user experience while providing great security. https://www.w3.org/TR/webauthn/#use-cases https://www.w3.org/TR/webauthn/#use-cases
I'm definitely going to keep track of this standard, but as I understand it no browser has released it yet?
Edit: I didn't properly read your reply, so disregard everything after "quite cool". :)
- hdhzy 10y agoEdge has Web Authentication support but only a draft version. The generated keypair is stored in TPM so after authentication credentials are basically bound to user's device. Web authentication is indeed quite cool. You can also drop passwords altogether and just rely on the token and the username (caveat: someone knows your username and physically steals your token is a threat) or even drop usernames at all! As U2F tokens generate new keypair per origin you'd only need the token to authorize. Of course if someone steals it and tries to login to your site... It's like physical key.