5 ms·

This is wonderful news! If anyone is interested in experimenting we built an API that makes it very simple to add WebAuthn (passkeys) to your existing web app.

by dyml 4y ago

This is wonderful news! If anyone is interested in experimenting we built an API that makes it very simple to add WebAuthn (passkeys) to your existing web app. It’s available at https://passwordless.dev https://passwordless.dev Note: We also maintain the open source fido2-net-lib, the API just lowers the friction for devs.

smorks 4y ago
i use fido2-net-lib for a personal auth site, it works great! thanks for all your work!
- dyml 4y ago
  Hey! Happy to hear Making this tech available has been our goal since inception
dorianmariefr 4y ago
I've used this gem for rails apps https://github.com/cedarcode/webauthn-ruby https://github.com/cedarcode/webauthn-ruby
ashtonbaker 4y ago
This is really cool! And well-timed - I have a project coming up this would be perfect for. The only thing I wonder is, if a user didn’t have biometrics on their device, how would they authenticate? Would I have to maintain a backup system for these users?
- judge2020 4y ago
  In general they just need _something_. If Windows Hello has even a pin number, Chrome and FF webauthn prompts will use Windows Hello as a TPM provider (assuming the website is using actual Webauthn and not the older U2F-compatible standard, which some sites still use for compatibility, eg google). If they don't have anything, then they will definitely need at least a usb hardware key.
- dyml 4y ago
  Biometrics are not needed, however device support is not 100%. If the user is not running a model OS they could still be supported by using what is known as a security key (yubico) etc. The Passwordless API can also help with out of band authentication (using a iOS device to sign in on unsupported old laptop)
lostfocus 4y ago
You might at least want to put a warning there for people who access the page with unsupported browsers? There's nothing on the left of "⬅ Go ahead... click it." for me.
- dyml 4y ago
  Good idea, thanks!

by dyml 4y ago

smorks 4y ago

i use fido2-net-lib for a personal auth site, it works great! thanks for all your work!

dyml 4y ago
Hey! Happy to hear Making this tech available has been our goal since inception

dorianmariefr 4y ago

I've used this gem for rails apps https://github.com/cedarcode/webauthn-ruby https://github.com/cedarcode/webauthn-ruby

ashtonbaker 4y ago

This is really cool! And well-timed - I have a project coming up this would be perfect for. The only thing I wonder is, if a user didn’t have biometrics on their device, how would they authenticate? Would I have to maintain a backup system for these users?

judge2020 4y ago
In general they just need _something_. If Windows Hello has even a pin number, Chrome and FF webauthn prompts will use Windows Hello as a TPM provider (assuming the website is using actual Webauthn and not the older U2F-compatible standard, which some sites still use for compatibility, eg google). If they don't have anything, then they will definitely need at least a usb hardware key.
dyml 4y ago
Biometrics are not needed, however device support is not 100%. If the user is not running a model OS they could still be supported by using what is known as a security key (yubico) etc. The Passwordless API can also help with out of band authentication (using a iOS device to sign in on unsupported old laptop)

lostfocus 4y ago

You might at least want to put a warning there for people who access the page with unsupported browsers? There's nothing on the left of "⬅ Go ahead... click it." for me.

dyml 4y ago
Good idea, thanks!