11 ms·

A Guide to WebAuthn

205 points by simonpure 7y ago

trulyrandom 7y ago
What's the story here regarding software tokens? As I understand it, the WebAuthn standard doesn't preclude non-hardware tokens, but doesn't explicitly define support for it either. In particular, I would like to use my phone and its built-in Titan M chip for WebAuthn authentication over the internet, instead of using a hardware token. Is that possible or on the horizon?
- arianvanp 7y ago
  That will already work right now! Go to https://webauthn.io https://webauthn.io on your phone and it will ask for your pin or fingerprint and then use the titan chip for the handshake! If it doesn't work. Select "Platform authenticator" in the drop down Will also work on iOS 13 beta. If your computer has a TPM 2.0 chip then it will also work on Microsoft Edge in Windows 10 (and maybe also other browsers. If they implement webauthb Microsoft Hello API ) Website is implemented with the excellent https://github.com/duo-labs/webauthn https://github.com/duo-labs/webauthn library by the way
  - beefhash 7y ago
    *webauthn.io, I assume EDIT: Disregard the rest of what I wrote here previously, I didn't realize it was Duo Labs's own website.
    - arianvanp 7y ago
      Website is not by me. I fixed the link. Thanks But webauthn.io and webauthn.guide are both copyright of Duo Labs and so is the library so I guess they can do whatever they want ;) I assume the two websites and the library are by the same author Also the library lives on the server side ; not client ; and given the license is not AGPL there is no need to state that they're using it either. (Edit: original comment was accusing me of copyright infringement for some reason)
      - beefhash 7y ago
        > But webauthn.io and webauthn.guide are both copyright of Duo Labs and so is the library so I guess they can do whatever they want ;) Yeah, I didn't realize that. Tried to edit it in, but too late. > Also the library lives on the server side ; not client ; and given the license is not AGPL there is no need to state that they're using it either. And I didn't notice that. I thought it was JavaScript, but it was Go all along. Doubly my bad. > (Edit: original comment was accusing me of copyright infringement for some reason) I was (wrongly) assuming webauthn.io was in violation of the license of the library because I thought it was a client-side library.
  - trulyrandom 7y ago
    Thanks for the info. This is not really 2FA anymore though, is it? Now WebAuthn authentication is happening on the same device as the one I'm using to log into the service. Is there a way to use my phone as a completely separate factor for WebAuthn authentication?
    - arianvanp 7y ago
      Webauthn is not a 2fa API. It's an authentication API. One of its usecases is to enhance password login (2fa) but can also be used as a single factor. That is up to the implementor. The implementor can ask the browser for certain security features of the authentication device. E.g. is the authentication device the same device as where the authentication flow is happening; is there a biometric check on the device or a pin on the device (i.e. the second factor is there but device-local) who is the manufacturer of the device (with consent of the user; given this is privacy-sensirive info) etc. And the implementor can then make a decision whether a device is 'strong' enough for single factor auth. All this information is cryptographically attested by the device. You can ignore all that and only use it as a second factor always though. That's totally up to you and how you use the authentication primitives that webauthn provides.
      - trulyrandom 7y ago
        Thanks again for the info. Sounds like I have some more reading up to do on WebAuthn.
  - ThePowerOfFuet 7y ago
    iOS 13.3 is what's required (not "13 beta"), and 13.3 was released a few weeks ago.
  - zaroth 7y ago
    I read that iOS 13.3 supports using a hardware token with WebAuthN. It doesn’t say you can just use TouchID to login without a separate WebAuth token.... > Currently, the WebAuthn second-factor use case (the FIDO U2F user experience) is the only log in flow that is supported. Security key-based biometrics or PIN (without the use of username and password) are not supported yet. https://www.yubico.com/2019/12/native-support-for-webauthn-and-fido-is-finally-here-on-iphones-and-ipads/ https://www.yubico.com/2019/12/native-support-for-webauthn-a...
TranquilMarmot 7y ago
How are these private keys being stored? It seems to be implied that there is a different public/private key pair for every website so are they stored in the browser? (or at an OS-level?)
- sam_lowry_ 7y ago
  They are stored on hardware tokens. There does not seem to be a way to have privately generated software keys, nothing like putty's pageant or .ssh/authorized_keys. WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem.
  - monocasa 7y ago
    > WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem. Can you expand on that?
    - sam_lowry_ 7y ago
      There is no way to generate your own software key pair as easily as one can do with ssh-keygen. The whole spec is designed with hardware tokens in mind, software tokens are not mentioned anywhere, and WebAuthn spec designers wave their hands when asked about software tokens.
      - deleted 7y ago
        [deleted]
      - StavrosK 7y ago
        You can just implement the client in software and use it if you want, the protocol doesn't care. Firefox already ships with that functionality and you can enable it.
