3 ms·

WebAuthn does this, and chrome/FF/edge support this. They're also adding CTAP2 support allowing the use of biometric, BTLE, and NFC devices to provide authenti

by tonyhb 8y ago

WebAuthn does this, and chrome/FF/edge support this. They're also adding CTAP2 support allowing the use of biometric, BTLE, and NFC devices to provide authentication keys. Soon you'll be able to use TouchID to log in to your website, provided you've associated the pubkey from your fingerprint authn with your website. https://www.chromestatus.com/features#component%3A%20Blink%3EWebAuthentication https://www.chromestatus.com/features#component%3A%20Blink%3... (TouchID on MacOS: TBD) https://bugs.chromium.org/p/chromium/issues/detail?id=780078#c31 https://bugs.chromium.org/p/chromium/issues/detail?id=780078... (CTAP2: merged) https://www.chromestatus.com/features/6288375388569600 https://www.chromestatus.com/features/6288375388569600. We're integrating webauthn for our medical clinics as a way to support easy, secure authentication without 2FA to reduce sharing of ipads with a session logged in. More reading: https://duo.com/blog/developments-to-webauthn-and-the-fido2-framework https://duo.com/blog/developments-to-webauthn-and-the-fido2-...

civilian 8y ago
Awesome!!
plopz 8y ago
So instead of password managers we'll have private key managers?
- tialaramex 8y ago
  WebAuthn private keys don't exist at all outside of the physical token. So there's nothing to manage. If you rely on WebAuthn as an essential authentication step you'd have two or more tokens registered and treat those the same way you would house keys.
  - simongr3dal 8y ago
    When you lose a house key it's pretty manageable to get a few locks changed, but it can be rather overwhelming to remember all the dozens of websites that have your auth details, and update them.
    - tialaramex 8y ago
      Good news. Like a house key, the FIDO keys are basically anonymous. So, as long as you didn't e.g. leave it with your wallet on a bus, or write on it with non-erasable marker "simongr3dal@example.com" losing the key is not that scary. In fact, unlike a house key, the Security Key works fine for its new owner, they can register it to sign into their Facebook, or whatever, that will work fine. Facebook will have no idea it's your key, now it's their key. If they know you're simongr3dal@example.com on Facebook then that's a problem, yes, as obviously they can sign in as you, but if it's so hard for you to remember what you signed up to, seems like it'll be pretty hard for a hypothetical finder to figure out too... "Hmm, I wonder if this random stranger was into Diaper Porn and Antique furniture?"
- dboreham 8y ago
  AKA "wallet"

by tonyhb 8y ago

civilian 8y ago

Awesome!!

plopz 8y ago

So instead of password managers we'll have private key managers?

tialaramex 8y ago
WebAuthn private keys don't exist at all outside of the physical token. So there's nothing to manage. If you rely on WebAuthn as an essential authentication step you'd have two or more tokens registered and treat those the same way you would house keys.
- simongr3dal 8y ago
  When you lose a house key it's pretty manageable to get a few locks changed, but it can be rather overwhelming to remember all the dozens of websites that have your auth details, and update them.
  - tialaramex 8y ago
    Good news. Like a house key, the FIDO keys are basically anonymous. So, as long as you didn't e.g. leave it with your wallet on a bus, or write on it with non-erasable marker "simongr3dal@example.com" losing the key is not that scary. In fact, unlike a house key, the Security Key works fine for its new owner, they can register it to sign into their Facebook, or whatever, that will work fine. Facebook will have no idea it's your key, now it's their key. If they know you're simongr3dal@example.com on Facebook then that's a problem, yes, as obviously they can sign in as you, but if it's so hard for you to remember what you signed up to, seems like it'll be pretty hard for a hypothetical finder to figure out too... "Hmm, I wonder if this random stranger was into Diaper Porn and Antique furniture?"
dboreham 8y ago
AKA "wallet"