6 ms·

I would rather use FIDO2, which is an open, decentralized standard that's both super secure and convenient. Why is nobody supporting that? That way we don't eve

I would rather use FIDO2, which is an open, decentralized standard that's both super secure and convenient. Why is nobody supporting that? That way we don't even need to remember usernames, let alone passwords.

ziml77 5y ago
I was really hoping that would catch on when I got my first yubikey some years ago. So far it seems that basically no one is using it. Which really sucks because it's so much more secure. Makes it impossible to accidentally send credentials to the wrong site.
- StavrosK 5y ago
  Same :( There are plenty of sites using U2F, but not WebAuthn. I hope that's because it's still relatively new.
  - Hamuko 5y ago
    I've yet to run across one browser / operating system combination where WebAuthn is implemented well. Stuff like assertion interface not showing up if you have two authenticators present. Browser and OS vendors should really fix their shit before any mass WebAuthn adaptation happens.
    - will4274 5y ago
      What don't you like about the Win10 + Edge implementation?
      - Hamuko 5y ago
        If you have a Windows 10 computer with Windows Hello enabled, Windows 10 will ALWAYS assume you want to use a platform authenticator if the website doesn't specify whether to register a platform or a cross-platform authenticator. If you have both Windows Hello enabled and a Yubikey inserted into your computer and you start the registration, Windows 10 will always bring up the Windows Hello dialog, asking you to perform a biometric verification. In my case, this will be a fingerprint reading. Your Yubikey won't be in any way active and the option to use your Yubikey won't be visible even if you click "More choices". What you actually need to do is to press the "Cancel" button on the Windows Hello dialog. If you press Cancel, only then are you prompted to register a security key. And if the registration was started accidentally, you need to press "Cancel" both on the Windows Hello dialog and on the security key dialog. It's just downright stupid UX. You basically need to teach the users to "start the registration and then immediately cancel it" if they want to use a Yubikey on a Windows Hello machine. If the website doesn't specify "platform" or "cross-platform" preference during registration and the user is using Chrome on macOS with Touch ID, Chrome will just ask if you want to use Touch ID or use a security key. If the website specifies a preference for cross-platform authenticators, or there's no Windows Hello set up on the machine, then Windows will actually show the security key registration dialog without any need to click "Cancel". There's also the issue that WebAuthn resident keys can only be managed through the clunky command-line interface. At least I haven't found a way to manage resident keys in another manner. But the clunky command-line interface is actually among the best management options - other browsers provide no management for resident keys. I've actually considered writing a blog post griping about how stupid the experience with WebAuthn is. Chrome, Firefox, Safari, Edge, Windows, macOS, iOS. I don't think there's been any combination there where something hasn't annoyed me.
        will4274 5y ago
        The cancel issue you described is no longer present in the current version of win10. The unfortunate fact is nobody except us geeks uses Yubikeys. 99% of users prefer platform keys. So it's not hard to understand why software defaults to it.
        Hamuko 5y ago
        What's the current version of Windows 10? Because I'm getting it on 20H2.
  - ArchOversight 5y ago
    With Safari now having it built-in so you can do FaceID/TouchID I have a feeling it is about to become more common for websites.
wstrange 5y ago
IIRC, the Google/Android 2FV implements FIDO2
- StavrosK 5y ago
  Isn't it U2F?
  - ArchOversight 5y ago
    No, it's WebAuthN these days (FIDO 2) which can transparently use U2F tokens.
bawolff 5y ago
ironically, google is probably one of the companies pushing that the most.
will4274 5y ago
Apple, Google, and Microsoft all support FIDO in their OSes and browsers.

ziml77 5y ago

I was really hoping that would catch on when I got my first yubikey some years ago. So far it seems that basically no one is using it. Which really sucks because it's so much more secure. Makes it impossible to accidentally send credentials to the wrong site.

StavrosK 5y ago
Same :( There are plenty of sites using U2F, but not WebAuthn. I hope that's because it's still relatively new.
- Hamuko 5y ago
  I've yet to run across one browser / operating system combination where WebAuthn is implemented well. Stuff like assertion interface not showing up if you have two authenticators present. Browser and OS vendors should really fix their shit before any mass WebAuthn adaptation happens.
  - will4274 5y ago
    What don't you like about the Win10 + Edge implementation?
    - Hamuko 5y ago
      If you have a Windows 10 computer with Windows Hello enabled, Windows 10 will ALWAYS assume you want to use a platform authenticator if the website doesn't specify whether to register a platform or a cross-platform authenticator. If you have both Windows Hello enabled and a Yubikey inserted into your computer and you start the registration, Windows 10 will always bring up the Windows Hello dialog, asking you to perform a biometric verification. In my case, this will be a fingerprint reading. Your Yubikey won't be in any way active and the option to use your Yubikey won't be visible even if you click "More choices". What you actually need to do is to press the "Cancel" button on the Windows Hello dialog. If you press Cancel, only then are you prompted to register a security key. And if the registration was started accidentally, you need to press "Cancel" both on the Windows Hello dialog and on the security key dialog. It's just downright stupid UX. You basically need to teach the users to "start the registration and then immediately cancel it" if they want to use a Yubikey on a Windows Hello machine. If the website doesn't specify "platform" or "cross-platform" preference during registration and the user is using Chrome on macOS with Touch ID, Chrome will just ask if you want to use Touch ID or use a security key. If the website specifies a preference for cross-platform authenticators, or there's no Windows Hello set up on the machine, then Windows will actually show the security key registration dialog without any need to click "Cancel". There's also the issue that WebAuthn resident keys can only be managed through the clunky command-line interface. At least I haven't found a way to manage resident keys in another manner. But the clunky command-line interface is actually among the best management options - other browsers provide no management for resident keys. I've actually considered writing a blog post griping about how stupid the experience with WebAuthn is. Chrome, Firefox, Safari, Edge, Windows, macOS, iOS. I don't think there's been any combination there where something hasn't annoyed me.
      - will4274 5y ago
        The cancel issue you described is no longer present in the current version of win10. The unfortunate fact is nobody except us geeks uses Yubikeys. 99% of users prefer platform keys. So it's not hard to understand why software defaults to it.
        Hamuko 5y ago
        What's the current version of Windows 10? Because I'm getting it on 20H2.
- ArchOversight 5y ago
  With Safari now having it built-in so you can do FaceID/TouchID I have a feeling it is about to become more common for websites.

wstrange 5y ago

IIRC, the Google/Android 2FV implements FIDO2

StavrosK 5y ago
Isn't it U2F?
- ArchOversight 5y ago
  No, it's WebAuthN these days (FIDO 2) which can transparently use U2F tokens.

bawolff 5y ago

ironically, google is probably one of the companies pushing that the most.

will4274 5y ago

Apple, Google, and Microsoft all support FIDO in their OSes and browsers.