        sam_lowry_ 7y ago
        >Firefox already ships with that functionality >and you can enable it. I can't find anything like that, can you point us to the docs/examples? OTOH, I see that someone right now posted a reply to https://github.com/w3c/webauthn/issues/1175#issuecomment-570945862 https://github.com/w3c/webauthn/issues/1175#issuecomment-570... trying to downplay the issue of purely software tokens Funnily, https://github.com/herrjemand/awesome-webauthn#software-authenticators https://github.com/herrjemand/awesome-webauthn#software-auth... is not about software tokens but about webauthning with an Android phone or a Wear OS.
navaati 7y ago
So, I went on the demo website (https://webauthn.io/ https://webauthn.io/) to try it with a recent desktop Firefox. I enter a username, press "Register" and Firefox gives me a prompt to "login [with a security key] and authorize", with only a "Cancel" button. And that's all that happens. Wait, so I can only use this stuff with a hardware token ? Bummer !
- masklinn 7y ago
  Firefox lets you enable software tokens, and disable USB tokens: in about:config, set security.webauth.webauthn_enable_softtoken=true security.webauth.webauthn_enable_usbtoken=false then the registration will go through without needing a hardware token.
  - zaroth 7y ago
    It’s almost like the designers thought - we are so damn close to killing the password, but, nah, why bother.
  - C14L 7y ago
    In other words, I can't use it in production (yet), because I'd need to ask users to change browser settings for it to work. That's disappointing :(
    - thayne 7y ago
      You can use it in production for users who have hardware tokens (and it is used in production by many sites for 2FA). But if you mean you can't _exclusively_ use it in production, then yes that is probably true since not all users will have authenticators (yet).
  - sam_lowry_ 7y ago
    Err... and how is my software token generated? Where is it stored? Can I move it around browsers, e.g. use it with my Mobile Firefox after I generated in on the desktop?
- 7y ago
richbradshaw 7y ago
If you have a Touch Bar MBP this works with Chrome and the Fingerprint Sensor out of the box. On iOS 13 you need a hardware token currently. MacOS Safari doesn't have support.
ecesena 7y ago
I see a lot of comments of people interested to test it out. If you have a hardware token with NFC, you can now test it everywhere: Mac, Windows, Linux (), Android (all browser), iOS (Safari iOS 13.3+). This is a big achievement as less than 1y ago the story was sooo much different. If you do NOT have a hardware token, here are some options: - Windows with TPM or Hello - Mac with touchID sensor, you have to use Chrome - Android phone, Chrome mobile, should work with fingerprint and face recognition - An Android phone itself can be used as a bluetooth hardware token, with Chrome on your laptop. Hope this list helps, please add if I forgot anything.
- StavrosK 7y ago
  Chrome beta on mobile didn't work for me with either fingerprint or any other method, the call to navigator.credentials.create just fails. Firefox half-works.
  - JshWright 7y ago
    Firefox mobile works for me on https://webauthn.io https://webauthn.io Which half doesn't work?
    - StavrosK 7y ago
      For me, authentication, though I see it works on that site. Maybe I made a mistake somewhere.
- Rafert 7y ago
  > An Android phone itself can be used as a bluetooth hardware token, with Chrome on your laptop. If you're referring to the caBLE (cloud-assisted Bluetooth LE) transport: this is still being worked on (https://github.com/w3c/webauthn/pull/909 https://github.com/w3c/webauthn/pull/909 but the actual discussion in the FIDO Alliance is non-public) and at the time of writing only works on Google properties. To add: https://github.com/herrjemand/awesome-webauthn https://github.com/herrjemand/awesome-webauthn also mentions implementations completely in software. Whether those are a good idea depends on your taste, but for playing around you don't need any kind of hardware.
tarjei 7y ago
What If I got multiple devices? Does the server have to store multiple keys per user?
- Rafert 7y ago
  Yes, that's what is recommended and most sites implement (AFAIK Twitter for some reason only permitting one :-/)
  - zaroth 7y ago
    And how do you enroll the second device? It would have to be something like; 1) Login on primary device 2) Generate a one-time code or link 3) Enter one-time code or click link on 2nd device 4) Click an “Enroll” button on the 2nd device which would generate a second enrollment saved in the account. You would have to do this for each and every service so that seems like a total non-starter. Alternatively, a way to share the private keys securely between the devices. But I’m not sure if there are site-specific salts as part of the WebAuthN signing process which would require additional state be sync’d between the devices in order to authenticate to a new service on both devices?
    - nickray 7y ago
      There's an ascending signature counter that's intended to prevent cloned devices (replay attacks are prevented seperately with server generated challenge). One way around it is clone (backup key) having very high initial signature counter set, so first use invalidates original (on loss). But yeah it's a UX problem that hopefully will find a better/non-hacky solution than "register multiple keys for each site".
      - xur17 7y ago
