6 ms·

Historically, it's bad news when big corporations get involved with standardizing anything security related. It generally means it's going to be complicated, co

Historically, it's bad news when big corporations get involved with standardizing anything security related. It generally means it's going to be complicated, convoluted, and hopelessly tied to proprietary stuff you can only get from these big corporations. Interoperability is almost guaranteed to not be a thing. Just look at how the big FANG companies managed to adopt OpenID and yet made it so that it can't be used to authenticate users between them. They never liked identity federation because it would mean not controlling the user's identity completely. Google loves identity standards as long as Google is the one and only party doing the authenticating. Same with Microsoft. Apple for sure is not going to let anyone do anything that matters on their platforms. That's why people still use simple email/password as a way to authenticate. It's just too much of a pain to implement anything else for independent web developers. Take fido/webauthn for example, which FIDO standardized and which then got restandardized/reimagined by the W3C as webauthn. That stuff was delivered years ago in a half-assed way. Pretty much the only widely used thing in this space is yubikey. The only people I know that actually use that or know about it are developers. Nobody ever did the obvious thing of hooking this stuff up to biometric readers deployed by the billions in the form of phones using either photo recognition or finger print readers, laptop finger print readers, etc. Such an obvious thing to do. Never happened. What are Google and Apple waiting for? What's the holdup? Do they lack the imagination or is there another reason that perfectly sane proposals from engineers they employ to do something like that consistently get shot down by management? Which is probably exactly what happened. Over and over again. They fundamentally don't like security standards that reduce their grip on user identity and "owning" that.

