5 ms·

This guide focuses on what WebAuthn looks like for the server. What does it look like for the user? As far as I can imagine, it boils down to relying on the po

This guide focuses on what WebAuthn looks like for the server. What does it look like for the user? As far as I can imagine, it boils down to relying on the possession of a certain piece of hardware instead of knowing a certain password. That is, I have to carry around some kind of USB device and plug it into every computer I want to use. The device holds all my secret keys and does all the magic behind the scenes. But if I lose my device, then I can't log in. And if someone steals my device, then they can log in. Maybe you can make it more convenient by using my phone instead of a specialized USB device, since everybody is always carrying around their phone everywhere they go anyway, right? But I just want to know that I understand the entire landscape first, from the point of view of the user, at a broad level. What are the user's options? What exactly does the user do? Is this only for smart users? If I made a web app for the general public, and my only method of authentication was WebAuthn, would the average user easily figure out what to do, or would they give up and walk away? Some have mentioned "software-based" tokens, but then how are those kept safe? With a master password? Then we're back to passwords.

haecceity 7y ago
There's usually a pin or a fingerprint reader on the usb device so that it's not usable except by the owner.
tmikaeld 7y ago
You can use psychical, TPM or biometric authentication, like fingerprint. The specs require one to be able to reset a login if device is lost, like with email and code or SMS.
nickray 7y ago
In FIDO-speak, "platform" authenticators are your laptop or phone, using their contained secure storage, vs "roaming" authnrs like our SoloKeys. Most people assume that the former will be the main way to use WebAuthn. Consumers using keys are mostly enthusiasts/early adopters/special needs. Mainly in a corporate setting, a separate hardware key may provide a root of trust (and audit trail if the key is modified to be trackable) , with which you can then unlock your devices in a self-service manner. You're right that software authnrs are a bad idea. For services that don't want the security to be pierced by such unsafe fallbacks, initial key attestation can whitelist the acceptable authenticators. One thing that is too infrequently highlighted is that FIDO2 is decentral authentication between you and the services, unlike "login with big-corp".
tialaramex 7y ago
The most common use case today is 2FA, where WebAuthn is the standard way to do something U2F defined only for 2FA. In this scenario where it's only a second factor, yes, it relies on you possessing a Security Key, and on the bad guys not possessing it. This matches the threat model, which is typically that bad guys are not your flatmate or your mother they live in another country and will never meet you. WebAuthn (and U2F) were specifically designed to register multiple tokens, the server-side stuff described explains how a site insists "Look I need to register a new token, not these tokens which I already registered" while also being open to whichever token you have on login, "Any of these tokens can log in, I don't mind which". So I have a token in my pocket, but if I got mugged I have a backup token at home that can substitute. Well designed sites let you nickname them during registration so you can go "I lost green hulk token but I still have Yubikey" later. Yes, if you use the flows where both factors are handled by the FIDO token then you're "back to passwords" but with a very important difference. Very, very important: Right now your password for news.ycombinator.com is known by the Y Combinator servers. Now, I'm sure they take good care of it, using a modern salted and pessimised hash for the purpose, but this creates many extra opportunities for vulnerabilities and a bad guy only needs to find a crack in one place. Whereas if I have a PIN for my FIDO token the PIN lives on the FIDO token. Not on every web site I use WebAuthn with, not in a database that some poor new sysadmin accidentally uploads to the Cloud, it's not sent over the wire to some Java backend sevice that might accidentally log it, or whatever. The device can insist upon rate-limiting attempts because it's a piece of hardware, like an iPhone.
- combatentropy 7y ago
  > This matches the threat model, which is typically that bad guys are not your flatmate or your mother they live in another country and will never meet you. Yes, that's a good point. No security is foolproof. But this is an easy way to curb 99% > "back to passwords" but with a very important difference Also a great point. It may not totally get rid of passwords, but it does stop leaks.
- ryukafalz 7y ago
  Unfortunately for the user experience, those tokens typically can’t be cloned even upon initial setup. The practical result of this is that if you intend to keep a second token as a backup, you need to remember to register the backup token individually for each service you use your primary one for. This is unlikely if you keep the backup at home, and it’s downright impractical if you kept it in e.g. a safe deposit box. I love FIDO tokens, but I’m not confident in my ability to keep myself from getting locked out of a service I use infrequently, and I’m a fairly technical user.
cbsmith 7y ago
You can make it more convenient by having a specialized USB or NFC device. The NFC handshake is really simple (tap your phone with it). Arguably more convenient than any kind of secure software-based tokens.
toastal 7y ago
Phones are one of the most likely things to break given their usage. So then you'd be locked out of the account. Requiring a smart phone or a phone number to authenticate but a high bar in certain regions of the world as well as against privacy-conscious people. Here's a anecdote about phone and required 2FA: I was in Laos needing to pay rent when my phone broke. I was locked out of TransferWise to get my paycheck because their 2FA is behind their proprietary app so I couldn't authenticate on my laptop. Luckily I had just enough cash in my bank account. Too bad the bank only had 2 2FA options; 1) behind their proprietary app which doesn't allow rooted devices (despite root for more privacy tools on Android) or 2) SMS in which I was in another country so I didn't have access to my home SIM. Because I needed a new phone to fix this issue, I went to buy a new one online. I couldn't pay for it because I needed a working phone to confirm a payment with my bank. All of this could be solved by allowing TOTP (which doesn't require a phone) or FIDO2 (which I have a key).

