4 ms·
> Resident Key / Discoverable Credential - The browser supports WebAuthn credentials stored on the authenticator. These credentials can be read to identify the
by zagrebian 4y ago
> Resident Key / Discoverable Credential - The browser supports WebAuthn credentials stored on the authenticator. These credentials can be read to identify the user account without the user manually providing them.
Which websites do this?
- mooreds 4y agoIntuit is the big name I've always heard thrown around when it comes to WebAuthn passwordless login: https://fidoalliance.org/the-right-mix-intuits-journey-with-fido-authentication/ https://fidoalliance.org/the-right-mix-intuits-journey-with-... (which is what the discoverable credential enables). That's in contrast to WebAuthn as a second factor (which is where the authenticator is another factor in addition to a password).
- michaellee8 4y agoWeb3Auth uses a WebAuthn + Social login approach to store the credentials. https://web3auth.io/ https://web3auth.io/ Disclaimer: I work there.
- number6 4y agoThis is something you can do pretty easily with webauthn, but I never thought it as a good idea. Maybe instead of a "Remeber Me" Function...
- tialaramex 4y agoThe passwordless WebAuthn UX is much nicer than everything except, maybe, passwords plus an unsupervised auto-fill rule, which is also a great way to get your passwords stolen (if the auto-fill rule ever malfunctions your passwords get automatically given to somebody else). Yet it delivers much better security.
- will4274 4y agoMicrosoft does it. It's hidden behind one click in the UX, but if you click "Sign in options" on the screen where it asks you for a username to sign into e.g. Outlook, one of the options is to sign in with a WebAuthn credential. Here, Microsoft invokes the WebAuthN API in "discoverable credential" mode (with empty allowCredentials) - if you have multiple online accounts connected to your Windows account, Windows will ask you which of the accounts you want to use and then provide both userid and assertion for that account.
- 411111111111111 4y agoif you're using a keycloak for you authentication, you can actually enable it today! https://keycloak.ch/keycloak-tutorials/tutorial-webauthn/ https://keycloak.ch/keycloak-tutorials/tutorial-webauthn/ you basically just have to create a new 'browser flow' and enable this one in the realm you wish to authenticate with. It wasn't really possible to add multiple keys to the user the last time i configured it -- but according to the docs, that seems to be resolved so it probably is worth another look.
- kuschku 4y agoSadly I haven’t managed to find a way to make keycloak prefer security keys for 2FA over TOTP. I always get the TOTP prompt first, then have to click "try another way" and select security key.
- ArchOversight 4y agoIt depends on the order that the user registered their 2FA, since they are ordered (and an admin can move factors up/down in the admin interface). If you move the WebAuthN devices above the TOTP, Keycloak will first ask for the WebAuthN key with a button to switch back to another method (TOTP). It's slightly annoying.
- kuschku 4y agoNow that’s annoying! I wish there was a way to rank them, e.g., always prefer WebAuthN if available over TOTP.
- stavros 4y agoIs that OSS SSO software? Seems pretty nifty, and I'm looking for an SSO solution for work at the moment.
- 411111111111111 4y agoIt's pretty great, but you should be aware that the LTS version is called red hat single sign on (rh sso), and the keycloak itself updates every few months. It's usually not a deal breaker, but you should be aware if you're going to evaluate it for work
- stavros 4y agoI implemented it on www.pastery.net, for example, as I love the usernameless auth flow.