microtonal 5y ago
Nobody ever did the obvious thing of hooking this stuff up to biometric readers deployed by the billions in the form of phones using either photo recognition or finger print readers, laptop finger print readers, etc. Such an obvious thing to do. Never happened. What are Google and Apple waiting for? On Apple platforms, you can use webauthn with Touch ID and Face ID in Safari. For some reason it doesn't work on all sites (probably because they implement the older FIDO standard, not webauthn?). These passkey FIDO credentials mentioned on the linked post are also activated with Touch ID on macOS. I have passkey configured on one or two websites and I authanticate with Touch ID. (And still a password, but it's the first step.)
- deleted 5y ago
  [deleted]
- number6 5y ago
  > The only people I know that actually use that or know about it are developers. Never saw this used outside of the tech space. Even adoption af standart password managers is painfully slow.
  - pmoriarty 5y ago
    "Even adoption af standart password managers is painfully slow." I am reluctant to use password managers on my phone because of the risk of my passwords being exfiltrated either by the app developer, by the OS manufacturer, or by whomever manages to hack in to my phone.
    - judge2020 5y ago
      The attack surfaces for desktops, even Linux desktops, is incredibly large in comparison to the phone. The only difference is that your concern of "the OS manufacturer" hacking your phone are lessened on Linux, assuming you're auditing all packages you download or are using a permission-based OS like Nix.
      - fragmede 5y ago
        what is it about curl | sudo bash that gives you pause about Linux desktop security?
- Avamander 5y ago
  > For some reason it doesn't work on all sites (probably because they implement the older FIDO standard, not webauthn?). Because Apple decided to improvise and added some broken and nonstandard "user interaction" requirement to Webauthn. With a whitelist for the big players.
  - Ajedi32 5y ago
jsmith99 5y ago
What happens if they lose the device?
- xyzzy123 5y ago
  The device tends to be tied to an underlying "cloud identity" (apple id, google account, microsoft account etc). You can use that account to re-enrol / manage devices etc. Ideally people have more than 1 device enrolled to enable easy fallback if one is lost. However, if the user loses access to their primary / cloud account for any reason, they will have a bad day.
  - _Algernon_ 5y ago
    What happens when google bans your entire google account for watching Ukraine supporting live streams? https://news.ycombinator.com/item?id=30467384 https://news.ycombinator.com/item?id=30467384
    - cute_boi 5y ago
      Obviously, Google wont care and people will lose their fortunes. Some of them will come to hacker news and grouse that they have been treated unfairly. Government will remain silent because they can easily spy on people from data obtained from "big" techs.
      - account-5 5y ago
        This exactly.
  - account-5 5y ago
    A number of these FIDO posts are cropping up and I still don't really get it. Someone in a previous one explained the benefits over and above my current password manager set up. However you have articulated the single biggest problem with this, and that is you are not in control of this thing. I'm activity not tying anything to a cloud identity, ever. And I'm not having multiple devices or multiple cloud identities for when Google's et. al. automated AI type system decides I'm not getting access to my stuff. It seems to me a centralised single point of weakness open to exploitation from the multi national corps.
wereHamster 5y ago
The FIDO2 spec is written by someone who has no idea how web apis work. Lots of it is based on CBOR instead of JSON which makes it a PITA to handle in JS code (yes, there is a cbor npm library but why… WHY?!?).
- robocat 5y ago
  > CBOR Ugggghh. https://en.wikipedia.org/wiki/CBOR https://en.wikipedia.org/wiki/CBOR Negative numbers are encoded in such a way that can express a number than can’t fit into an int64. Undefined can be encoded. Floating point numbers are sent raw, so Infinity, -Infinity, -0, Signalling NaN, other NaN values can be encoded. A horrific choice for a security related API - a security API should never add unnecessary corner cases. Type 1 encodes negative integers, with a value of −1−count, for values from −2^64 to −1. The values 20–23 are used to encode the special values false, true, null, and undefined Short counts of 25, 26 or 27 indicate a following extended count field is to be interpreted as a (big-endian) 16-, 32- or 64-bit IEEE floating point value Edit: oh god no. https://www.rfc-editor.org/rfc/rfc8949.html https://www.rfc-editor.org/rfc/rfc8949.html Epoch-Based Date/Time allows 5 different integer or floating point representations (what to do with NaN numbers unspecified, so t+Infinity and beyond are representable). Tag number 36 is for MIME messages. Read the rest of the RFC for a truely hideous kitchen-sink specification.
- pg_bot 5y ago
  I agree that CBOR is unnecessarily shoe horned into the spec, but it honestly isn't that bad. IMO there are two other problems that need to be resolved for webauthn to go mainstream. The first is the fact that there is no mechanism for changing/updating the url tied to a device for a website. This is intentional for phishing reasons, but if you want to rebrand or are acquired you're going to run into problems. The second is the frontend JS API is a bit awkward to implement.
  - tialaramex 5y ago
    > The first is the fact that there is no mechanism for changing/updating the url tied to a device for a website. This is intentional for phishing reasons, but if you want to rebrand or are acquired you're going to run into problems. You can't solve this "problem". The RPID is bound into the actual credentials, it isn't that there's no mechanism provided to change it, but rather that it is part of the credentials themselves. If you want actionable advice for people whose big boss has determined that they absolutely must change from foo.example to bar.example, they need to use the foo.example site to accept the credentials and forward users to bar.example and then re-enrol them to the "new" bar.example account with new credentials. Users will probably be annoyed about this hassle, but you can't do anything about that it was sealed in with the decision to get rid of foo.example. If your feedback is "But that's user hostile" yeah, so, don't change from foo.example to bar.example. What seems so very important to you is just another pointless annoyance for your users. Remember, you don't need to put the foo.example name on employee badges or the corporate logo to keep it, you only need to keep the name and use it to do the auth step. The same "Re-brand at all costs" thinking destroys users bookmarks, email address books, word-of-mouth, - destroys so much intangible value, and yet you can bet that the executives who decided upon it will argue that since they didn't measure that value they're destroying it doesn't exist.
mschuster91 5y ago
> Nobody ever did the obvious thing of hooking this stuff up to biometric readers deployed by the billions in the form of phones using either photo recognition or finger print readers, laptop finger print readers, etc. The last thing I want to expose to some random shady internet site is my photo or fingerprint.
- jillesvangurp 5y ago
  The photo or fingerprint never leaves your device ...
  - mschuster91 5y ago
    No solution on a PC or non-Apple laptops offers this. Apple and Android devices can because they have secure enclaves with the capability to do trusted analysis and attestation of fingerprints and photos, but no one else has the required technology and the required secure communication channels between the involved components.
    - currysausage 5y ago
      Are you sure? I'm pretty sure I can use my fingerprint for Outlook.com login through Chrome on Windows 10.
    - philistine 5y ago
      You’re wrong. Multiple vendors have what Apple calls a Secure Enclave. On PC, it’s called the Trusted Platform Module and somehow the whole PC crowd has decided that thing is unequivocally the road to fascism.
- currysausage 5y ago
  If it's FIDO2, then you don't actually expose biometrics to the site. The verification is done on device and unlocks a key saved in the TPM/secure enclave. Of course, once Face ID/Windows Hello logins on the web become a thing, web sites may trick users into enabling their regular camera instead, for whatever reason.
jolux 5y ago
Actually Apple does support using Touch ID and Face ID for WebAuthn on their platforms, it even works in Chrome.
judge2020 5y ago
You can try it currently - set an iOS device as a development target in Xcode, go to the iOS developer menu (settings->developer) and turn on the passkey option[0]. Then, on a desktop or laptop with Bluetooth and in a Chromium-based browser, attempt to enroll a security key on a website that supports Webauthn - Chrome will popup the prompt to "add a new Android device", which will then show a QR code that you can scan on your iOS device. It'll prompt you to enroll a security key with the text about "save a passkey for this account in iCloud Keychain"[1]. In reality, all it does is create and sync fresh security key private keys for use across devices, with interoperability over BLE so it's easier to use them even if you don't have an expensive iMac. 0: https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys https://developer.apple.com/documentation/authenticationserv... 1: https://photos.app.goo.gl/5LwhDsXbWg4yb6326 https://photos.app.goo.gl/5LwhDsXbWg4yb6326
_wldu 5y ago
Yubikeys are awesome. I have a copy of a signing only PGP key on a Yubikey and I use it to sign all of my git commits. Easy and very secure. Cheap too.
- jml7c5 5y ago
  >Cheap too. Doesn't it cost $45? There's the FIDO one that's less expensive, but I thought it couldn't be used for signing commits.
merb 5y ago
> Just look at how the big FANG companies managed to adopt OpenID and yet made it so that it can't be used to authenticate users between them. They never liked identity federation because it would mean not controlling the user's identity completely. Google loves identity standards as long as Google is the one and only party doing the authenticating. Same with Microsoft. Apple for sure is not going to let anyone do anything that matters on their platforms. actually OpenID Connect 1.0 - the thing that most companies use (like google, apple, microsoft) actually does not yet support Federation. OpenID Connect is basically a little bit more than OAuth2 (which was never about Federation) Of course there is a draft spec about federation: https://openid.net/specs/openid-connect-federation-1_0.html https://openid.net/specs/openid-connect-federation-1_0.html (unfortunatly only microsoft is included and not google), there is also: https://openid.net/specs/openid-connect-self-issued-v2-1_0.html https://openid.net/specs/openid-connect-self-issued-v2-1_0.h... (also only a draft one...) but I'm pretty sure that both will probably allow the usage of federation at one point - at least for Commercial entities. Because Google Cloud Identity actually supports SCIM 2.0 and upstream OpenID Connect IdP's or SAML2 (https://cloud.google.com/architecture/identity/keycloak-single-sign-on?hl=de https://cloud.google.com/architecture/identity/keycloak-sing...). the original OpenID Authentication spec was about federatation, but barley nobody implemented it. (I can only think about StackOverflow (which dropped it in 2018) and something at RedHat/Fedora - can't remember?)

