4 ms·
We're finally seeing challenge-response in the form of WebAuthn, though I'm not sure why it's taken so long to get to where we are now. It's not like challenge-
by ziml77 6y ago
We're finally seeing challenge-response in the form of WebAuthn, though I'm not sure why it's taken so long to get to where we are now. It's not like challenge-response is a new concept. And you don't need a hardware security key to handle challenge-response. If you don't have that as an option, you could use the password to directly generate the response. Of course the browser has to support this, otherwise you'd be relying on the page's JS which doesn't help with the attacker controlled server scenario.
- tialaramex 6y agoWebAuthn is a lot more than just challenge response though. I think other schemes that did a lot less had plenty of time to displace passwords if they were going to. And they didn't. So, implement WebAuthn and have done with it.
- ziml77 6y agoAgreed. My point here is that there was no reason that we couldn't have had something better than passwords in the time between first using passwords on the web and now.