4 ms·

There is no way to generate your own software key pair as easily as one can do with ssh-keygen. The whole spec is designed with hardware tokens in mind, softwa

There is no way to generate your own software key pair as easily as one can do with ssh-keygen. The whole spec is designed with hardware tokens in mind, software tokens are not mentioned anywhere, and WebAuthn spec designers wave their hands when asked about software tokens.

deleted 7y ago
[deleted]
StavrosK 7y ago
You can just implement the client in software and use it if you want, the protocol doesn't care. Firefox already ships with that functionality and you can enable it.
- sam_lowry_ 7y ago
  >Firefox already ships with that functionality >and you can enable it. I can't find anything like that, can you point us to the docs/examples? OTOH, I see that someone right now posted a reply to https://github.com/w3c/webauthn/issues/1175#issuecomment-570945862 https://github.com/w3c/webauthn/issues/1175#issuecomment-570... trying to downplay the issue of purely software tokens Funnily, https://github.com/herrjemand/awesome-webauthn#software-authenticators https://github.com/herrjemand/awesome-webauthn#software-auth... is not about software tokens but about webauthning with an Android phone or a Wear OS.
  - StavrosK 7y ago
    Here: https://news.ycombinator.com/item?id=21963399 https://news.ycombinator.com/item?id=21963399 Which comment is trying to downplay the issue? What is the issue?
  - nickray 7y ago
    The point is that ssh keys lying around on your laptop aren't the greatest idea either. Where is the root of trust? The password you type to terminal if you encrypt them? FIDO2 starts with the idea of safe defaults, where either client devices (Android, laptop TPM,...) store the keys safely, or dongle vendors (like us, SoloKeys). These have a business interest in doing their job properly. But there's nothing preventing software implementations, it's an open standard in that respect (I do have other issues with it but your specific concern is unfounded imho).
  - sam_lowry_ 7y ago
    @nickray, with ssh, I manage the root of thrust. With Webauthn, someone else manages it for me, be it Yubico or Intel or Apple. This is a fundamental difference.
    - StavrosK 7y ago
      You're wrong. You can manage your own keys. You don't need any big corporation for WebAuthn.
      - dane-pgp 7y ago
        Well, that's assuming that the anti-feature of device attestation doesn't end up being used in the inevitable way that the spec allows: "But attestation is not spoofable. Therefore, if sites launch webauthn support and accept attestations from the current set of token vendors, future vendors may be locked out of the market: Their devices won’t work because their attestations aren’t trusted, and they won’t be able to get sites to update because they won’t have enough market presence to matter." https://www.imperialviolet.org/2018/03/27/webauthn.html https://www.imperialviolet.org/2018/03/27/webauthn.html
        StavrosK 7y ago
        Yes, if a service says "we only support Yubikeys for login", you should boycott them.
        dane-pgp 7y ago
        I hope that principle does establish itself among users of the web, but I suspect that if a bank says "You have to use one of these supported devices to access your account online" people are not going to change their bank because of it. Similarly, if China mandates a government-approved (backdoored?) device when accessing Chinese websites, I don't suppose Chinese citizens are going to boycott those. Other countries might reasonably retaliate by forbidding sites to accept authentication by devices made in China. Do you think that if Apple decreed that you can only securely log in to Apple websites with an iPhone (or some other device made by Apple) people would switch to Android? It's hard enough to get people to boycott Facebook despite repeated scandals that are much worse than having a whitelist of supported authentication devices.

deleted 7y ago

[deleted]

StavrosK 7y ago

You can just implement the client in software and use it if you want, the protocol doesn't care. Firefox already ships with that functionality and you can enable it.

sam_lowry_ 7y ago
>Firefox already ships with that functionality >and you can enable it. I can't find anything like that, can you point us to the docs/examples? OTOH, I see that someone right now posted a reply to https://github.com/w3c/webauthn/issues/1175#issuecomment-570945862 https://github.com/w3c/webauthn/issues/1175#issuecomment-570... trying to downplay the issue of purely software tokens Funnily, https://github.com/herrjemand/awesome-webauthn#software-authenticators https://github.com/herrjemand/awesome-webauthn#software-auth... is not about software tokens but about webauthning with an Android phone or a Wear OS.
- StavrosK 7y ago
  Here: https://news.ycombinator.com/item?id=21963399 https://news.ycombinator.com/item?id=21963399 Which comment is trying to downplay the issue? What is the issue?
- nickray 7y ago
  The point is that ssh keys lying around on your laptop aren't the greatest idea either. Where is the root of trust? The password you type to terminal if you encrypt them? FIDO2 starts with the idea of safe defaults, where either client devices (Android, laptop TPM,...) store the keys safely, or dongle vendors (like us, SoloKeys). These have a business interest in doing their job properly. But there's nothing preventing software implementations, it's an open standard in that respect (I do have other issues with it but your specific concern is unfounded imho).
- sam_lowry_ 7y ago
  @nickray, with ssh, I manage the root of thrust. With Webauthn, someone else manages it for me, be it Yubico or Intel or Apple. This is a fundamental difference.
  - StavrosK 7y ago
    You're wrong. You can manage your own keys. You don't need any big corporation for WebAuthn.
    - dane-pgp 7y ago
      Well, that's assuming that the anti-feature of device attestation doesn't end up being used in the inevitable way that the spec allows: "But attestation is not spoofable. Therefore, if sites launch webauthn support and accept attestations from the current set of token vendors, future vendors may be locked out of the market: Their devices won’t work because their attestations aren’t trusted, and they won’t be able to get sites to update because they won’t have enough market presence to matter." https://www.imperialviolet.org/2018/03/27/webauthn.html https://www.imperialviolet.org/2018/03/27/webauthn.html
      - StavrosK 7y ago
        Yes, if a service says "we only support Yubikeys for login", you should boycott them.
        dane-pgp 7y ago
        I hope that principle does establish itself among users of the web, but I suspect that if a bank says "You have to use one of these supported devices to access your account online" people are not going to change their bank because of it. Similarly, if China mandates a government-approved (backdoored?) device when accessing Chinese websites, I don't suppose Chinese citizens are going to boycott those. Other countries might reasonably retaliate by forbidding sites to accept authentication by devices made in China. Do you think that if Apple decreed that you can only securely log in to Apple websites with an iPhone (or some other device made by Apple) people would switch to Android? It's hard enough to get people to boycott Facebook despite repeated scandals that are much worse than having a whitelist of supported authentication devices.