microtonal 5y ago

Nobody ever did the obvious thing of hooking this stuff up to biometric readers deployed by the billions in the form of phones using either photo recognition or finger print readers, laptop finger print readers, etc. Such an obvious thing to do. Never happened. What are Google and Apple waiting for? On Apple platforms, you can use webauthn with Touch ID and Face ID in Safari. For some reason it doesn't work on all sites (probably because they implement the older FIDO standard, not webauthn?). These passkey FIDO credentials mentioned on the linked post are also activated with Touch ID on macOS. I have passkey configured on one or two websites and I authanticate with Touch ID. (And still a password, but it's the first step.)

deleted 5y ago
[deleted]
number6 5y ago
> The only people I know that actually use that or know about it are developers. Never saw this used outside of the tech space. Even adoption af standart password managers is painfully slow.
- pmoriarty 5y ago
  "Even adoption af standart password managers is painfully slow." I am reluctant to use password managers on my phone because of the risk of my passwords being exfiltrated either by the app developer, by the OS manufacturer, or by whomever manages to hack in to my phone.
  - judge2020 5y ago
    The attack surfaces for desktops, even Linux desktops, is incredibly large in comparison to the phone. The only difference is that your concern of "the OS manufacturer" hacking your phone are lessened on Linux, assuming you're auditing all packages you download or are using a permission-based OS like Nix.
    - fragmede 5y ago
      what is it about curl | sudo bash that gives you pause about Linux desktop security?
Avamander 5y ago
> For some reason it doesn't work on all sites (probably because they implement the older FIDO standard, not webauthn?). Because Apple decided to improvise and added some broken and nonstandard "user interaction" requirement to Webauthn. With a whitelist for the big players.
- Ajedi32 5y ago

jsmith99 5y ago

What happens if they lose the device?