        > But yeah it's a UX problem that hopefully will find a better/non-hacky solution than "register multiple keys for each site". This seems like a huge blocker for adoption. I currently run into this issue with FIDO for 2fa - I store my backup key offsite, which means enrolling the second device requires me to make a special trip to retrieve the device. My current approach is to retrieve the backup token every few months and add it to all of the new services I have enrolled in, but I don't have a good system for remembering all of these services, so I inevitably forget one (despite only using the key on a few services)...
akubera 7y ago
So this is like BrowserID/Persona but instead of including the third-party email service to prove identification, the only credentials are on device/in-browser, right? I assume that if you only connect one computer (authenticator) and lose the device, you're either SOL or the service has some workaround where you pre-register an email address or a separate "Login With" service.
- StavrosK 7y ago
  No, it's a new standard where the site securely negotiates the login with the browser. What happens after that is the browser's job, all the site cares about is that it sees a correct credential. Eg your password manager could implement this so all you'd have to do is click "log in" and you'd be in, without usernames or passwords to remember or steal.
  - combatentropy 7y ago
    So, how do you keep someone else from sitting down at your computer and clicking Log In? Am I right in guessing that fundamentally you're back to passwords, in the sense that when you are away you lock your computer screen and have to enter a password to unlock it (or some other implementation that still relies on passwords, like if your browser requires a master password to use its password manager, etc.)
    - stavros 7y ago
      You use some method of authentication, of course. How do you keep someone who has your unlocked password manager from using it? You just make sure nobody is ever in that situation. The big win is that, with WebAuthn, you don't need to also hide your authentication from site operators, your OS, key loggers, phishers, etc etc.
      - combatentropy 7y ago
        Thanks. Like you said, this is safer, even if a password remains somewhere in the chain, like a master password for your computer. An advantage is that websites are not storing passwords (hashed or otherwise, because it's hard to do well).
StavrosK 7y ago
I am really excited about WebAuthn finally being the end of usernames/passwords and credential leaks/thefts, so much so that I've implemented a Django library for usernameless authentication with WebAuthn: https://pypi.org/project/django-webauthin/ https://pypi.org/project/django-webauthin/ It's live on some of my side projects, if you want to try it out: https://www.pastery.net https://www.pastery.net https://www.eternum.io https://www.eternum.io https://www.deadmansswitch.net https://www.deadmansswitch.net
- latchkey 7y ago
  I love DMS! Thank you for implementing this on it. =)
  - StavrosK 7y ago
    Thanks, I'm glad you like it!
scanr 7y ago
Anyone know if this will let sites use TouchID / FaceID on ios?
- jrockway 7y ago
  When I last tried a couple weeks ago it looked like some basic support for hardware tokens existed, but not for Face ID.
combatentropy 7y ago
This guide focuses on what WebAuthn looks like for the server. What does it look like for the user? As far as I can imagine, it boils down to relying on the possession of a certain piece of hardware instead of knowing a certain password. That is, I have to carry around some kind of USB device and plug it into every computer I want to use. The device holds all my secret keys and does all the magic behind the scenes. But if I lose my device, then I can't log in. And if someone steals my device, then they can log in. Maybe you can make it more convenient by using my phone instead of a specialized USB device, since everybody is always carrying around their phone everywhere they go anyway, right? But I just want to know that I understand the entire landscape first, from the point of view of the user, at a broad level. What are the user's options? What exactly does the user do? Is this only for smart users? If I made a web app for the general public, and my only method of authentication was WebAuthn, would the average user easily figure out what to do, or would they give up and walk away? Some have mentioned "software-based" tokens, but then how are those kept safe? With a master password? Then we're back to passwords.
- haecceity 7y ago
  There's usually a pin or a fingerprint reader on the usb device so that it's not usable except by the owner.
- tmikaeld 7y ago
  You can use psychical, TPM or biometric authentication, like fingerprint. The specs require one to be able to reset a login if device is lost, like with email and code or SMS.
- nickray 7y ago
  In FIDO-speak, "platform" authenticators are your laptop or phone, using their contained secure storage, vs "roaming" authnrs like our SoloKeys. Most people assume that the former will be the main way to use WebAuthn. Consumers using keys are mostly enthusiasts/early adopters/special needs. Mainly in a corporate setting, a separate hardware key may provide a root of trust (and audit trail if the key is modified to be trackable) , with which you can then unlock your devices in a self-service manner. You're right that software authnrs are a bad idea. For services that don't want the security to be pierced by such unsafe fallbacks, initial key attestation can whitelist the acceptable authenticators. One thing that is too infrequently highlighted is that FIDO2 is decentral authentication between you and the services, unlike "login with big-corp".
