4 ms·

> What's my basic authentication method to a site or system I can write down, backup, export or memorize? There isn't one. This is by design. Logging into your

by p-e-w 4y ago

> What's my basic authentication method to a site or system I can write down, backup, export or memorize? There isn't one. This is by design. Logging into your bank or email provider will in the future require mobile device shenanigans that are either proprietary or so complex and opaque that you have no chance of "controlling" anything, or even really understanding what's actually going on. The main lobby driving this forward consists of Google, Apple, and Microsoft. This should tell you all you need to know.

stetrain 4y ago
Which part of passkeys / Webauthn / FIDO requires a mobile device?
- p-e-w 4y ago
  In principle, none. In practice, many websites will check the user agent and flat out refuse service unless it's one of a pre-approved list of implementations, regardless of whether it would work or not. This has been happening for a long, long time already, for many browser features, and such "standards" pushed forward by the major mobile vendors will only make the problem worse.
  - stetrain 4y ago
    Well if we're making up things that websites haven't done yet then yeah I'm angry too.
- ajvs 4y ago
  Unless you're using one of the proprietary desktop OSes then you have to use one of the proprietary mobile OSes. https://developers.google.com/identity/passkeys/supported-environments#linux https://developers.google.com/identity/passkeys/supported-en...
  - stetrain 4y ago
    Assuming desktop Chrome doesn’t support third party password managers like 1Password and Lastpass that are similarly part of the FIDO alliance. Passkeys aren’t a Chrome feature they’re a Webauthn feature. So if Chrome doesn’t provide the features you want on your platform you should be able to use another browser / password manager combo that does.
  - psanford 4y ago
    No you do not need to use anything proprietary to use WebAuthn. There are open source software[0] and hardware keys[1]. [0]: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido [1]: https://solokeys.com/ https://solokeys.com/
    - codedokode 4y ago
      WebAuthn supports attestation of key storage and site owners might choose not to trust keys coming from an unknown DIY device.
      - psanford 4y ago
        Fortunately that feature isn't used outside of enterprise environments. Apple's passkeys don't support it so there will not be any mainstream adoption for requiring an attestation cert.
mynameisvlad 4y ago
What part of WebAuthn, a W3C standard, is "proprietary or [...] complex and opaque"? The FIDO alliance also consists of far more companies than just "Google, Apple, and Microsoft", although they're certainly members. https://fidoalliance.org/members/ https://fidoalliance.org/members/
- p-e-w 4y ago
  > What part of WebAuthn, a W3C standard, is "proprietary or [...] complex and opaque"? Ask Mozilla. FIDO U2F is so complicated that Firefox support was hidden behind a config flag for a long time, then "a hard-coded permission for Google Accounts"[1] was implemented in order to not fall too far behind Chrome. The linked email thread is an eye-opener on how many intricacies and unresolved questions there are, with multiple mentions of non-standard behavior implemented in the Google ecosystem, undermining WebAuthn. This is how such "standards" work in practice, and passkeys will be no exception. [1] https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGTEA/m/lC834665BQAJ https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGT...
  - mynameisvlad 4y ago
    FIDO U2F is not WebAuthn, and if you had even bothered to skim the link you provided, you probably would have realized that considering: - they go out of their way to explicitly differentiate them, and - the entire discussion is about U2F and bringing in support for it in a limited sense so that people adopt WebAuthn instead of U2F. Like, did you even read the link you provided? So, again, what about WebAuthn is proprietary or complicated?
    - p-e-w 4y ago
      I'm not claiming they're the same. What matters is that U2F is what many websites implemented, which is why those problems arose in the first place. This time, websites will implement "Chrome passkeys", which will be almost-but-not-quite WebAuthn, just like Internet Explorer's box model was almost-but-not-quite CSS. If there are only two or three major players and the standard is sufficiently complex, "standard" becomes synonymous with "what iOS and Android do". But to answer your question: > So, again, what about WebAuthn is proprietary or complicated? The WebAuthn standard is 184 pages of A4 size. That's a technical document, the length of a typical novel. Are you seriously asking what's "complicated" about that?

by p-e-w 4y ago

stetrain 4y ago

Which part of passkeys / Webauthn / FIDO requires a mobile device?

p-e-w 4y ago
In principle, none. In practice, many websites will check the user agent and flat out refuse service unless it's one of a pre-approved list of implementations, regardless of whether it would work or not. This has been happening for a long, long time already, for many browser features, and such "standards" pushed forward by the major mobile vendors will only make the problem worse.
- stetrain 4y ago
  Well if we're making up things that websites haven't done yet then yeah I'm angry too.
ajvs 4y ago
Unless you're using one of the proprietary desktop OSes then you have to use one of the proprietary mobile OSes. https://developers.google.com/identity/passkeys/supported-environments#linux https://developers.google.com/identity/passkeys/supported-en...
- stetrain 4y ago
  Assuming desktop Chrome doesn’t support third party password managers like 1Password and Lastpass that are similarly part of the FIDO alliance. Passkeys aren’t a Chrome feature they’re a Webauthn feature. So if Chrome doesn’t provide the features you want on your platform you should be able to use another browser / password manager combo that does.
- psanford 4y ago
  No you do not need to use anything proprietary to use WebAuthn. There are open source software[0] and hardware keys[1]. [0]: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido [1]: https://solokeys.com/ https://solokeys.com/
  - codedokode 4y ago
    WebAuthn supports attestation of key storage and site owners might choose not to trust keys coming from an unknown DIY device.
    - psanford 4y ago
      Fortunately that feature isn't used outside of enterprise environments. Apple's passkeys don't support it so there will not be any mainstream adoption for requiring an attestation cert.

mynameisvlad 4y ago

What part of WebAuthn, a W3C standard, is "proprietary or [...] complex and opaque"? The FIDO alliance also consists of far more companies than just "Google, Apple, and Microsoft", although they're certainly members. https://fidoalliance.org/members/ https://fidoalliance.org/members/

p-e-w 4y ago
> What part of WebAuthn, a W3C standard, is "proprietary or [...] complex and opaque"? Ask Mozilla. FIDO U2F is so complicated that Firefox support was hidden behind a config flag for a long time, then "a hard-coded permission for Google Accounts"[1] was implemented in order to not fall too far behind Chrome. The linked email thread is an eye-opener on how many intricacies and unresolved questions there are, with multiple mentions of non-standard behavior implemented in the Google ecosystem, undermining WebAuthn. This is how such "standards" work in practice, and passkeys will be no exception. [1] https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGTEA/m/lC834665BQAJ https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGT...
- mynameisvlad 4y ago
  FIDO U2F is not WebAuthn, and if you had even bothered to skim the link you provided, you probably would have realized that considering: - they go out of their way to explicitly differentiate them, and - the entire discussion is about U2F and bringing in support for it in a limited sense so that people adopt WebAuthn instead of U2F. Like, did you even read the link you provided? So, again, what about WebAuthn is proprietary or complicated?
  - p-e-w 4y ago
    I'm not claiming they're the same. What matters is that U2F is what many websites implemented, which is why those problems arose in the first place. This time, websites will implement "Chrome passkeys", which will be almost-but-not-quite WebAuthn, just like Internet Explorer's box model was almost-but-not-quite CSS. If there are only two or three major players and the standard is sufficiently complex, "standard" becomes synonymous with "what iOS and Android do". But to answer your question: > So, again, what about WebAuthn is proprietary or complicated? The WebAuthn standard is 184 pages of A4 size. That's a technical document, the length of a typical novel. Are you seriously asking what's "complicated" about that?