3 ms·
Same :( There are plenty of sites using U2F, but not WebAuthn. I hope that's because it's still relatively new.
by StavrosK 5y ago
Same :( There are plenty of sites using U2F, but not WebAuthn. I hope that's because it's still relatively new.
- Hamuko 5y agoI've yet to run across one browser / operating system combination where WebAuthn is implemented well. Stuff like assertion interface not showing up if you have two authenticators present. Browser and OS vendors should really fix their shit before any mass WebAuthn adaptation happens.
- will4274 5y agoWhat don't you like about the Win10 + Edge implementation?
- Hamuko 5y agoIf you have a Windows 10 computer with Windows Hello enabled, Windows 10 will ALWAYS assume you want to use a platform authenticator if the website doesn't specify whether to register a platform or a cross-platform authenticator. If you have both Windows Hello enabled and a Yubikey inserted into your computer and you start the registration, Windows 10 will always bring up the Windows Hello dialog, asking you to perform a biometric verification. In my case, this will be a fingerprint reading. Your Yubikey won't be in any way active and the option to use your Yubikey won't be visible even if you click "More choices". What you actually need to do is to press the "Cancel" button on the Windows Hello dialog. If you press Cancel, only then are you prompted to register a security key. And if the registration was started accidentally, you need to press "Cancel" both on the Windows Hello dialog and on the security key dialog. It's just downright stupid UX. You basically need to teach the users to "start the registration and then immediately cancel it" if they want to use a Yubikey on a Windows Hello machine. If the website doesn't specify "platform" or "cross-platform" preference during registration and the user is using Chrome on macOS with Touch ID, Chrome will just ask if you want to use Touch ID or use a security key. If the website specifies a preference for cross-platform authenticators, or there's no Windows Hello set up on the machine, then Windows will actually show the security key registration dialog without any need to click "Cancel". There's also the issue that WebAuthn resident keys can only be managed through the clunky command-line interface. At least I haven't found a way to manage resident keys in another manner. But the clunky command-line interface is actually among the best management options - other browsers provide no management for resident keys. I've actually considered writing a blog post griping about how stupid the experience with WebAuthn is. Chrome, Firefox, Safari, Edge, Windows, macOS, iOS. I don't think there's been any combination there where something hasn't annoyed me.
- will4274 5y agoThe cancel issue you described is no longer present in the current version of win10. The unfortunate fact is nobody except us geeks uses Yubikeys. 99% of users prefer platform keys. So it's not hard to understand why software defaults to it.
- Hamuko 5y agoWhat's the current version of Windows 10? Because I'm getting it on 20H2.
- ArchOversight 5y agoWith Safari now having it built-in so you can do FaceID/TouchID I have a feeling it is about to become more common for websites.