user738273 7y ago
In the future, what will prevent some random border officer from pointing my phone to my face and unlocking all my social media, google/Apple accounts, mail, bank etc?
- echeese 7y ago
  What's stopping them from doing that now?
  - user83628 7y ago
    My password, pin, whatever, is in my head
    - echeese 7y ago
      In that case you should probably not use this, or if you do, sign out of your accounts. If you're worried about Face ID, you can actually temporarily disable it easily (without even looking at your device) by holding down the power button and volume up until it vibrates.
alexchamberlain 7y ago
Is it fair to call this client side certificates 2.0?
gwillz 7y ago
I really enjoy the server-client diagram [1]. I've always thought myself very able to explain technical things quite well to non-technical people, but always struggled to explain the public/private key exchange in a simple way. This is really neat. 1: https://webauthn.guide/#authentication https://webauthn.guide/#authentication
ak217 7y ago
This is a great, highly accessible guide. The biggest value add is in the description of the protocol, although the W3C standard (https://www.w3.org/TR/webauthn/ https://www.w3.org/TR/webauthn/) was also expertly written and is a great, relatively accessible resource. Duo has done good work in this space. I've written an implementation of WebAuthn for Python-based webapps: https://github.com/pyauth/pywarp https://github.com/pyauth/pywarp that may be useful to implementers.
sebastien_b 7y ago
I didn't read the whole thing, but the first few paragraphs make it sound almost exactly like SQRL (ie. no secrets to keep).
- fiatjaf 7y ago
  SQRL used to be a nice protocol, now it's a completely unusable monster with more than 100 pages of technical documentation. If you're interested in something similar that actually works and is very simple, take a look at https://github.com/btcontract/lnurl-rfc/blob/master/spec.md#2-lnurl-auth https://github.com/btcontract/lnurl-rfc/blob/master/spec.md#...
thayne 7y ago
Why is the information that needs to be sent to the server so complicated? Specifically you need to send the rawId (raw bytes), clientDataJson (json), attestationObject (cbor) and the result of `getClientExtensionResults()` (js object). And then the attestationObject further includes an `authData` field which is itself a structure which contains another field which is CBOR encoded. Why not a single CBOR object?
- adyavanapalli 7y ago
  Can you clarify whether you mean only the `attestationObject` should be sent to the server or that everything should be encoded as a single CBOR object and then sent to the server?
  - thayne 7y ago
    I mean why are ther multiple objects that have to be sent instead of a single cbor object. And why is some of it cbor and some of it json?
    - arianvanp 7y ago
      Gets worse. Some of it is ASN.1 inside CBOR too. Some of it is custom binary format containing CBOR The answer is as far as I know: Backwards compatibility with bad decisions made in U2F Also; relying on base64url is odd as there are no built in functions in JavaScript to encode and decode it.
      - tomashubelbauer 7y ago
        > Also; relying on base64url is odd as there are no built in functions in JavaScript to encode and decode it. I'm probably missing something, but aren't window.atob and window.btoa just that? It's not available in Node though.
        thayne 7y ago
        btoa is base64 not base64url. And even if it was base64url, it takes a "binary string", so using it on, say, a Uint8Array is non-trivial.
pabs3 7y ago
Can WebAuth work on websites that do not use JavaScript?
- Freak_NL 7y ago
  No. The browser provides a client-side API that is exposed through JavaScript.
hamandcheese 7y ago
> After the PublicKeyCredential has been obtained, it is sent to the server for validation. The WebAuthn specification describes a 19-point procedure to validate the registration data 19 points?! I haven’t dug too deep into the details, but so far everything I’ve seen re: implementing WebAuthn seems so... over complicated? Compared to implementing, say, TOTP based 2FA, which is very straightforward.
- tialaramex 7y ago
  Complicated certainly. But over-complicated would imply that there's a significantly simpler way to do it. The nice thing about software is that it can be copied, so the complicated part only needs to be done once by somebody suitably skilled in the art.
toadi 7y ago
This is about the same library: https://www.agwa.name/blog/post/always_review_your_dependencies https://www.agwa.name/blog/post/always_review_your_dependenc... Claims there are it's written by people who don't understand Go that well.
beders 7y ago
My spider-senses are tingling: Is this tracking I can't get rid of?
- ficklepickle 7y ago
  I mean, if you are logged in, the service already knows who you are. I guess your public key could get associated with your identity. But the pub key is only sent when you register, I believe. So I can't see how this would be used for tracking.
fiatjaf 7y ago
Why is everybody acting as if this is some kind of solution to password-based auth? Can you even imagine a world in which a big chunk of the population carry these tokens around and never ever lose them?

