3 ms·
How does this work if you need to sign in to a site on a borrowed computer while traveling or something? Is the private key derivable from a master password or
by cactus2093 6y ago
How does this work if you need to sign in to a site on a borrowed computer while traveling or something? Is the private key derivable from a master password or something?
- namanaggarwal 6y agoIt's mentioned in the video as well that website should always use this as faster sign in option with providing other options alongside.
- sirn 6y agoSimilar to how you would sign in on devices/browsers without WebAuthn support or don't have physical token (Yubikey/etc.) with you: use a fallback method provided by a website. This is usually TOTP or a scratch code. The website need to implement it though. One thing to keep in mind is this is not supposed to be the only factor required to sign in. It should be used as a 2nd factor in the similar way to TOTP (but with much better usability).
- Skunkleton 6y agoWith Okta (since gp mentioned it), you would sign in with a password, then click the "yes its me" button on your phone, or you could use TOTP, or even a yubikey.
- sirn 6y agoOkta is more of a SAML/OpenID Connect thing with built-in multi factor authentication than a replacement for WebAuthn, though. Okta could embrace WebAuthn Platform Authenticator as one of their authenticating factor if user is unwilling to install an app, but a website isn't expected to use Okta as a second factor in their authentication flow.
- jackson1442 6y agoOP is referring to how you already can sign in to Okta as a website, not as an authentication mechanism. You can create a sign in flow that goes like so: username -> password -> [ WebAuthn | Okta Verify Push ] This approach can be used on any website, just with a regular TOTP code in place of the proprietary Okta Verify Push.
- sirn 6y agoAh I didn't know you could do the Okta push without using their whole SSO suite. Thank you! I guess in this scenario Okta acts more like Authy proprietary OTP thing then.
- dwaite 6y agoWeb Authentication does support being the only authentication mechanism, since it is in itself multi factor (in this case, physical possession of the phone and biometric confirmation)
- jacobr1 6y agoA few options if you want to maintain MFA: For my Okta account, they support push notification to their app on my phone as an alternative authentication measure. Another approach is a bluetooth (or NFC) enabled device (like your phone) that actually caries the private key. When using a borrowed computer, the signed attestation data is shared with the borrowed system, but that can only be used once, since the private key is never transmitted. So basically you can either have a side-channel to another MFA method, or a relay where you don't need to trust the intermediary beyond the current session.
- tomp 6y agoApple already kind-of supports this for iClout login. If you want to authenticate on a new device, you’ll get a prompt on one of your already authenticated devices to confirm the login. You still need the password, but it’s really not necessary... if there was also some additional “privilege” system (i.e. that the same user account would have less privileges if logged in through a less secure method) it would be even safer.
- GekkePrutser 6y agoI'm surprised nobody has mentioned this but you can also use a hardware FIDO2 token for Webauthn. Like a Yubikey. This is ideal if you use many computers. If you need to sign in on a borrowed computer you visit the site, it'll ask you to insert the yubikey (if not already), you enter the PIN code and touch it, that's it. I believe a yubikey with fingerprint instead of PIN (or additionally? Information is scarce on it) is also coming.