4 ms·

No, the solution is to get rid of passwords. WebAuthn is already being deployed. There will be a decade of consumer education ahead. https://en.wikipedia.org/

No, the solution is to get rid of passwords. WebAuthn is already being deployed. There will be a decade of consumer education ahead. https://en.wikipedia.org/wiki/WebAuthn https://en.wikipedia.org/wiki/WebAuthn

asiachick 5y ago
I'm not up on all the details but if I use WebAuthn in a major browser can I trivially give a different id to every website or is it more like they all want to authenticate me as the same person joe@apple.com, jill@google.com, clippy@outlook.com etc,....
- tialaramex 5y ago
  tl;dr Yes you can definitely give a different ID to every web site and it's not even possible to correlate those IDs based on you using WebAuthn for them The elliptic curve private keys used to sign the authentication message are actually different for every site you use the authenticator with, they're chosen at random and cheap authenticators aren't even storing them anywhere, which is part of how fiendishly clever WebAuthn / FIDO is. Because the authenticators aren't storing the identifier, if you sign into GitHub as asiachick, after having previously enrolled your authenticator as southamericandude even that authenticator has no idea you're asiachick, and so it won't give the game away, and you can even enroll the same authenticator for both these users and it will work, correctly, and GitHub can only even prove anything is going on by deliberating asking asiachick to authenticate as southamericandude or vice versa, which they've got no reason to try. Now, if you are using WebAuthn to do usernameless authentication (no password, not even a username, just WebAuthn and one touch to log in) this can't work without the authenticator knowing the credentials. But in that case your local device gives you a menu saying like, asiachick or southamericandude ?
userbinator 5y ago
This makes it possible to implement support for WebAuthn purely in software, making use of a processor's trusted execution environment or a Trusted Platform Module (TPM). Hell no. Do NOT want. No no no no no, never. A password is a simple concept. That stuff seems more aligned with incentives to create complexity, and thus increase possibility of things going wrong. Not to mention the overall dystopian nature of it all.
- notriddle 5y ago
  What’s your plan to reduce the number of successful phishing attacks? Password managers are a perfectly reasonable answer, but they need to hide the text entry field, to make sure everybody actually uses the password manager instead of entering a password by hand.
  - userbinator 5y ago
    Education. Not turning users into even more idiotic helpless creatures.
    - notriddle 5y ago
      Education has been the plan for the past twenty years. Has it worked?
      - userbinator 5y ago
        How long did it take for most people to become literate in general?
        notriddle 5y ago
        Unfortunately, we live in the present, not hundreds of years in the future. The fact that it took so long for literacy to take hold seems like an argument against trying to use education as you go-to solution to a problem, since it’s not only slow, but also spreads unevenly and unpredictably. Also, I resent the comparison between advocating a defensive design, and being opposed to literacy. It’s not as if I’m advocating for locked bootloaders, or anything else that would prevent a determined user from doing whatever they want. I’m arguing that manual password management should not be the obvious default.
        smaudet 5y ago
        "I resent the comparison between advocating a defensive design, and being opposed to literacy." Perhaps you shouldn't - this is like Conways law, systems tend to mimic the communication systems of their organizations. When you design a system which encourages a certain philosophy, you create "positive" potential in that direction. By designing and promoting systems which reduce user control, you further the communication model of top down hierarchical control. Why should I trust Webauthn? What stops it from itself being hacked? People with password managers, no control over authentication, end up less, not more secure. The only way to increase security is modularization - if you don't want phishing attacks to occur, you should isolate the process. You should have more than one password, and you should absolutely not store them all in one place. There have been several indications in this thread how you can isolate the process, none of them require overly complex, big brotheresque solutions.
ReactiveJelly 5y ago
No, 2 factors is good. Something you have AND something you know. I don't want someone to lift my HSM and joyride with it all weekend before I notice it's gone.
- tialaramex 5y ago
  WebAuthn is quite capable of doing two factors. At the cheapest end, something like a Yubico Security Key 2 does two factors with one being the physical key you have and the other being a PIN (such as "180479" or indeed "FkR0Mpg"). An adversary who steals the physical device needs to guess the PIN correctly before it locks out after a few wrong guesses. Something like a decent Android phone uses a fingerprint as its second factor, Yubico make a physical device that does this if you've got cash burning a hole in your pocket. In WebAuthn terms the remote site ("relying party") just asks for User Verification and checks that the UV bit is set on the signed message from the authenticator (all WebAuthn signatures will have UP (User Present) set, but UV is a separate bit)
- miohtama 5y ago
  Two-factor does not protect against phishing attempts. The fake website can ask for two-factor input and man-in-the-middle proxy this to the attacked website. These techniques have been used by the phishers for the last decade or so. Asking more two-factor codes e.g. Once at login and once at withdrawal helps, but the impact is not significant and also brings down the overall UX.
tialaramex 5y ago
Right, notice that WebAuthn is completely immune to this attack like other phishing attacks, and the "consumer education" is mostly unlearning things. All the anti-phishing lessons are irrelevant. The real browser knows you are looking at phishing.example and so if asked for credentials it will try to get credentials for phishing.example, meanwhile the fake browser which insists this is facebook.com can't talk to the physical Security Key.
- tatersolid 5y ago
  Until the phishing site says “there’s a problem with your security key, please enter your password and the SMS code we just sent” The presence of alternative “back up” Authentication mechanisms on nearly every site and service prevents WebAuthn from being truly effective.
pabs3 5y ago
Do any web browsers/servers natively support WebAuthn? or will it remain a JS-only and webapp-only technology?
mschuster91 5y ago
Anything that does not involve passwords or something that can be backed up is dangerous on its own though. Consider the case of police or customs seizing all of your devices, your Yubikey being destroyed by a pet eating it, your home being destroyed by fire or you having to flee an active war zone - how will you login into your stuff again? And most people won't think of enrolling a secondary 2FA module, not to mention there are a lot of sites that don't allow enrolment of more than one authenticator and the fact that the backup has to be stored somewhere offsite opens up new potential for theft
- miohtama 5y ago
  While what you say is true, e.g. WebAuthn + trusted platform module on mobile phone is the lesser evil for the most consumer use cases. It might not be lesser evil for all use cases, but it wil be the lesser evil for retail banking, Ecommerce, Steam accounts, OnlyFan creators, cryptocurrency exchanges, social media accounts and such. We are talking about billions of medium security accounts, not handful of high security accounts.