205 points by simonpure 7y ago

What's the story here regarding software tokens? As I understand it, the WebAuthn standard doesn't preclude non-hardware tokens, but doesn't explicitly define support for it either. In particular, I would like to use my phone and its built-in Titan M chip for WebAuthn authentication over the internet, instead of using a hardware token. Is that possible or on the horizon?

arianvanp 7y ago
That will already work right now! Go to https://webauthn.io https://webauthn.io on your phone and it will ask for your pin or fingerprint and then use the titan chip for the handshake! If it doesn't work. Select "Platform authenticator" in the drop down Will also work on iOS 13 beta. If your computer has a TPM 2.0 chip then it will also work on Microsoft Edge in Windows 10 (and maybe also other browsers. If they implement webauthb Microsoft Hello API ) Website is implemented with the excellent https://github.com/duo-labs/webauthn https://github.com/duo-labs/webauthn library by the way
- beefhash 7y ago
  *webauthn.io, I assume EDIT: Disregard the rest of what I wrote here previously, I didn't realize it was Duo Labs's own website.
  - arianvanp 7y ago
    Website is not by me. I fixed the link. Thanks But webauthn.io and webauthn.guide are both copyright of Duo Labs and so is the library so I guess they can do whatever they want ;) I assume the two websites and the library are by the same author Also the library lives on the server side ; not client ; and given the license is not AGPL there is no need to state that they're using it either. (Edit: original comment was accusing me of copyright infringement for some reason)
    - beefhash 7y ago
      > But webauthn.io and webauthn.guide are both copyright of Duo Labs and so is the library so I guess they can do whatever they want ;) Yeah, I didn't realize that. Tried to edit it in, but too late. > Also the library lives on the server side ; not client ; and given the license is not AGPL there is no need to state that they're using it either. And I didn't notice that. I thought it was JavaScript, but it was Go all along. Doubly my bad. > (Edit: original comment was accusing me of copyright infringement for some reason) I was (wrongly) assuming webauthn.io was in violation of the license of the library because I thought it was a client-side library.
- trulyrandom 7y ago
  Thanks for the info. This is not really 2FA anymore though, is it? Now WebAuthn authentication is happening on the same device as the one I'm using to log into the service. Is there a way to use my phone as a completely separate factor for WebAuthn authentication?
  - arianvanp 7y ago
    Webauthn is not a 2fa API. It's an authentication API. One of its usecases is to enhance password login (2fa) but can also be used as a single factor. That is up to the implementor. The implementor can ask the browser for certain security features of the authentication device. E.g. is the authentication device the same device as where the authentication flow is happening; is there a biometric check on the device or a pin on the device (i.e. the second factor is there but device-local) who is the manufacturer of the device (with consent of the user; given this is privacy-sensirive info) etc. And the implementor can then make a decision whether a device is 'strong' enough for single factor auth. All this information is cryptographically attested by the device. You can ignore all that and only use it as a second factor always though. That's totally up to you and how you use the authentication primitives that webauthn provides.
    - trulyrandom 7y ago
      Thanks again for the info. Sounds like I have some more reading up to do on WebAuthn.
- ThePowerOfFuet 7y ago
  iOS 13.3 is what's required (not "13 beta"), and 13.3 was released a few weeks ago.
- zaroth 7y ago
  I read that iOS 13.3 supports using a hardware token with WebAuthN. It doesn’t say you can just use TouchID to login without a separate WebAuth token.... > Currently, the WebAuthn second-factor use case (the FIDO U2F user experience) is the only log in flow that is supported. Security key-based biometrics or PIN (without the use of username and password) are not supported yet. https://www.yubico.com/2019/12/native-support-for-webauthn-and-fido-is-finally-here-on-iphones-and-ipads/ https://www.yubico.com/2019/12/native-support-for-webauthn-a...

TranquilMarmot 7y ago

How are these private keys being stored? It seems to be implied that there is a different public/private key pair for every website so are they stored in the browser? (or at an OS-level?)