xyzzy123 5y ago
The device tends to be tied to an underlying "cloud identity" (apple id, google account, microsoft account etc). You can use that account to re-enrol / manage devices etc. Ideally people have more than 1 device enrolled to enable easy fallback if one is lost. However, if the user loses access to their primary / cloud account for any reason, they will have a bad day.
- _Algernon_ 5y ago
  What happens when google bans your entire google account for watching Ukraine supporting live streams? https://news.ycombinator.com/item?id=30467384 https://news.ycombinator.com/item?id=30467384
  - cute_boi 5y ago
    Obviously, Google wont care and people will lose their fortunes. Some of them will come to hacker news and grouse that they have been treated unfairly. Government will remain silent because they can easily spy on people from data obtained from "big" techs.
    - account-5 5y ago
      This exactly.
- account-5 5y ago
  A number of these FIDO posts are cropping up and I still don't really get it. Someone in a previous one explained the benefits over and above my current password manager set up. However you have articulated the single biggest problem with this, and that is you are not in control of this thing. I'm activity not tying anything to a cloud identity, ever. And I'm not having multiple devices or multiple cloud identities for when Google's et. al. automated AI type system decides I'm not getting access to my stuff. It seems to me a centralised single point of weakness open to exploitation from the multi national corps.

wereHamster 5y ago

The FIDO2 spec is written by someone who has no idea how web apis work. Lots of it is based on CBOR instead of JSON which makes it a PITA to handle in JS code (yes, there is a cbor npm library but why… WHY?!?).

robocat 5y ago
> CBOR Ugggghh. https://en.wikipedia.org/wiki/CBOR https://en.wikipedia.org/wiki/CBOR Negative numbers are encoded in such a way that can express a number than can’t fit into an int64. Undefined can be encoded. Floating point numbers are sent raw, so Infinity, -Infinity, -0, Signalling NaN, other NaN values can be encoded. A horrific choice for a security related API - a security API should never add unnecessary corner cases. Type 1 encodes negative integers, with a value of −1−count, for values from −2^64 to −1. The values 20–23 are used to encode the special values false, true, null, and undefined Short counts of 25, 26 or 27 indicate a following extended count field is to be interpreted as a (big-endian) 16-, 32- or 64-bit IEEE floating point value Edit: oh god no. https://www.rfc-editor.org/rfc/rfc8949.html https://www.rfc-editor.org/rfc/rfc8949.html Epoch-Based Date/Time allows 5 different integer or floating point representations (what to do with NaN numbers unspecified, so t+Infinity and beyond are representable). Tag number 36 is for MIME messages. Read the rest of the RFC for a truely hideous kitchen-sink specification.
pg_bot 5y ago
I agree that CBOR is unnecessarily shoe horned into the spec, but it honestly isn't that bad. IMO there are two other problems that need to be resolved for webauthn to go mainstream. The first is the fact that there is no mechanism for changing/updating the url tied to a device for a website. This is intentional for phishing reasons, but if you want to rebrand or are acquired you're going to run into problems. The second is the frontend JS API is a bit awkward to implement.
- tialaramex 5y ago
  > The first is the fact that there is no mechanism for changing/updating the url tied to a device for a website. This is intentional for phishing reasons, but if you want to rebrand or are acquired you're going to run into problems. You can't solve this "problem". The RPID is bound into the actual credentials, it isn't that there's no mechanism provided to change it, but rather that it is part of the credentials themselves. If you want actionable advice for people whose big boss has determined that they absolutely must change from foo.example to bar.example, they need to use the foo.example site to accept the credentials and forward users to bar.example and then re-enrol them to the "new" bar.example account with new credentials. Users will probably be annoyed about this hassle, but you can't do anything about that it was sealed in with the decision to get rid of foo.example. If your feedback is "But that's user hostile" yeah, so, don't change from foo.example to bar.example. What seems so very important to you is just another pointless annoyance for your users. Remember, you don't need to put the foo.example name on employee badges or the corporate logo to keep it, you only need to keep the name and use it to do the auth step. The same "Re-brand at all costs" thinking destroys users bookmarks, email address books, word-of-mouth, - destroys so much intangible value, and yet you can bet that the executives who decided upon it will argue that since they didn't measure that value they're destroying it doesn't exist.