asiachick 5y ago

I'm not up on all the details but if I use WebAuthn in a major browser can I trivially give a different id to every website or is it more like they all want to authenticate me as the same person joe@apple.com, jill@google.com, clippy@outlook.com etc,....

tialaramex 5y ago
tl;dr Yes you can definitely give a different ID to every web site and it's not even possible to correlate those IDs based on you using WebAuthn for them The elliptic curve private keys used to sign the authentication message are actually different for every site you use the authenticator with, they're chosen at random and cheap authenticators aren't even storing them anywhere, which is part of how fiendishly clever WebAuthn / FIDO is. Because the authenticators aren't storing the identifier, if you sign into GitHub as asiachick, after having previously enrolled your authenticator as southamericandude even that authenticator has no idea you're asiachick, and so it won't give the game away, and you can even enroll the same authenticator for both these users and it will work, correctly, and GitHub can only even prove anything is going on by deliberating asking asiachick to authenticate as southamericandude or vice versa, which they've got no reason to try. Now, if you are using WebAuthn to do usernameless authentication (no password, not even a username, just WebAuthn and one touch to log in) this can't work without the authenticator knowing the credentials. But in that case your local device gives you a menu saying like, asiachick or southamericandude ?

userbinator 5y ago

This makes it possible to implement support for WebAuthn purely in software, making use of a processor's trusted execution environment or a Trusted Platform Module (TPM). Hell no. Do NOT want. No no no no no, never. A password is a simple concept. That stuff seems more aligned with incentives to create complexity, and thus increase possibility of things going wrong. Not to mention the overall dystopian nature of it all.