sam_lowry_ 7y ago
They are stored on hardware tokens. There does not seem to be a way to have privately generated software keys, nothing like putty's pageant or .ssh/authorized_keys. WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem.
- monocasa 7y ago
  > WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem. Can you expand on that?
  - sam_lowry_ 7y ago
    There is no way to generate your own software key pair as easily as one can do with ssh-keygen. The whole spec is designed with hardware tokens in mind, software tokens are not mentioned anywhere, and WebAuthn spec designers wave their hands when asked about software tokens.
    - deleted 7y ago
      [deleted]
    - StavrosK 7y ago
      You can just implement the client in software and use it if you want, the protocol doesn't care. Firefox already ships with that functionality and you can enable it.
      - sam_lowry_ 7y ago
        >Firefox already ships with that functionality >and you can enable it. I can't find anything like that, can you point us to the docs/examples? OTOH, I see that someone right now posted a reply to https://github.com/w3c/webauthn/issues/1175#issuecomment-570945862 https://github.com/w3c/webauthn/issues/1175#issuecomment-570... trying to downplay the issue of purely software tokens Funnily, https://github.com/herrjemand/awesome-webauthn#software-authenticators https://github.com/herrjemand/awesome-webauthn#software-auth... is not about software tokens but about webauthning with an Android phone or a Wear OS.

navaati 7y ago

So, I went on the demo website (https://webauthn.io/ https://webauthn.io/) to try it with a recent desktop Firefox. I enter a username, press "Register" and Firefox gives me a prompt to "login [with a security key] and authorize", with only a "Cancel" button. And that's all that happens. Wait, so I can only use this stuff with a hardware token ? Bummer !

masklinn 7y ago
Firefox lets you enable software tokens, and disable USB tokens: in about:config, set security.webauth.webauthn_enable_softtoken=true security.webauth.webauthn_enable_usbtoken=false then the registration will go through without needing a hardware token.
- zaroth 7y ago
  It’s almost like the designers thought - we are so damn close to killing the password, but, nah, why bother.
- C14L 7y ago
  In other words, I can't use it in production (yet), because I'd need to ask users to change browser settings for it to work. That's disappointing :(
  - thayne 7y ago
    You can use it in production for users who have hardware tokens (and it is used in production by many sites for 2FA). But if you mean you can't _exclusively_ use it in production, then yes that is probably true since not all users will have authenticators (yet).
- sam_lowry_ 7y ago
  Err... and how is my software token generated? Where is it stored? Can I move it around browsers, e.g. use it with my Mobile Firefox after I generated in on the desktop?
7y ago

richbradshaw 7y ago

If you have a Touch Bar MBP this works with Chrome and the Fingerprint Sensor out of the box. On iOS 13 you need a hardware token currently. MacOS Safari doesn't have support.

ecesena 7y ago

I see a lot of comments of people interested to test it out. If you have a hardware token with NFC, you can now test it everywhere: Mac, Windows, Linux (), Android (all browser), iOS (Safari iOS 13.3+). This is a big achievement as less than 1y ago the story was sooo much different. If you do NOT have a hardware token, here are some options: - Windows with TPM or Hello - Mac with touchID sensor, you have to use Chrome - Android phone, Chrome mobile, should work with fingerprint and face recognition - An Android phone itself can be used as a bluetooth hardware token, with Chrome on your laptop. Hope this list helps, please add if I forgot anything.

StavrosK 7y ago
Chrome beta on mobile didn't work for me with either fingerprint or any other method, the call to navigator.credentials.create just fails. Firefox half-works.
- JshWright 7y ago
  Firefox mobile works for me on https://webauthn.io https://webauthn.io Which half doesn't work?
  - StavrosK 7y ago
    For me, authentication, though I see it works on that site. Maybe I made a mistake somewhere.
Rafert 7y ago
> An Android phone itself can be used as a bluetooth hardware token, with Chrome on your laptop. If you're referring to the caBLE (cloud-assisted Bluetooth LE) transport: this is still being worked on (https://github.com/w3c/webauthn/pull/909 https://github.com/w3c/webauthn/pull/909 but the actual discussion in the FIDO Alliance is non-public) and at the time of writing only works on Google properties. To add: https://github.com/herrjemand/awesome-webauthn https://github.com/herrjemand/awesome-webauthn also mentions implementations completely in software. Whether those are a good idea depends on your taste, but for playing around you don't need any kind of hardware.

tarjei 7y ago

What If I got multiple devices? Does the server have to store multiple keys per user?

Rafert 7y ago
Yes, that's what is recommended and most sites implement (AFAIK Twitter for some reason only permitting one :-/)
- zaroth 7y ago
  And how do you enroll the second device? It would have to be something like; 1) Login on primary device 2) Generate a one-time code or link 3) Enter one-time code or click link on 2nd device 4) Click an “Enroll” button on the 2nd device which would generate a second enrollment saved in the account. You would have to do this for each and every service so that seems like a total non-starter. Alternatively, a way to share the private keys securely between the devices. But I’m not sure if there are site-specific salts as part of the WebAuthN signing process which would require additional state be sync’d between the devices in order to authenticate to a new service on both devices?
  - nickray 7y ago
    There's an ascending signature counter that's intended to prevent cloned devices (replay attacks are prevented seperately with server generated challenge). One way around it is clone (backup key) having very high initial signature counter set, so first use invalidates original (on loss). But yeah it's a UX problem that hopefully will find a better/non-hacky solution than "register multiple keys for each site".
    - xur17 7y ago
      > But yeah it's a UX problem that hopefully will find a better/non-hacky solution than "register multiple keys for each site". This seems like a huge blocker for adoption. I currently run into this issue with FIDO for 2fa - I store my backup key offsite, which means enrolling the second device requires me to make a special trip to retrieve the device. My current approach is to retrieve the backup token every few months and add it to all of the new services I have enrolled in, but I don't have a good system for remembering all of these services, so I inevitably forget one (despite only using the key on a few services)...

