4 ms·

Why are only very few services supporting WebAuthn? Google and github supprot WebAuthn, but most services only support OATH-TOTP, OATH-HOTP or even worse only

by haukem 5y ago

Why are only very few services supporting WebAuthn? Google and github supprot WebAuthn, but most services only support OATH-TOTP, OATH-HOTP or even worse only their own app.

dheera 5y ago
If something doesn't support Web'n'Auth you can use TOTP with a Yubikey, the TOTP moves with the key, much better than those dumb authenticator possibly-spyware apps.
- chris37879 5y ago
  Since moving my totp keys onto a yubikey, I device hop with wild abandon since I know I can't accidentally bork my 2fa, it's great.
- tyingq 5y ago
  Generating the 6 digit codes from a TOTP seed is < 10 lines of python and requires only core modules. Meaning it's pretty easy to find or make a client you would trust.
- Dylan16807 5y ago
  > much better than those dumb authenticator possibly-spyware apps If the google or microsoft TOTP app is spyware, I have bigger problems. I don't see what's dumb about them either.
  - dheera 5y ago
    They are dumb because - they involve storing secrets on a readable filesystem - are tied to a particular instance of a filesystem, not actually tied to a piece of hardware, which fails the "something you have" part of 2FA - either (a) fail if you reinstall your OS, OR (b) need to transmit secrets to Google and Microsoft to allow you to reinstall the OS, both bad With Yubikey TOTP you cannot read back the secret, the hardware itself doesn't provide an interface to do that.
    - Dylan16807 5y ago
      For a normal user with an app that doesn't allow export, it's more or less equivalent to a yubikey. There's no reasonable way to get the secrets out of a locked phone or a yubikey, but an expert with a lot of resources probably could. And a normal user isn't reinstalling their phone OS so that worry's out of the way. For apps that do allow export/transfer, it's up to the user if they want to keep the secret safe. But really at some point it's up to the user no matter what method or hardware you use. And since most sites don't have an easy way to have multiple tokens, allowing export/transfer also reduces the temptation to insecurely store a copy of enrollment QR codes.
tialaramex 5y ago
Reluctantly I think my conclusion is the majority of services do not care.

by haukem 5y ago

Why are only very few services supporting WebAuthn? Google and github supprot WebAuthn, but most services only support OATH-TOTP, OATH-HOTP or even worse only their own app.

dheera 5y ago

If something doesn't support Web'n'Auth you can use TOTP with a Yubikey, the TOTP moves with the key, much better than those dumb authenticator possibly-spyware apps.

chris37879 5y ago
Since moving my totp keys onto a yubikey, I device hop with wild abandon since I know I can't accidentally bork my 2fa, it's great.
tyingq 5y ago
Generating the 6 digit codes from a TOTP seed is < 10 lines of python and requires only core modules. Meaning it's pretty easy to find or make a client you would trust.
Dylan16807 5y ago
> much better than those dumb authenticator possibly-spyware apps If the google or microsoft TOTP app is spyware, I have bigger problems. I don't see what's dumb about them either.
- dheera 5y ago
  They are dumb because - they involve storing secrets on a readable filesystem - are tied to a particular instance of a filesystem, not actually tied to a piece of hardware, which fails the "something you have" part of 2FA - either (a) fail if you reinstall your OS, OR (b) need to transmit secrets to Google and Microsoft to allow you to reinstall the OS, both bad With Yubikey TOTP you cannot read back the secret, the hardware itself doesn't provide an interface to do that.
  - Dylan16807 5y ago
    For a normal user with an app that doesn't allow export, it's more or less equivalent to a yubikey. There's no reasonable way to get the secrets out of a locked phone or a yubikey, but an expert with a lot of resources probably could. And a normal user isn't reinstalling their phone OS so that worry's out of the way. For apps that do allow export/transfer, it's up to the user if they want to keep the secret safe. But really at some point it's up to the user no matter what method or hardware you use. And since most sites don't have an easy way to have multiple tokens, allowing export/transfer also reduces the temptation to insecurely store a copy of enrollment QR codes.

tialaramex 5y ago

Reluctantly I think my conclusion is the majority of services do not care.