haecceity 7y ago

There's usually a pin or a fingerprint reader on the usb device so that it's not usable except by the owner.

tmikaeld 7y ago

You can use psychical, TPM or biometric authentication, like fingerprint. The specs require one to be able to reset a login if device is lost, like with email and code or SMS.

nickray 7y ago

In FIDO-speak, "platform" authenticators are your laptop or phone, using their contained secure storage, vs "roaming" authnrs like our SoloKeys. Most people assume that the former will be the main way to use WebAuthn. Consumers using keys are mostly enthusiasts/early adopters/special needs. Mainly in a corporate setting, a separate hardware key may provide a root of trust (and audit trail if the key is modified to be trackable) , with which you can then unlock your devices in a self-service manner. You're right that software authnrs are a bad idea. For services that don't want the security to be pierced by such unsafe fallbacks, initial key attestation can whitelist the acceptable authenticators. One thing that is too infrequently highlighted is that FIDO2 is decentral authentication between you and the services, unlike "login with big-corp".

tialaramex 7y ago

The most common use case today is 2FA, where WebAuthn is the standard way to do something U2F defined only for 2FA. In this scenario where it's only a second factor, yes, it relies on you possessing a Security Key, and on the bad guys not possessing it. This matches the threat model, which is typically that bad guys are not your flatmate or your mother they live in another country and will never meet you. WebAuthn (and U2F) were specifically designed to register multiple tokens, the server-side stuff described explains how a site insists "Look I need to register a new token, not these tokens which I already registered" while also being open to whichever token you have on login, "Any of these tokens can log in, I don't mind which". So I have a token in my pocket, but if I got mugged I have a backup token at home that can substitute. Well designed sites let you nickname them during registration so you can go "I lost green hulk token but I still have Yubikey" later. Yes, if you use the flows where both factors are handled by the FIDO token then you're "back to passwords" but with a very important difference. Very, very important: Right now your password for news.ycombinator.com is known by the Y Combinator servers. Now, I'm sure they take good care of it, using a modern salted and pessimised hash for the purpose, but this creates many extra opportunities for vulnerabilities and a bad guy only needs to find a crack in one place. Whereas if I have a PIN for my FIDO token the PIN lives on the FIDO token. Not on every web site I use WebAuthn with, not in a database that some poor new sysadmin accidentally uploads to the Cloud, it's not sent over the wire to some Java backend sevice that might accidentally log it, or whatever. The device can insist upon rate-limiting attempts because it's a piece of hardware, like an iPhone.

combatentropy 7y ago
> This matches the threat model, which is typically that bad guys are not your flatmate or your mother they live in another country and will never meet you. Yes, that's a good point. No security is foolproof. But this is an easy way to curb 99% > "back to passwords" but with a very important difference Also a great point. It may not totally get rid of passwords, but it does stop leaks.
ryukafalz 7y ago
Unfortunately for the user experience, those tokens typically can’t be cloned even upon initial setup. The practical result of this is that if you intend to keep a second token as a backup, you need to remember to register the backup token individually for each service you use your primary one for. This is unlikely if you keep the backup at home, and it’s downright impractical if you kept it in e.g. a safe deposit box. I love FIDO tokens, but I’m not confident in my ability to keep myself from getting locked out of a service I use infrequently, and I’m a fairly technical user.

cbsmith 7y ago

You can make it more convenient by having a specialized USB or NFC device. The NFC handshake is really simple (tap your phone with it). Arguably more convenient than any kind of secure software-based tokens.

toastal 7y ago

Phones are one of the most likely things to break given their usage. So then you'd be locked out of the account. Requiring a smart phone or a phone number to authenticate but a high bar in certain regions of the world as well as against privacy-conscious people. Here's a anecdote about phone and required 2FA: I was in Laos needing to pay rent when my phone broke. I was locked out of TransferWise to get my paycheck because their 2FA is behind their proprietary app so I couldn't authenticate on my laptop. Luckily I had just enough cash in my bank account. Too bad the bank only had 2 2FA options; 1) behind their proprietary app which doesn't allow rooted devices (despite root for more privacy tools on Android) or 2) SMS in which I was in another country so I didn't have access to my home SIM. Because I needed a new phone to fix this issue, I went to buy a new one online. I couldn't pay for it because I needed a working phone to confirm a payment with my bank. All of this could be solved by allowing TOTP (which doesn't require a phone) or FIDO2 (which I have a key).