notriddle 5y ago
What’s your plan to reduce the number of successful phishing attacks? Password managers are a perfectly reasonable answer, but they need to hide the text entry field, to make sure everybody actually uses the password manager instead of entering a password by hand.
- userbinator 5y ago
  Education. Not turning users into even more idiotic helpless creatures.
  - notriddle 5y ago
    Education has been the plan for the past twenty years. Has it worked?
    - userbinator 5y ago
      How long did it take for most people to become literate in general?
      - notriddle 5y ago
        Unfortunately, we live in the present, not hundreds of years in the future. The fact that it took so long for literacy to take hold seems like an argument against trying to use education as you go-to solution to a problem, since it’s not only slow, but also spreads unevenly and unpredictably. Also, I resent the comparison between advocating a defensive design, and being opposed to literacy. It’s not as if I’m advocating for locked bootloaders, or anything else that would prevent a determined user from doing whatever they want. I’m arguing that manual password management should not be the obvious default.
        smaudet 5y ago
        "I resent the comparison between advocating a defensive design, and being opposed to literacy." Perhaps you shouldn't - this is like Conways law, systems tend to mimic the communication systems of their organizations. When you design a system which encourages a certain philosophy, you create "positive" potential in that direction. By designing and promoting systems which reduce user control, you further the communication model of top down hierarchical control. Why should I trust Webauthn? What stops it from itself being hacked? People with password managers, no control over authentication, end up less, not more secure. The only way to increase security is modularization - if you don't want phishing attacks to occur, you should isolate the process. You should have more than one password, and you should absolutely not store them all in one place. There have been several indications in this thread how you can isolate the process, none of them require overly complex, big brotheresque solutions.

ReactiveJelly 5y ago

No, 2 factors is good. Something you have AND something you know. I don't want someone to lift my HSM and joyride with it all weekend before I notice it's gone.

tialaramex 5y ago
WebAuthn is quite capable of doing two factors. At the cheapest end, something like a Yubico Security Key 2 does two factors with one being the physical key you have and the other being a PIN (such as "180479" or indeed "FkR0Mpg"). An adversary who steals the physical device needs to guess the PIN correctly before it locks out after a few wrong guesses. Something like a decent Android phone uses a fingerprint as its second factor, Yubico make a physical device that does this if you've got cash burning a hole in your pocket. In WebAuthn terms the remote site ("relying party") just asks for User Verification and checks that the UV bit is set on the signed message from the authenticator (all WebAuthn signatures will have UP (User Present) set, but UV is a separate bit)
miohtama 5y ago
Two-factor does not protect against phishing attempts. The fake website can ask for two-factor input and man-in-the-middle proxy this to the attacked website. These techniques have been used by the phishers for the last decade or so. Asking more two-factor codes e.g. Once at login and once at withdrawal helps, but the impact is not significant and also brings down the overall UX.

tialaramex 5y ago

Right, notice that WebAuthn is completely immune to this attack like other phishing attacks, and the "consumer education" is mostly unlearning things. All the anti-phishing lessons are irrelevant. The real browser knows you are looking at phishing.example and so if asked for credentials it will try to get credentials for phishing.example, meanwhile the fake browser which insists this is facebook.com can't talk to the physical Security Key.

tatersolid 5y ago
Until the phishing site says “there’s a problem with your security key, please enter your password and the SMS code we just sent” The presence of alternative “back up” Authentication mechanisms on nearly every site and service prevents WebAuthn from being truly effective.

pabs3 5y ago

Do any web browsers/servers natively support WebAuthn? or will it remain a JS-only and webapp-only technology?

mschuster91 5y ago

Anything that does not involve passwords or something that can be backed up is dangerous on its own though. Consider the case of police or customs seizing all of your devices, your Yubikey being destroyed by a pet eating it, your home being destroyed by fire or you having to flee an active war zone - how will you login into your stuff again? And most people won't think of enrolling a secondary 2FA module, not to mention there are a lot of sites that don't allow enrolment of more than one authenticator and the fact that the backup has to be stored somewhere offsite opens up new potential for theft

miohtama 5y ago
While what you say is true, e.g. WebAuthn + trusted platform module on mobile phone is the lesser evil for the most consumer use cases. It might not be lesser evil for all use cases, but it wil be the lesser evil for retail banking, Ecommerce, Steam accounts, OnlyFan creators, cryptocurrency exchanges, social media accounts and such. We are talking about billions of medium security accounts, not handful of high security accounts.