2 ms·
Oh no, sorry. I'm asking for FIDO2 passwordless. Right now I can do that (e.g. at https://www.passwordless.dev/passwordless https://www.passwordless.dev/passwor
by StavrosK 7y ago
Oh no, sorry. I'm asking for FIDO2 passwordless. Right now I can do that (e.g. at https://www.passwordless.dev/passwordless https://www.passwordless.dev/passwordless), but the Yubikey doesn't ask for a PIN, which is insecure, since anyone stealing it can auth as me. I simply want passwordless auth to ask for my PIN.
EDIT: It turns out Chrome does ask for the PIN (Firefox doesn't), but only when registering (not when logging in). This raises the question, why can the browser log me in without a PIN? Then the thief can simply use one of those browsers.
- tialaramex 7y agoThe site you're looking at offers a variety of different WebAuthn flows. I linked the one that behaves how you described, requiring a PIN (and yes it requires the PIN to log in) but now you've found and linked a different flow that doesn't require PINs and sure enough it doesn't require PINs. I guess you could say the site is badly labelled. The true FIDO2 flow that I linked you to above is labelled usernameless rather than passwordless. The flow they've called passwordless works with an ordinary FIDO key it doesn't need FIDO2. Because it simply doesn't have a password. Passwordless. Simple.
- StavrosK 7y agoTrying it on Chrome, it works as you say. On Firefox it just failed to auth, I assumed it was because my Yubikey lacked onboard storage for storing the user details but it looks like it's because of the lack of PIN support. Thanks.