4 ms·

I'm assuming you're someone that uses some sort of hardware tokens--if not, ignore this. How do you manage your tokens with WebAuthn? I have several but I've n

I'm assuming you're someone that uses some sort of hardware tokens--if not, ignore this. How do you manage your tokens with WebAuthn? I have several but I've never really used them as much besides a repository for TOTP tokens because I just can't wrap my head around it. So I've got one I leave in my device, another I leave laying around the house as a "backup", and another I'm supposed to keep secure off-site somewhere. I register a new account. What's the process? Register on the one I've got in my device because of course. Then go dig out my backup token and add that to the account. Then... ? Pull out a journal and write down the account I've created, swing by the bank once a week/month/quarter to swap my on-site backup for the off-site, go back through my journal and find every account I've created during that time period and enroll the new backup token? What happens if my house burns down during the week/month/quarter I've registered a new account? Is that account just gone? This is easily mitigated with TOTP--just put the TOTP secret into a separate keepass file. As soon as I've registered it's backed up off-site. I'm very risk averse in this area, so I just can't see a path to using webauthn that makes any sense.

tialaramex 5y ago
> What happens if my house burns down during the week/month/quarter I've registered a new account? Is that account just gone? Well no, the account is still there but you can't access it. I'd be pretty happy with the outcome where a major disaster's most annoying effect is "I lost my HN karma" or "I have to make a new GitHub account, although all my existing code is still available to download". Maybe your house burns down a lot, but most people go decades without that happening, so, it's OK if it sucks pretty badly when it happens. I'm not comfortable losing everything. But most of the entities who have a relationship I need to stay alive after a major disaster are already used to this in other cases. I am not going to be the first account holder at my good bank whose worldly possessions were all destroyed in a house fire. It may take a few days, and a lot of inconvenience, but hey, my house burned down so I think the inconvenience isn't the worst part of the scenario. Even Google promises (vaguely) to make it possible for you to recover access to your account with them, despite using WebAuthn, in the event of such disasters. The government is another example. Ordinarily they'd prefer I used WebAuthn (actually they seem unduly keen on SMS, but I use WebAuthn) but if my house burned down they can see their way to consulting their database of e.g. photographs of me, records of where I live (oh, the place that burned down well that makes sense) and so on instead to confirm my identity manually. Edited to add: You know what, people vary. Maybe you can never be comfortable without setting up TOTP "just in case". Fine. But what I suggest to you is: Don't actually use it. The phishing protection of WebAuthn is effective even if you have TOTP setup so long as you don't let the phishers persuade you to use TOTP. Keep TOTP for when your house has burned down, and all the rest of the time you have that protection. You do lose some other WebAuthn benefits (e.g. bad guys can steal all the other credentials, passwords, TOTP secrets, SMS codes, from e.g. a server break-in, but it doesn't mean anything to steal your WebAuthn credentials because the relying party doesn't have any secret credentials, that's the whole point of the design) but phishing is the #1 win
encryptluks2 5y ago
This is my opinion as well. TOTP info can be encrypted, many programs offer phishing protection for TOTP tokens. I just don't see the value of hardware tokens where the hardware token can be compromised, and the credentials to access them can be as well.
- tialaramex 5y ago
  > I just don't see the value of hardware tokens where the hardware token can be compromised, and the credentials to access them can be as well. What sort of compromises are you envisioning here?

tialaramex 5y ago

> What happens if my house burns down during the week/month/quarter I've registered a new account? Is that account just gone? Well no, the account is still there but you can't access it. I'd be pretty happy with the outcome where a major disaster's most annoying effect is "I lost my HN karma" or "I have to make a new GitHub account, although all my existing code is still available to download". Maybe your house burns down a lot, but most people go decades without that happening, so, it's OK if it sucks pretty badly when it happens. I'm not comfortable losing everything. But most of the entities who have a relationship I need to stay alive after a major disaster are already used to this in other cases. I am not going to be the first account holder at my good bank whose worldly possessions were all destroyed in a house fire. It may take a few days, and a lot of inconvenience, but hey, my house burned down so I think the inconvenience isn't the worst part of the scenario. Even Google promises (vaguely) to make it possible for you to recover access to your account with them, despite using WebAuthn, in the event of such disasters. The government is another example. Ordinarily they'd prefer I used WebAuthn (actually they seem unduly keen on SMS, but I use WebAuthn) but if my house burned down they can see their way to consulting their database of e.g. photographs of me, records of where I live (oh, the place that burned down well that makes sense) and so on instead to confirm my identity manually. Edited to add: You know what, people vary. Maybe you can never be comfortable without setting up TOTP "just in case". Fine. But what I suggest to you is: Don't actually use it. The phishing protection of WebAuthn is effective even if you have TOTP setup so long as you don't let the phishers persuade you to use TOTP. Keep TOTP for when your house has burned down, and all the rest of the time you have that protection. You do lose some other WebAuthn benefits (e.g. bad guys can steal all the other credentials, passwords, TOTP secrets, SMS codes, from e.g. a server break-in, but it doesn't mean anything to steal your WebAuthn credentials because the relying party doesn't have any secret credentials, that's the whole point of the design) but phishing is the #1 win

encryptluks2 5y ago

This is my opinion as well. TOTP info can be encrypted, many programs offer phishing protection for TOTP tokens. I just don't see the value of hardware tokens where the hardware token can be compromised, and the credentials to access them can be as well.

tialaramex 5y ago
> I just don't see the value of hardware tokens where the hardware token can be compromised, and the credentials to access them can be as well. What sort of compromises are you envisioning here?