3 ms·

Does anyone know whether password+key is a supported WebAuthn use case? I don't mean whether the standard supports it (it does), but whether it's planned. I wou

Does anyone know whether password+key is a supported WebAuthn use case? I don't mean whether the standard supports it (it does), but whether it's planned. I would love to use my Yubikey + PIN to log in to sites passwordlessly, but it seems that so far the only thing that anyone uses WebAuthn for is as a second factor.

acheron9383 7y ago
Microsoft has been making some progress on this front, allowing the use of only a security key to log in. https://www.yubico.com/solutions/passwordless/ https://www.yubico.com/solutions/passwordless/
- StavrosK 7y ago
  Very interesting, they do use WebAuthn passwordlessly. I'll see if I can try it out, thanks! Here's the whitepaper, if anyone is interested (the download form was broken): https://www.yubico.com/wp-content/uploads/2018/11/going-passwordless-wp-final-2.pdf https://www.yubico.com/wp-content/uploads/2018/11/going-pass...
tialaramex 7y ago
https://www.passwordless.dev/usernameless https://www.passwordless.dev/usernameless lets you try this flow out but I'd be surprised to see any significant adoption for the Web generally unless FIDO itself takes off first, because FIDO2 capable devices are more expensive. I can't justify telling people to pay extra when the core feature is not yet widely used.
- StavrosK 7y ago
  Thanks, that's very useful! I've been trying for ages to get my Yubikey to ask me for my PIN that I've set on it when authenticating, to no avail. It doesn't seem reasonable to have a site authenticate me with no PIN, since someone could just steal my yubikey and log in as me everywhere. Would anyone happen to know how I can force asking for a PIN?
  - lxgr 7y ago
    Ultimately, this is up to the website (relying party): It can require or prefer user authentication during enrolment or authentication; if the key supports it, the site can then skip password creation. There doesn't seem to be anything in the spec preventing an authenticator from always asking for a PIN, but at least for the Yubikey, I'm not aware of a way to achieve that.
    - StavrosK 7y ago
      This is true, but I'm asking for the opposite: the flag that asks the key to always enable auth. Would you happen to know it? I haven't been able to find it in the demos I tried.
  - tialaramex 7y ago
    The flow you're asking for (PIN required to do ordinary FIDO not just for FIDO2 passwordless auth) seems like a weird choice and I doubt it's possible. This hypothetical person has to get your password from somewhere. The mode most (essentially all non-test sites I've seen) used has FIDO only as second factor, so the bad guy needs your first factor (invariably a password) as well as the stolen Yubikey. You're asking for a three factor system, with two factors you know, plus a final factor you have. The improvement in threat resistance is small and the added inconvenience is large.
    - StavrosK 7y ago
      Oh no, sorry. I'm asking for FIDO2 passwordless. Right now I can do that (e.g. at https://www.passwordless.dev/passwordless https://www.passwordless.dev/passwordless), but the Yubikey doesn't ask for a PIN, which is insecure, since anyone stealing it can auth as me. I simply want passwordless auth to ask for my PIN. EDIT: It turns out Chrome does ask for the PIN (Firefox doesn't), but only when registering (not when logging in). This raises the question, why can the browser log me in without a PIN? Then the thief can simply use one of those browsers.
      - tialaramex 7y ago

acheron9383 7y ago

Microsoft has been making some progress on this front, allowing the use of only a security key to log in. https://www.yubico.com/solutions/passwordless/ https://www.yubico.com/solutions/passwordless/

StavrosK 7y ago
Very interesting, they do use WebAuthn passwordlessly. I'll see if I can try it out, thanks! Here's the whitepaper, if anyone is interested (the download form was broken): https://www.yubico.com/wp-content/uploads/2018/11/going-passwordless-wp-final-2.pdf https://www.yubico.com/wp-content/uploads/2018/11/going-pass...

tialaramex 7y ago

https://www.passwordless.dev/usernameless https://www.passwordless.dev/usernameless lets you try this flow out but I'd be surprised to see any significant adoption for the Web generally unless FIDO itself takes off first, because FIDO2 capable devices are more expensive. I can't justify telling people to pay extra when the core feature is not yet widely used.

StavrosK 7y ago
Thanks, that's very useful! I've been trying for ages to get my Yubikey to ask me for my PIN that I've set on it when authenticating, to no avail. It doesn't seem reasonable to have a site authenticate me with no PIN, since someone could just steal my yubikey and log in as me everywhere. Would anyone happen to know how I can force asking for a PIN?
- lxgr 7y ago
  Ultimately, this is up to the website (relying party): It can require or prefer user authentication during enrolment or authentication; if the key supports it, the site can then skip password creation. There doesn't seem to be anything in the spec preventing an authenticator from always asking for a PIN, but at least for the Yubikey, I'm not aware of a way to achieve that.
  - StavrosK 7y ago
    This is true, but I'm asking for the opposite: the flag that asks the key to always enable auth. Would you happen to know it? I haven't been able to find it in the demos I tried.
- tialaramex 7y ago
  The flow you're asking for (PIN required to do ordinary FIDO not just for FIDO2 passwordless auth) seems like a weird choice and I doubt it's possible. This hypothetical person has to get your password from somewhere. The mode most (essentially all non-test sites I've seen) used has FIDO only as second factor, so the bad guy needs your first factor (invariably a password) as well as the stolen Yubikey. You're asking for a three factor system, with two factors you know, plus a final factor you have. The improvement in threat resistance is small and the added inconvenience is large.
  - StavrosK 7y ago
    Oh no, sorry. I'm asking for FIDO2 passwordless. Right now I can do that (e.g. at https://www.passwordless.dev/passwordless https://www.passwordless.dev/passwordless), but the Yubikey doesn't ask for a PIN, which is insecure, since anyone stealing it can auth as me. I simply want passwordless auth to ask for my PIN. EDIT: It turns out Chrome does ask for the PIN (Firefox doesn't), but only when registering (not when logging in). This raises the question, why can the browser log me in without a PIN? Then the thief can simply use one of those browsers.
    - tialaramex 7y ago