akubera 7y ago

So this is like BrowserID/Persona but instead of including the third-party email service to prove identification, the only credentials are on device/in-browser, right? I assume that if you only connect one computer (authenticator) and lose the device, you're either SOL or the service has some workaround where you pre-register an email address or a separate "Login With" service.

StavrosK 7y ago
No, it's a new standard where the site securely negotiates the login with the browser. What happens after that is the browser's job, all the site cares about is that it sees a correct credential. Eg your password manager could implement this so all you'd have to do is click "log in" and you'd be in, without usernames or passwords to remember or steal.
- combatentropy 7y ago
  So, how do you keep someone else from sitting down at your computer and clicking Log In? Am I right in guessing that fundamentally you're back to passwords, in the sense that when you are away you lock your computer screen and have to enter a password to unlock it (or some other implementation that still relies on passwords, like if your browser requires a master password to use its password manager, etc.)
  - stavros 7y ago
    You use some method of authentication, of course. How do you keep someone who has your unlocked password manager from using it? You just make sure nobody is ever in that situation. The big win is that, with WebAuthn, you don't need to also hide your authentication from site operators, your OS, key loggers, phishers, etc etc.
    - combatentropy 7y ago
      Thanks. Like you said, this is safer, even if a password remains somewhere in the chain, like a master password for your computer. An advantage is that websites are not storing passwords (hashed or otherwise, because it's hard to do well).

StavrosK 7y ago

I am really excited about WebAuthn finally being the end of usernames/passwords and credential leaks/thefts, so much so that I've implemented a Django library for usernameless authentication with WebAuthn: https://pypi.org/project/django-webauthin/ https://pypi.org/project/django-webauthin/ It's live on some of my side projects, if you want to try it out: https://www.pastery.net https://www.pastery.net https://www.eternum.io https://www.eternum.io https://www.deadmansswitch.net https://www.deadmansswitch.net

latchkey 7y ago
I love DMS! Thank you for implementing this on it. =)
- StavrosK 7y ago
  Thanks, I'm glad you like it!

scanr 7y ago

Anyone know if this will let sites use TouchID / FaceID on ios?

jrockway 7y ago
When I last tried a couple weeks ago it looked like some basic support for hardware tokens existed, but not for Face ID.

combatentropy 7y ago

This guide focuses on what WebAuthn looks like for the server. What does it look like for the user? As far as I can imagine, it boils down to relying on the possession of a certain piece of hardware instead of knowing a certain password. That is, I have to carry around some kind of USB device and plug it into every computer I want to use. The device holds all my secret keys and does all the magic behind the scenes. But if I lose my device, then I can't log in. And if someone steals my device, then they can log in. Maybe you can make it more convenient by using my phone instead of a specialized USB device, since everybody is always carrying around their phone everywhere they go anyway, right? But I just want to know that I understand the entire landscape first, from the point of view of the user, at a broad level. What are the user's options? What exactly does the user do? Is this only for smart users? If I made a web app for the general public, and my only method of authentication was WebAuthn, would the average user easily figure out what to do, or would they give up and walk away? Some have mentioned "software-based" tokens, but then how are those kept safe? With a master password? Then we're back to passwords.

haecceity 7y ago
There's usually a pin or a fingerprint reader on the usb device so that it's not usable except by the owner.
tmikaeld 7y ago
You can use psychical, TPM or biometric authentication, like fingerprint. The specs require one to be able to reset a login if device is lost, like with email and code or SMS.
nickray 7y ago
In FIDO-speak, "platform" authenticators are your laptop or phone, using their contained secure storage, vs "roaming" authnrs like our SoloKeys. Most people assume that the former will be the main way to use WebAuthn. Consumers using keys are mostly enthusiasts/early adopters/special needs. Mainly in a corporate setting, a separate hardware key may provide a root of trust (and audit trail if the key is modified to be trackable) , with which you can then unlock your devices in a self-service manner. You're right that software authnrs are a bad idea. For services that don't want the security to be pierced by such unsafe fallbacks, initial key attestation can whitelist the acceptable authenticators. One thing that is too infrequently highlighted is that FIDO2 is decentral authentication between you and the services, unlike "login with big-corp".