mschuster91 5y ago

> Nobody ever did the obvious thing of hooking this stuff up to biometric readers deployed by the billions in the form of phones using either photo recognition or finger print readers, laptop finger print readers, etc. The last thing I want to expose to some random shady internet site is my photo or fingerprint.

jillesvangurp 5y ago
The photo or fingerprint never leaves your device ...
- mschuster91 5y ago
  No solution on a PC or non-Apple laptops offers this. Apple and Android devices can because they have secure enclaves with the capability to do trusted analysis and attestation of fingerprints and photos, but no one else has the required technology and the required secure communication channels between the involved components.
  - currysausage 5y ago
    Are you sure? I'm pretty sure I can use my fingerprint for Outlook.com login through Chrome on Windows 10.
  - philistine 5y ago
    You’re wrong. Multiple vendors have what Apple calls a Secure Enclave. On PC, it’s called the Trusted Platform Module and somehow the whole PC crowd has decided that thing is unequivocally the road to fascism.
currysausage 5y ago
If it's FIDO2, then you don't actually expose biometrics to the site. The verification is done on device and unlocks a key saved in the TPM/secure enclave. Of course, once Face ID/Windows Hello logins on the web become a thing, web sites may trick users into enabling their regular camera instead, for whatever reason.

jolux 5y ago

Actually Apple does support using Touch ID and Face ID for WebAuthn on their platforms, it even works in Chrome.

judge2020 5y ago

You can try it currently - set an iOS device as a development target in Xcode, go to the iOS developer menu (settings->developer) and turn on the passkey option[0]. Then, on a desktop or laptop with Bluetooth and in a Chromium-based browser, attempt to enroll a security key on a website that supports Webauthn - Chrome will popup the prompt to "add a new Android device", which will then show a QR code that you can scan on your iOS device. It'll prompt you to enroll a security key with the text about "save a passkey for this account in iCloud Keychain"[1]. In reality, all it does is create and sync fresh security key private keys for use across devices, with interoperability over BLE so it's easier to use them even if you don't have an expensive iMac. 0: https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys https://developer.apple.com/documentation/authenticationserv... 1: https://photos.app.goo.gl/5LwhDsXbWg4yb6326 https://photos.app.goo.gl/5LwhDsXbWg4yb6326

_wldu 5y ago

Yubikeys are awesome. I have a copy of a signing only PGP key on a Yubikey and I use it to sign all of my git commits. Easy and very secure. Cheap too.

jml7c5 5y ago
>Cheap too. Doesn't it cost $45? There's the FIDO one that's less expensive, but I thought it couldn't be used for signing commits.

merb 5y ago

> Just look at how the big FANG companies managed to adopt OpenID and yet made it so that it can't be used to authenticate users between them. They never liked identity federation because it would mean not controlling the user's identity completely. Google loves identity standards as long as Google is the one and only party doing the authenticating. Same with Microsoft. Apple for sure is not going to let anyone do anything that matters on their platforms. actually OpenID Connect 1.0 - the thing that most companies use (like google, apple, microsoft) actually does not yet support Federation. OpenID Connect is basically a little bit more than OAuth2 (which was never about Federation) Of course there is a draft spec about federation: https://openid.net/specs/openid-connect-federation-1_0.html https://openid.net/specs/openid-connect-federation-1_0.html (unfortunatly only microsoft is included and not google), there is also: https://openid.net/specs/openid-connect-self-issued-v2-1_0.html https://openid.net/specs/openid-connect-self-issued-v2-1_0.h... (also only a draft one...) but I'm pretty sure that both will probably allow the usage of federation at one point - at least for Commercial entities. Because Google Cloud Identity actually supports SCIM 2.0 and upstream OpenID Connect IdP's or SAML2 (https://cloud.google.com/architecture/identity/keycloak-single-sign-on?hl=de https://cloud.google.com/architecture/identity/keycloak-sing...). the original OpenID Authentication spec was about federatation, but barley nobody implemented it. (I can only think about StackOverflow (which dropped it in 2018) and something at RedHat/Fedora - can't remember?)