3 ms·
Today, with WebAuthn, recovery works the exact same way. Which is normally by emailing the user a magical link to a (trusted) address that does some recovery fl
by aseipp 5y ago
Today, with WebAuthn, recovery works the exact same way. Which is normally by emailing the user a magical link to a (trusted) address that does some recovery flow. There's nothing different about this, and how much of a weak link it is depends on your risk assessment, I guess. WebAuthn makes other classes of "first-party" attacks like phishing and credential stuffing impossible to perform, however, which is a huge benefit. So on the whole I see it as an improvement, but there could still be a lot improved.
Honestly saying that part out loud, one of the annoying parts of it all now is that the credential store for WebAuthn is now effectively per-application, not per-user. So you need "number-of-browsers * number-of-devices" different registrations, which is basically annoying enough to mean I still use 1Password. In some fancy world, the actual credential store could be some kind of persistent, per-user system service provided to any application, and they would all share these credentials. Sort of like Apple Keychain on steroids, basically, but it needs to work everywhere, on all platforms, and be adopted consistently by applications.
- MarkSweep 5y agoApple has a technical preview in iOS 15 and macOS Monterey that stores the WebAuthn credentials in iCloud. This lets you have passwordless WebAuthn login, without registering each device separately. https://developer.apple.com/videos/play/wwdc2021/10106 https://developer.apple.com/videos/play/wwdc2021/10106 It's only works in the Apple ecosystem currently and is only a technical preview, but it's a cool idea to reduce the number of registrations you have to do and reduce the chance of getting locked out of websites by losing your WebAuthn key.
- dwaite 5y ago> It's only works in the Apple ecosystem currently and is only a technical preview, but it's a cool idea to reduce the number of registrations you have to do and reduce the chance of getting locked out of websites by losing your WebAuthn key. There is work being done to try to create a realistically usable cross-device (e.g. mobile phone as authenticator to my desktop) support leveraging Bluetooth LE. One could hope for a future where say an iPhone with these WebAuthn "PassKeys" (as Apple branded them) could be used to authenticate with a Windows laptop. There are also draft features which would allow a site to detect you are going cross-platform, and offer to add an additional local Windows Hello mechanism to streamline the process in the future.