user738273 7y ago

In the future, what will prevent some random border officer from pointing my phone to my face and unlocking all my social media, google/Apple accounts, mail, bank etc?

echeese 7y ago
What's stopping them from doing that now?
- user83628 7y ago
  My password, pin, whatever, is in my head
  - echeese 7y ago
    In that case you should probably not use this, or if you do, sign out of your accounts. If you're worried about Face ID, you can actually temporarily disable it easily (without even looking at your device) by holding down the power button and volume up until it vibrates.

alexchamberlain 7y ago

Is it fair to call this client side certificates 2.0?

gwillz 7y ago

I really enjoy the server-client diagram [1]. I've always thought myself very able to explain technical things quite well to non-technical people, but always struggled to explain the public/private key exchange in a simple way. This is really neat. 1: https://webauthn.guide/#authentication https://webauthn.guide/#authentication

ak217 7y ago

This is a great, highly accessible guide. The biggest value add is in the description of the protocol, although the W3C standard (https://www.w3.org/TR/webauthn/ https://www.w3.org/TR/webauthn/) was also expertly written and is a great, relatively accessible resource. Duo has done good work in this space. I've written an implementation of WebAuthn for Python-based webapps: https://github.com/pyauth/pywarp https://github.com/pyauth/pywarp that may be useful to implementers.

sebastien_b 7y ago

I didn't read the whole thing, but the first few paragraphs make it sound almost exactly like SQRL (ie. no secrets to keep).

fiatjaf 7y ago
SQRL used to be a nice protocol, now it's a completely unusable monster with more than 100 pages of technical documentation. If you're interested in something similar that actually works and is very simple, take a look at https://github.com/btcontract/lnurl-rfc/blob/master/spec.md#2-lnurl-auth https://github.com/btcontract/lnurl-rfc/blob/master/spec.md#...

thayne 7y ago

Why is the information that needs to be sent to the server so complicated? Specifically you need to send the rawId (raw bytes), clientDataJson (json), attestationObject (cbor) and the result of `getClientExtensionResults()` (js object). And then the attestationObject further includes an `authData` field which is itself a structure which contains another field which is CBOR encoded. Why not a single CBOR object?

adyavanapalli 7y ago
Can you clarify whether you mean only the `attestationObject` should be sent to the server or that everything should be encoded as a single CBOR object and then sent to the server?
- thayne 7y ago
  I mean why are ther multiple objects that have to be sent instead of a single cbor object. And why is some of it cbor and some of it json?
  - arianvanp 7y ago
    Gets worse. Some of it is ASN.1 inside CBOR too. Some of it is custom binary format containing CBOR The answer is as far as I know: Backwards compatibility with bad decisions made in U2F Also; relying on base64url is odd as there are no built in functions in JavaScript to encode and decode it.
    - tomashubelbauer 7y ago
      > Also; relying on base64url is odd as there are no built in functions in JavaScript to encode and decode it. I'm probably missing something, but aren't window.atob and window.btoa just that? It's not available in Node though.
      - thayne 7y ago
        btoa is base64 not base64url. And even if it was base64url, it takes a "binary string", so using it on, say, a Uint8Array is non-trivial.

pabs3 7y ago

Can WebAuth work on websites that do not use JavaScript?

Freak_NL 7y ago
No. The browser provides a client-side API that is exposed through JavaScript.

hamandcheese 7y ago

> After the PublicKeyCredential has been obtained, it is sent to the server for validation. The WebAuthn specification describes a 19-point procedure to validate the registration data 19 points?! I haven’t dug too deep into the details, but so far everything I’ve seen re: implementing WebAuthn seems so... over complicated? Compared to implementing, say, TOTP based 2FA, which is very straightforward.

tialaramex 7y ago
Complicated certainly. But over-complicated would imply that there's a significantly simpler way to do it. The nice thing about software is that it can be copied, so the complicated part only needs to be done once by somebody suitably skilled in the art.

toadi 7y ago

This is about the same library: https://www.agwa.name/blog/post/always_review_your_dependencies https://www.agwa.name/blog/post/always_review_your_dependenc... Claims there are it's written by people who don't understand Go that well.

beders 7y ago

My spider-senses are tingling: Is this tracking I can't get rid of?

ficklepickle 7y ago
I mean, if you are logged in, the service already knows who you are. I guess your public key could get associated with your identity. But the pub key is only sent when you register, I believe. So I can't see how this would be used for tracking.

fiatjaf 7y ago

Why is everybody acting as if this is some kind of solution to password-based auth? Can you even imagine a world in which a big chunk of the population carry these tokens around and never ever lose them?