5 ms·

We just migrated our web service from u2f api to webauthn and it was a massive pain. It’s true the old keys worked but it relies on using an extensions api with

by qudat 5y ago

We just migrated our web service from u2f api to webauthn and it was a massive pain. It’s true the old keys worked but it relies on using an extensions api within webauthn. Even without backwards compatibility, there are a lot of pieces that have to be set properly and rely heavily on third-party libraries to be written correctly for things to work. I get the security benefits over something like OTP but it is vastly simpler to setup. Getting an RP ID to work across multiple subdomains, legacy trusted facets, origin checks, proper marshaling and unmarshaling of binary / base64 / base64 url safe are real pain points. Things will work with localhost but then when you deploy it doesn’t with the real domains / subdomains / origin / rp id. Not fun and the documentation is at times rather vague. For example, what is a registrable domain? I spent hours and hours trying to figure this out by reading the specification. I don’t know why but no matter what I tried I couldn’t get webauthn to recognize ngrok.io as one so things would fail. Probably my misinterpretation but still frustrating nonetheless. We also have a cli counterpart and libfido2 has virtually no documentation so I’m traversing C code to figure out vague error messages like “err invalid length.”

psanford 5y ago
Adam Langley's blog about webauthn is still the best resource that explains how everything fits together: https://www.imperialviolet.org/2018/03/27/webauthn.html https://www.imperialviolet.org/2018/03/27/webauthn.html
paulryanrogers 5y ago
IIRC the only reliable way to check if a domain is registrable is to rely on a public suffix list. ICANN's TLD binge has made keeping those PSLs up to date a challenge.
tialaramex 5y ago
From your description it sounds like you were fighting very hard to make this into a box ticking exercise which didn't deliver any security, and unsurprisingly WebAuthn wasn't interested in helping you achieve that. I found it very easy to deploy WebAuthn securely, writing everything from scratch as a toy project to understand how it works, but of course I wasn't fighting to mark the checkbox while not delivering security. > what is a registrable domain? [...] I couldn't get webauthn to recognize ngrok.io A registrable domain is a domain that "you" aren't sharing with somebody else. For example this site is sharing .com with millions of other separate entities, so WebAuthn is not interested in having credentials for "com" because that wouldn't mean anything and introduces needless privacy risk, but Y Combinator owns all of ycombinator.com so that would constitute a registrable domain. ngrok.io as you presumably knew but omitted to mention, is used by large numbers of different entities to build network tunnels, so it doesn't mean anything to have "ngrok.io" credentials any more than for "com" and WebAuthn won't allow that. For now, for want of anything better, the PSL is used in browsers to figure out what counts and what doesn't, but the rule of thumb I described above will serve you very well.
- qudat 5y ago
  > so it doesn't mean anything to have "ngrok.io" credentials any more than for "com" and WebAuthn won't allow that. Nowhere in the spec did I see where ngrok.io should be excluded as a valid rp id, I looked pretty intently but could have missed something. Just like with localhost this was purely a way to cheaply get tls to simulate a more real implementation. > I found it very easy to deploy WebAuthn securely, writing everything from scratch as a toy project to understand how it works I’m glad you found it easy but judging by the fact that you implemented webauthn by yourself, your skill level is probably advanced. Furthermore, in my particular case I needed to support legacy u2f-api keys, which added to the complexity. The APIs are different, what they expect are different, and the third party libraries are different.
  - hn_throwaway_99 5y ago
    Not an expert in this topic, but: ngrok.io is on the Public Suffix List: https://publicsuffix.org/list/ https://publicsuffix.org/list/ This other comment says that WebAuthn uses the PSL in its definition of "registerable domains": https://news.ycombinator.com/item?id=24444476 https://news.ycombinator.com/item?id=24444476 Edit: yes, here is the part of the spec that says where you can't register public suffixes: https://html.spec.whatwg.org/multipage/origin.html#is-a-registrable-domain-suffix-of-or-is-equal-to https://html.spec.whatwg.org/multipage/origin.html#is-a-regi...
  - jeroenhd 5y ago
    > Nowhere in the spec did I see where ngrok.io should be excluded as a valid rp id, I looked pretty intently but could have missed something. Just like with localhost this was purely a way to cheaply get tls to simulate a more real implementation. It's in the spec, though you need to click a few links to get to the details. The WebAuthn spec (https://www.w3.org/TR/webauthn-2/ https://www.w3.org/TR/webauthn-2/) has the following in the terms defined by reference: > is a registrable domain suffix of or is equal to This references the following page: https://html.spec.whatwg.org/multipage/origin.html#is-a-registrable-domain-suffix-of-or-is-equal-to https://html.spec.whatwg.org/multipage/origin.html#is-a-regi... Which contains a reference to a "public suffix": https://url.spec.whatwg.org/#host-public-suffix https://url.spec.whatwg.org/#host-public-suffix Which references the Public Suffic List: https://publicsuffix.org/list/ https://publicsuffix.org/list/ Which ngrok.io is on: https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat So, this limitation is in the spec, it's just not immediately obvious if you skim through the spec to find the problem. The public suffix list ensures that you cannot accidentally share your authentication domain with others for all kinds of security measures, and WebAuthn is just one of those. Learning about the PSL and its uses (and applied limitations) is imperative if you write any kind of security-related web content, IMO.
baybal2 5y ago
We used USB smartcard, and they were plug-and-play for the last n-years, despite Google's repeated attempts to axe/stealth brake them (and being returned to working order every time due to corporate clients pressure)

