3 ms·

So, I went on the demo website (https://webauthn.io/ https://webauthn.io/) to try it with a recent desktop Firefox. I enter a username, press "Register" and Fi

So, I went on the demo website (https://webauthn.io/ https://webauthn.io/) to try it with a recent desktop Firefox. I enter a username, press "Register" and Firefox gives me a prompt to "login [with a security key] and authorize", with only a "Cancel" button. And that's all that happens. Wait, so I can only use this stuff with a hardware token ? Bummer !

masklinn 7y ago
Firefox lets you enable software tokens, and disable USB tokens: in about:config, set security.webauth.webauthn_enable_softtoken=true security.webauth.webauthn_enable_usbtoken=false then the registration will go through without needing a hardware token.
- zaroth 7y ago
  It’s almost like the designers thought - we are so damn close to killing the password, but, nah, why bother.
- C14L 7y ago
  In other words, I can't use it in production (yet), because I'd need to ask users to change browser settings for it to work. That's disappointing :(
  - thayne 7y ago
    You can use it in production for users who have hardware tokens (and it is used in production by many sites for 2FA). But if you mean you can't _exclusively_ use it in production, then yes that is probably true since not all users will have authenticators (yet).
- sam_lowry_ 7y ago
  Err... and how is my software token generated? Where is it stored? Can I move it around browsers, e.g. use it with my Mobile Firefox after I generated in on the desktop?
the_gipsy 7y ago
Firefox mobile allows using fingerprint.
- StavrosK 7y ago
  I recently implemented this in a library (https://pypi.org/project/django-webauthin/ https://pypi.org/project/django-webauthin/), and Firefox mobile (at least for me) won't log you in if you're using resident keys. Registering the key works, but not authenticating. It's odd.
download13 7y ago
If you're using windows I think you need to setup a pin or the hello auth method. Once windows has a quick way to authenticate you it'll offer that when you register

masklinn 7y ago

Firefox lets you enable software tokens, and disable USB tokens: in about:config, set security.webauth.webauthn_enable_softtoken=true security.webauth.webauthn_enable_usbtoken=false then the registration will go through without needing a hardware token.

zaroth 7y ago
It’s almost like the designers thought - we are so damn close to killing the password, but, nah, why bother.
C14L 7y ago
In other words, I can't use it in production (yet), because I'd need to ask users to change browser settings for it to work. That's disappointing :(
- thayne 7y ago
  You can use it in production for users who have hardware tokens (and it is used in production by many sites for 2FA). But if you mean you can't _exclusively_ use it in production, then yes that is probably true since not all users will have authenticators (yet).
sam_lowry_ 7y ago
Err... and how is my software token generated? Where is it stored? Can I move it around browsers, e.g. use it with my Mobile Firefox after I generated in on the desktop?

the_gipsy 7y ago

Firefox mobile allows using fingerprint.

StavrosK 7y ago
I recently implemented this in a library (https://pypi.org/project/django-webauthin/ https://pypi.org/project/django-webauthin/), and Firefox mobile (at least for me) won't log you in if you're using resident keys. Registering the key works, but not authenticating. It's odd.

download13 7y ago

If you're using windows I think you need to setup a pin or the hello auth method. Once windows has a quick way to authenticate you it'll offer that when you register