3 ms·

I love WebAuthn for 2FA, but I feel like it will struggle to go from 2FA system to primary login (as full replacement for passwords). Indeed, exporting key inf

I love WebAuthn for 2FA, but I feel like it will struggle to go from 2FA system to primary login (as full replacement for passwords). Indeed, exporting key information between browsers or devices are out of scope, causing browser makers to recommend never making WebAuthn log-in the only log-in mechanism, and allow passwords as fallback[0] (not really a replacement for passwords then). Additionally, it is more complex for website operators to set up. I know it can be done, though, and with an amazing UX as simple as clicking “login” on the chrome, and a simpler implementation for website owners. I tried my hand at a protocol that does that[1]. I would love to see browsers do something with that UX. But ultimately, browsers hold the cards; whatever ships wins. I believe that whatever path we have, this UX will eventually be the one users experience; I’d just like to have it happen within five rather than ten years. [0]: https://developer.apple.com/videos/play/wwdc2020/10670/ https://developer.apple.com/videos/play/wwdc2020/10670/ [1]: https://espadrine.github.io/blog/posts/webidentity.html https://espadrine.github.io/blog/posts/webidentity.html

c0wb0yc0d3r 6y ago
I like your idea of webidentity. Is it only theoretical, or is there any sample code? I have been thinking about the particular issue migrating identity too. My thoughts are mostly around additional keys. Realistically, you have more than one device. You could associate (some or all of) them with an account. This, to me, feels like it's more inline with key based auth. My other thought was something like the list of codes you have with other 2FA solutions. I don't think we will ever eliminate passwords in the sense that a person will never need a password ever again, but I think the solutions above definitely get us to the point where we literally never need to share a password.
- espadrine 6y ago
  > Is it only theoretical, or is there any sample code? Ah, not exactly. I saw it a something that could become a draft standard. That said, the test vectors do come from a program that implements it by hand[0]. I assume we could write one that would implement it for the command line (say, for cURL), but the design is really meant to be implemented by browsers. > You could associate (some or all of) them with an account Yes. In this instance, the account is the browser’s Sync system, which synchronizes between devices. > I don't think we will ever eliminate passwords in the sense that a person will never need a password ever again My belief is: we should only ask each individual to only remember a single password throughout their life, so that it can be strong enough to outlast them[1]. [0]: https://github.com/espadrine/espadrine.github.com/blob/master/blog/assets/webidentity/test-vectors.sh https://github.com/espadrine/espadrine.github.com/blob/maste... [1]: https://espadrine.github.io/blog/posts/memorable-passwords.html https://espadrine.github.io/blog/posts/memorable-passwords.h...
md_ 6y ago
I have mixed feelings about key export. :) That is indeed a fair criticism. FWIW, in terms of difficulty setting up, I suspect most developers use libraries from people like Okta and Firebase, so the underlying implementation may not be the big differentiator. There are certainly great examples of non-standards-based approaches beating out the cumbersome/designed-by-committee standard, but they're more common in cases where there are no significant compatibility challenges standing in the way of adoption. For example, any given developer can adopt JSON internally instead of XML, and at some point it reaches critical mass and everyone is using it, including for interchange. In comparison, SQRL isn't useful until it's widely adopted, and because it's not a standard approach with built-in support on any major platform, nobody is going to use it.
- espadrine 6y ago
  Yes! Identity is at this weird place where the goal of the solution (to have the same thing work everywhere instead of the status quo) cannot gain adoption organically, you need browser buy-in first. Which nowadays basically mean to convince Adam Langley.

c0wb0yc0d3r 6y ago

I like your idea of webidentity. Is it only theoretical, or is there any sample code? I have been thinking about the particular issue migrating identity too. My thoughts are mostly around additional keys. Realistically, you have more than one device. You could associate (some or all of) them with an account. This, to me, feels like it's more inline with key based auth. My other thought was something like the list of codes you have with other 2FA solutions. I don't think we will ever eliminate passwords in the sense that a person will never need a password ever again, but I think the solutions above definitely get us to the point where we literally never need to share a password.

espadrine 6y ago
> Is it only theoretical, or is there any sample code? Ah, not exactly. I saw it a something that could become a draft standard. That said, the test vectors do come from a program that implements it by hand[0]. I assume we could write one that would implement it for the command line (say, for cURL), but the design is really meant to be implemented by browsers. > You could associate (some or all of) them with an account Yes. In this instance, the account is the browser’s Sync system, which synchronizes between devices. > I don't think we will ever eliminate passwords in the sense that a person will never need a password ever again My belief is: we should only ask each individual to only remember a single password throughout their life, so that it can be strong enough to outlast them[1]. [0]: https://github.com/espadrine/espadrine.github.com/blob/master/blog/assets/webidentity/test-vectors.sh https://github.com/espadrine/espadrine.github.com/blob/maste... [1]: https://espadrine.github.io/blog/posts/memorable-passwords.html https://espadrine.github.io/blog/posts/memorable-passwords.h...

md_ 6y ago

I have mixed feelings about key export. :) That is indeed a fair criticism. FWIW, in terms of difficulty setting up, I suspect most developers use libraries from people like Okta and Firebase, so the underlying implementation may not be the big differentiator. There are certainly great examples of non-standards-based approaches beating out the cumbersome/designed-by-committee standard, but they're more common in cases where there are no significant compatibility challenges standing in the way of adoption. For example, any given developer can adopt JSON internally instead of XML, and at some point it reaches critical mass and everyone is using it, including for interchange. In comparison, SQRL isn't useful until it's widely adopted, and because it's not a standard approach with built-in support on any major platform, nobody is going to use it.

espadrine 6y ago
Yes! Identity is at this weird place where the goal of the solution (to have the same thing work everywhere instead of the status quo) cannot gain adoption organically, you need browser buy-in first. Which nowadays basically mean to convince Adam Langley.