3 ms·

Nobody ever did the obvious thing of hooking this stuff up to biometric readers deployed by the billions in the form of phones using either photo recognition or

Nobody ever did the obvious thing of hooking this stuff up to biometric readers deployed by the billions in the form of phones using either photo recognition or finger print readers, laptop finger print readers, etc. Such an obvious thing to do. Never happened. What are Google and Apple waiting for? On Apple platforms, you can use webauthn with Touch ID and Face ID in Safari. For some reason it doesn't work on all sites (probably because they implement the older FIDO standard, not webauthn?). These passkey FIDO credentials mentioned on the linked post are also activated with Touch ID on macOS. I have passkey configured on one or two websites and I authanticate with Touch ID. (And still a password, but it's the first step.)

deleted 5y ago
[deleted]
number6 5y ago
> The only people I know that actually use that or know about it are developers. Never saw this used outside of the tech space. Even adoption af standart password managers is painfully slow.
- pmoriarty 5y ago
  "Even adoption af standart password managers is painfully slow." I am reluctant to use password managers on my phone because of the risk of my passwords being exfiltrated either by the app developer, by the OS manufacturer, or by whomever manages to hack in to my phone.
  - judge2020 5y ago
    The attack surfaces for desktops, even Linux desktops, is incredibly large in comparison to the phone. The only difference is that your concern of "the OS manufacturer" hacking your phone are lessened on Linux, assuming you're auditing all packages you download or are using a permission-based OS like Nix.
    - fragmede 5y ago
      what is it about curl | sudo bash that gives you pause about Linux desktop security?
Avamander 5y ago
> For some reason it doesn't work on all sites (probably because they implement the older FIDO standard, not webauthn?). Because Apple decided to improvise and added some broken and nonstandard "user interaction" requirement to Webauthn. With a whitelist for the big players.
- Ajedi32 5y ago
  That's part of the standard: https://www.w3.org/TR/webauthn-2/#user-verification https://www.w3.org/TR/webauthn-2/#user-verification There's no whitelist AFAIK. Or are you talking about something else?
  - Avamander 5y ago
    I'm speaking of the idiotic buggy DOM "User gesture"¹ being required, that's not part of the standard. User presence is a different thing. [1]: https://support.yubico.com/hc/en-us/articles/360022004600-No-reaction-when-using-WebAuthn-on-macOS-iOS-and-iPadOS https://support.yubico.com/hc/en-us/articles/360022004600-No...
    - dmitriid 5y ago
      It's not idiotic. It's to prevent automatic sign-ins, sign-in requests etc. especially from hidden iframes. "User must interact with page for features to become active" is a very common way to deal with quite a few things in various browsers, not just Safari.
      - Avamander 5y ago
        It is. There are many reasons why. 1. It's nonstandard, we need no more of that on the web. Also poorly documented. Also buggy. 2. There are way better methods, it could've been something akin to Media Engagement Index. 3. There's no "allow bypass" option. Wasting people's time unconditionally is idiotic. 4. This check applies to both Webauthn password-ed and passwordless with or without user presence. It makes no sense that the user must click a button to consent to being able to verify presence and then enter a PIN. 5. User gesture does not carry over to contexts where it's often needed. It breaks subpages like most login flows have, it does not carry properly between various JS callbacks, it does not carry over between multiple sites (for example to an SSO solution), it does not allow an easy way to reattempt authentication when something errors. It's so cumbersome and breaks so much without proper alternatives! 6. Large websites got an exception.

deleted 5y ago

[deleted]

number6 5y ago

> The only people I know that actually use that or know about it are developers. Never saw this used outside of the tech space. Even adoption af standart password managers is painfully slow.

pmoriarty 5y ago
"Even adoption af standart password managers is painfully slow." I am reluctant to use password managers on my phone because of the risk of my passwords being exfiltrated either by the app developer, by the OS manufacturer, or by whomever manages to hack in to my phone.
- judge2020 5y ago
  The attack surfaces for desktops, even Linux desktops, is incredibly large in comparison to the phone. The only difference is that your concern of "the OS manufacturer" hacking your phone are lessened on Linux, assuming you're auditing all packages you download or are using a permission-based OS like Nix.
  - fragmede 5y ago
    what is it about curl | sudo bash that gives you pause about Linux desktop security?

Avamander 5y ago

> For some reason it doesn't work on all sites (probably because they implement the older FIDO standard, not webauthn?). Because Apple decided to improvise and added some broken and nonstandard "user interaction" requirement to Webauthn. With a whitelist for the big players.

Ajedi32 5y ago
That's part of the standard: https://www.w3.org/TR/webauthn-2/#user-verification https://www.w3.org/TR/webauthn-2/#user-verification There's no whitelist AFAIK. Or are you talking about something else?
- Avamander 5y ago
  I'm speaking of the idiotic buggy DOM "User gesture"¹ being required, that's not part of the standard. User presence is a different thing. [1]: https://support.yubico.com/hc/en-us/articles/360022004600-No-reaction-when-using-WebAuthn-on-macOS-iOS-and-iPadOS https://support.yubico.com/hc/en-us/articles/360022004600-No...
  - dmitriid 5y ago
    It's not idiotic. It's to prevent automatic sign-ins, sign-in requests etc. especially from hidden iframes. "User must interact with page for features to become active" is a very common way to deal with quite a few things in various browsers, not just Safari.
    - Avamander 5y ago
      It is. There are many reasons why. 1. It's nonstandard, we need no more of that on the web. Also poorly documented. Also buggy. 2. There are way better methods, it could've been something akin to Media Engagement Index. 3. There's no "allow bypass" option. Wasting people's time unconditionally is idiotic. 4. This check applies to both Webauthn password-ed and passwordless with or without user presence. It makes no sense that the user must click a button to consent to being able to verify presence and then enter a PIN. 5. User gesture does not carry over to contexts where it's often needed. It breaks subpages like most login flows have, it does not carry properly between various JS callbacks, it does not carry over between multiple sites (for example to an SSO solution), it does not allow an easy way to reattempt authentication when something errors. It's so cumbersome and breaks so much without proper alternatives! 6. Large websites got an exception.