4 ms·

> Almost every phone and laptop today supports it Eh. I'm super excited for WebAuthn, but unless my sources are out of date it's far from being supported ever

> Almost every phone and laptop today supports it Eh. I'm super excited for WebAuthn, but unless my sources are out of date it's far from being supported everywhere (https://webauthn.me/browser-support https://webauthn.me/browser-support). A giant challenge with WebAuthn is the lack of platform authenticator integrations, particularly on Linux. You basically need to buy a separate key. And if you're on Android and you swapped out Chrome for Firefox (which you should do) then even the physical key stops working. I desperately want to start using WebAuthn everywhere and I desperately want to start encouraging devs to swap over to it for most new logins. But I don't think I can. I don't know that I own a single phone or desktop that as configured can use WebAuthn without a security key. If I'm doing something wrong, or if there's some config option that just hasn't gotten flipped by default on platforms like Firefox Linux, then I'd love to know.

psanford 5y ago
I made a FIDO token (a platform authenticator) implementation that uses the TPM to protect your private keys on Linux: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido
- apostacy 5y ago
  That's really cool. Is it possible to use it without a hardware TPM, for testing? I have used rust-u2f in the past for that purpose.
  - psanford 5y ago
    Yup, there's a flag `-backend memory` that generates ephemeral keys in memory.
- lrvick 5y ago
  As I understand this, if malware is on the machine it can do unlimited WebAuthn validations in the background without user interaction. Anchoring to physical human interaction with a button or biometric sensor is a huge security property I don't think current gen TPMs can solve for. In a typical implementation someone must be present at the machine expecting a tap, and tapping. That said, overall this is a clever best effort for when a TPM is all a user has and you at least want to prove a given machine is involved in with.
  - UncleMeat 5y ago
    If malware is on the machine you are basically screwed anyway. A threat model where you happen to never authenticate with a service while you have the malware installed is not especially compelling.
lrvick 5y ago
It is supported in virtually all current gen phones/laptops. Giving up WebAuthn and thus trading security for privacy by dumping Chrome for Firefox is a raw deal. If privacy is a concern run a de-googled ROM like CalyxOS which ships defanged Chromium so you get to have vital security features like WebAuthn without giving up privacy.
- danShumway 5y ago
  > so you get to have vital security features like WebAuthn without giving up privacy. Yes, Chrome phoning home is a concern to me, but a much bigger concern is the lack of mobile extension and adblock support. Defanged Chromium doesn't solve that problem. Even desktop deGoogled Chromium is just an inferior browser when it comes to privacy right now; it has fewer extension APIs than Firefox and it's missing built in Firefox privacy features like containers. But on mobile, giving up the ability to run extensions entirely? I'm not sure I can substantively argue whether giving up adblocking is a bigger security tradeoff than giving up webauthn. But it's definitely a pretty big privacy tradeoff given the current state of the mobile web. I don't know, maybe this is a solved problem. I haven't really looked into CalyxOS. Does it patch mobile Chromium to support extensions? Can I trust the devs to do that securely? ---- Edit: so I did look into this, and it looks like MicroG just doesn't support WebAuthn at all: https://github.com/microg/GmsCore/issues/849 https://github.com/microg/GmsCore/issues/849, https://bugs.chromium.org/p/chromium/issues/detail?id=997538 https://bugs.chromium.org/p/chromium/issues/detail?id=997538 So if anything, that gives me a lot more confidence to claim that this is not widely supported yet and people shouldn't be calling WebAuthn a universal drop-in replacement for other systems. Not to say that WebAuthn is bad, I expect these problems will be solved over time and support will widen. I do think WebAuthn is the obviously correct long-term solution. But I think the "virtually all" language used here is not currently accurate. At best I'm seeing some (very small) repos trying to work around the problem, and I'm not convinced it's good security practice to entrust login tokens to under-audited 3rd-party services."

psanford 5y ago

I made a FIDO token (a platform authenticator) implementation that uses the TPM to protect your private keys on Linux: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido

apostacy 5y ago
That's really cool. Is it possible to use it without a hardware TPM, for testing? I have used rust-u2f in the past for that purpose.
- psanford 5y ago
  Yup, there's a flag `-backend memory` that generates ephemeral keys in memory.
lrvick 5y ago
As I understand this, if malware is on the machine it can do unlimited WebAuthn validations in the background without user interaction. Anchoring to physical human interaction with a button or biometric sensor is a huge security property I don't think current gen TPMs can solve for. In a typical implementation someone must be present at the machine expecting a tap, and tapping. That said, overall this is a clever best effort for when a TPM is all a user has and you at least want to prove a given machine is involved in with.
- UncleMeat 5y ago
  If malware is on the machine you are basically screwed anyway. A threat model where you happen to never authenticate with a service while you have the malware installed is not especially compelling.

lrvick 5y ago

It is supported in virtually all current gen phones/laptops. Giving up WebAuthn and thus trading security for privacy by dumping Chrome for Firefox is a raw deal. If privacy is a concern run a de-googled ROM like CalyxOS which ships defanged Chromium so you get to have vital security features like WebAuthn without giving up privacy.

danShumway 5y ago
> so you get to have vital security features like WebAuthn without giving up privacy. Yes, Chrome phoning home is a concern to me, but a much bigger concern is the lack of mobile extension and adblock support. Defanged Chromium doesn't solve that problem. Even desktop deGoogled Chromium is just an inferior browser when it comes to privacy right now; it has fewer extension APIs than Firefox and it's missing built in Firefox privacy features like containers. But on mobile, giving up the ability to run extensions entirely? I'm not sure I can substantively argue whether giving up adblocking is a bigger security tradeoff than giving up webauthn. But it's definitely a pretty big privacy tradeoff given the current state of the mobile web. I don't know, maybe this is a solved problem. I haven't really looked into CalyxOS. Does it patch mobile Chromium to support extensions? Can I trust the devs to do that securely? ---- Edit: so I did look into this, and it looks like MicroG just doesn't support WebAuthn at all: https://github.com/microg/GmsCore/issues/849 https://github.com/microg/GmsCore/issues/849, https://bugs.chromium.org/p/chromium/issues/detail?id=997538 https://bugs.chromium.org/p/chromium/issues/detail?id=997538 So if anything, that gives me a lot more confidence to claim that this is not widely supported yet and people shouldn't be calling WebAuthn a universal drop-in replacement for other systems. Not to say that WebAuthn is bad, I expect these problems will be solved over time and support will widen. I do think WebAuthn is the obviously correct long-term solution. But I think the "virtually all" language used here is not currently accurate. At best I'm seeing some (very small) repos trying to work around the problem, and I'm not convinced it's good security practice to entrust login tokens to under-audited 3rd-party services."