3 ms·
> the website has a chance of seeing it everytime one signs in Indeed. I don't understand why challenge-response auth isn't more widely deployed, or even part
by kaoD 6y ago
> the website has a chance of seeing it everytime one signs in
Indeed. I don't understand why challenge-response auth isn't more widely deployed, or even part of the web APIs.
Sure, it doesn't mitigate ALL attacks, but it does mitigate SOME attacks even if you're already on TLS.
- ziml77 6y agoWe're finally seeing challenge-response in the form of WebAuthn, though I'm not sure why it's taken so long to get to where we are now. It's not like challenge-response is a new concept. And you don't need a hardware security key to handle challenge-response. If you don't have that as an option, you could use the password to directly generate the response. Of course the browser has to support this, otherwise you'd be relying on the page's JS which doesn't help with the attacker controlled server scenario.
- tialaramex 6y agoWebAuthn is a lot more than just challenge response though. I think other schemes that did a lot less had plenty of time to displace passwords if they were going to. And they didn't. So, implement WebAuthn and have done with it.
- ziml77 6y agoAgreed. My point here is that there was no reason that we couldn't have had something better than passwords in the time between first using passwords on the web and now.