4 ms·

Not mentioned: passwordless authentication See: https://www.microsoft.com/en-us/security/business/identity/passwordless https://www.microsoft.com/en-us/securi

Not mentioned: passwordless authentication See: https://www.microsoft.com/en-us/security/business/identity/passwordless https://www.microsoft.com/en-us/security/business/identity/p... https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2KEup https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE... In passwordless authentication, the device creates a public and private key when registered. The private key can only be unlocked using fingerprint or PIN. If an attacker knows the PIN he also needs the device. If he has the device he also needs the PIN.

ketamine__ 6y ago
I associate "passwordless" with login via link sent in email. I actually prefer this as long as the email is instant.
- flowerlad 6y ago
  The "passwordless" described by Microsoft is 2-factor (but is just as convenient as 1-factor). Login link sent via email or text message is only 1-factor.
toomuchtodo 6y ago
Isn’t this FIDO2/WebAuthN/CTAP? https://fidoalliance.org/fido2/ https://fidoalliance.org/fido2/ https://www.w3.org/TR/webauthn-2/ https://www.w3.org/TR/webauthn-2/
- tialaramex 6y ago
  Mostly. Microsoft seems to really hate just saying "Do this standard thing" and prefer to say "Do this special Microsoft thing †" with an asterisk explaining somewhere that it's basically the standard thing but with a Microsoft logo and also your Microsoft Certified Partner will charge extra. For example Microsoft used to tell its customers they need a "Unified Communications Certificate" for SSL/TLS. And some companies would advertise specifically that phrase. What's special about UCC? Nothing, it's just an ordinary PKIX compliant certificate using SANs, which is what all the providers are always required to do anyway. But I guess in principle Microsoft felt this way if you bought something else somehow, that's not a "Unified Communications Certificate" so that's why it didn't work. In the case of WebAuthn Microsoft really wanted to do RSA PKCS#1.5 even though that was obviously at best a weird choice and arguably a bad choice. So the standard says you can do RSA PKCS#1.5 and as I understand it a pure Windows system does, but nobody else wanted that, it's slower, it's clumsier, there is no formal security proof that it's even safe. Everybody else does an elliptic curve signature, I think either ECDSA or EdDSA. I've built a toy WebAuthn implementation and I literally have no clue whether it works with Microsoft's clients because I was not able to test that yet because they are different from everything else. It fails closed, so if it doesn't work I guess I locked out all Windows users. But all the widely available popular solutions should work.
  - toomuchtodo 6y ago
    Really appreciate this reply, it can be difficult at times to cut through the marketingspeak.

ketamine__ 6y ago

I associate "passwordless" with login via link sent in email. I actually prefer this as long as the email is instant.

flowerlad 6y ago
The "passwordless" described by Microsoft is 2-factor (but is just as convenient as 1-factor). Login link sent via email or text message is only 1-factor.

toomuchtodo 6y ago

Isn’t this FIDO2/WebAuthN/CTAP? https://fidoalliance.org/fido2/ https://fidoalliance.org/fido2/ https://www.w3.org/TR/webauthn-2/ https://www.w3.org/TR/webauthn-2/

tialaramex 6y ago
Mostly. Microsoft seems to really hate just saying "Do this standard thing" and prefer to say "Do this special Microsoft thing †" with an asterisk explaining somewhere that it's basically the standard thing but with a Microsoft logo and also your Microsoft Certified Partner will charge extra. For example Microsoft used to tell its customers they need a "Unified Communications Certificate" for SSL/TLS. And some companies would advertise specifically that phrase. What's special about UCC? Nothing, it's just an ordinary PKIX compliant certificate using SANs, which is what all the providers are always required to do anyway. But I guess in principle Microsoft felt this way if you bought something else somehow, that's not a "Unified Communications Certificate" so that's why it didn't work. In the case of WebAuthn Microsoft really wanted to do RSA PKCS#1.5 even though that was obviously at best a weird choice and arguably a bad choice. So the standard says you can do RSA PKCS#1.5 and as I understand it a pure Windows system does, but nobody else wanted that, it's slower, it's clumsier, there is no formal security proof that it's even safe. Everybody else does an elliptic curve signature, I think either ECDSA or EdDSA. I've built a toy WebAuthn implementation and I literally have no clue whether it works with Microsoft's clients because I was not able to test that yet because they are different from everything else. It fails closed, so if it doesn't work I guess I locked out all Windows users. But all the widely available popular solutions should work.
- toomuchtodo 6y ago
  Really appreciate this reply, it can be difficult at times to cut through the marketingspeak.