4 ms·

If possible can you point out resident keys in the spec? This is confusing. > For each account on a given site, you'll have an independent RK. Is this only fo

by hpfr 6y ago

If possible can you point out resident keys in the spec? This is confusing. > For each account on a given site, you'll have an independent RK. Is this only for usernameless sites? Sites with usernames can just use normal keys, right? > (But the only sites where you can use RKs are basically Microsoft or demos.) How do sites request to use RK’s? Why would Microsoft request RK’s when they can use the associated email address as a unique username? Also, I can’t find anything about hardware security keys on my Microsoft account page, much less usernameless authentication. If there’s multiple usernameless accounts per site how does the user select which RK to use? This seems impossible. If it is in fact impossible, then only one RK per authenticator would be necessary and only one usernameless account per site per authenticator could be used.

tialaramex 6y ago
> can you point out resident keys in the spec The WebAuthn specification calls this a "Client-side-resident Public Key Credential Source" or "Resident Credential" for short. > Is this only for usernameless sites? It facilitates the "usernameless" flow yes, since the Resident Credential includes everything needed for the authenticator to claim you are some particular user and prove it. But it will still work for other flows. > How do sites request to use RK’s? Set the residentKey parameter to "required" during enrollment. Enrolling an authenticator that can't do Resident Credentials should fail in this case. Sites which want a second factor only should pick "discouraged" which allows the authenticator to remember all the credentials if it wants to (e.g. an iPhone has gigabytes of secure Flash storage so why not) but discourages doing so. > If there’s multiple usernameless accounts per site how does the user select which RK to use? Potentially the authenticator has its own UI. But the CTAP2 protocol allows the host to build a UI by asking for all the valid credentials for some particular relying party (ie web site). It goes something like this: * Host PC-> Security Key "Do you know credentials for ycombinator.com ? We're doing the usernameless thing, so I have no hints just asking" * Security Key "Yes, here is proof I'm user 48B4C9CDA2 aka hpfr, also, I can prove 6 identities on ycombinator.com including that one" * Host PC "OK, what's the next identity?" * Security Key "Here is proof I'm user A29EE0F103 aka tialaramex" (and so on, iterating through the identities quickly)
- hpfr 6y ago
  Hmm, usernameless with resident keys doesn’t seem all that great to me then. Thanks for the info!

by hpfr 6y ago

tialaramex 6y ago

> can you point out resident keys in the spec The WebAuthn specification calls this a "Client-side-resident Public Key Credential Source" or "Resident Credential" for short. > Is this only for usernameless sites? It facilitates the "usernameless" flow yes, since the Resident Credential includes everything needed for the authenticator to claim you are some particular user and prove it. But it will still work for other flows. > How do sites request to use RK’s? Set the residentKey parameter to "required" during enrollment. Enrolling an authenticator that can't do Resident Credentials should fail in this case. Sites which want a second factor only should pick "discouraged" which allows the authenticator to remember all the credentials if it wants to (e.g. an iPhone has gigabytes of secure Flash storage so why not) but discourages doing so. > If there’s multiple usernameless accounts per site how does the user select which RK to use? Potentially the authenticator has its own UI. But the CTAP2 protocol allows the host to build a UI by asking for all the valid credentials for some particular relying party (ie web site). It goes something like this: * Host PC-> Security Key "Do you know credentials for ycombinator.com ? We're doing the usernameless thing, so I have no hints just asking" * Security Key "Yes, here is proof I'm user 48B4C9CDA2 aka hpfr, also, I can prove 6 identities on ycombinator.com including that one" * Host PC "OK, what's the next identity?" * Security Key "Here is proof I'm user A29EE0F103 aka tialaramex" (and so on, iterating through the identities quickly)

hpfr 6y ago
Hmm, usernameless with resident keys doesn’t seem all that great to me then. Thanks for the info!