by qudat 5y ago

psanford 5y ago

Adam Langley's blog about webauthn is still the best resource that explains how everything fits together: https://www.imperialviolet.org/2018/03/27/webauthn.html https://www.imperialviolet.org/2018/03/27/webauthn.html

paulryanrogers 5y ago

IIRC the only reliable way to check if a domain is registrable is to rely on a public suffix list. ICANN's TLD binge has made keeping those PSLs up to date a challenge.

tialaramex 5y ago

From your description it sounds like you were fighting very hard to make this into a box ticking exercise which didn't deliver any security, and unsurprisingly WebAuthn wasn't interested in helping you achieve that. I found it very easy to deploy WebAuthn securely, writing everything from scratch as a toy project to understand how it works, but of course I wasn't fighting to mark the checkbox while not delivering security. > what is a registrable domain? [...] I couldn't get webauthn to recognize ngrok.io A registrable domain is a domain that "you" aren't sharing with somebody else. For example this site is sharing .com with millions of other separate entities, so WebAuthn is not interested in having credentials for "com" because that wouldn't mean anything and introduces needless privacy risk, but Y Combinator owns all of ycombinator.com so that would constitute a registrable domain. ngrok.io as you presumably knew but omitted to mention, is used by large numbers of different entities to build network tunnels, so it doesn't mean anything to have "ngrok.io" credentials any more than for "com" and WebAuthn won't allow that. For now, for want of anything better, the PSL is used in browsers to figure out what counts and what doesn't, but the rule of thumb I described above will serve you very well.

qudat 5y ago
> so it doesn't mean anything to have "ngrok.io" credentials any more than for "com" and WebAuthn won't allow that. Nowhere in the spec did I see where ngrok.io should be excluded as a valid rp id, I looked pretty intently but could have missed something. Just like with localhost this was purely a way to cheaply get tls to simulate a more real implementation. > I found it very easy to deploy WebAuthn securely, writing everything from scratch as a toy project to understand how it works I’m glad you found it easy but judging by the fact that you implemented webauthn by yourself, your skill level is probably advanced. Furthermore, in my particular case I needed to support legacy u2f-api keys, which added to the complexity. The APIs are different, what they expect are different, and the third party libraries are different.
- hn_throwaway_99 5y ago
  Not an expert in this topic, but: ngrok.io is on the Public Suffix List: https://publicsuffix.org/list/ https://publicsuffix.org/list/ This other comment says that WebAuthn uses the PSL in its definition of "registerable domains": https://news.ycombinator.com/item?id=24444476 https://news.ycombinator.com/item?id=24444476 Edit: yes, here is the part of the spec that says where you can't register public suffixes: https://html.spec.whatwg.org/multipage/origin.html#is-a-registrable-domain-suffix-of-or-is-equal-to https://html.spec.whatwg.org/multipage/origin.html#is-a-regi...
- jeroenhd 5y ago
  > Nowhere in the spec did I see where ngrok.io should be excluded as a valid rp id, I looked pretty intently but could have missed something. Just like with localhost this was purely a way to cheaply get tls to simulate a more real implementation. It's in the spec, though you need to click a few links to get to the details. The WebAuthn spec (https://www.w3.org/TR/webauthn-2/ https://www.w3.org/TR/webauthn-2/) has the following in the terms defined by reference: > is a registrable domain suffix of or is equal to This references the following page: https://html.spec.whatwg.org/multipage/origin.html#is-a-registrable-domain-suffix-of-or-is-equal-to https://html.spec.whatwg.org/multipage/origin.html#is-a-regi... Which contains a reference to a "public suffix": https://url.spec.whatwg.org/#host-public-suffix https://url.spec.whatwg.org/#host-public-suffix Which references the Public Suffic List: https://publicsuffix.org/list/ https://publicsuffix.org/list/ Which ngrok.io is on: https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat So, this limitation is in the spec, it's just not immediately obvious if you skim through the spec to find the problem. The public suffix list ensures that you cannot accidentally share your authentication domain with others for all kinds of security measures, and WebAuthn is just one of those. Learning about the PSL and its uses (and applied limitations) is imperative if you write any kind of security-related web content, IMO.

baybal2 5y ago

We used USB smartcard, and they were plug-and-play for the last n-years, despite Google's repeated attempts to axe/stealth brake them (and being returned to working order every time due to corporate clients pressure)