4 ms·

What part of WebAuthn, a W3C standard, is "proprietary or [...] complex and opaque"? The FIDO alliance also consists of far more companies than just "Google, A

What part of WebAuthn, a W3C standard, is "proprietary or [...] complex and opaque"? The FIDO alliance also consists of far more companies than just "Google, Apple, and Microsoft", although they're certainly members. https://fidoalliance.org/members/ https://fidoalliance.org/members/

p-e-w 4y ago
> What part of WebAuthn, a W3C standard, is "proprietary or [...] complex and opaque"? Ask Mozilla. FIDO U2F is so complicated that Firefox support was hidden behind a config flag for a long time, then "a hard-coded permission for Google Accounts"[1] was implemented in order to not fall too far behind Chrome. The linked email thread is an eye-opener on how many intricacies and unresolved questions there are, with multiple mentions of non-standard behavior implemented in the Google ecosystem, undermining WebAuthn. This is how such "standards" work in practice, and passkeys will be no exception. [1] https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGTEA/m/lC834665BQAJ https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGT...
- mynameisvlad 4y ago
  FIDO U2F is not WebAuthn, and if you had even bothered to skim the link you provided, you probably would have realized that considering: - they go out of their way to explicitly differentiate them, and - the entire discussion is about U2F and bringing in support for it in a limited sense so that people adopt WebAuthn instead of U2F. Like, did you even read the link you provided? So, again, what about WebAuthn is proprietary or complicated?
  - p-e-w 4y ago
    I'm not claiming they're the same. What matters is that U2F is what many websites implemented, which is why those problems arose in the first place. This time, websites will implement "Chrome passkeys", which will be almost-but-not-quite WebAuthn, just like Internet Explorer's box model was almost-but-not-quite CSS. If there are only two or three major players and the standard is sufficiently complex, "standard" becomes synonymous with "what iOS and Android do". But to answer your question: > So, again, what about WebAuthn is proprietary or complicated? The WebAuthn standard is 184 pages of A4 size. That's a technical document, the length of a typical novel. Are you seriously asking what's "complicated" about that?
    - mynameisvlad 4y ago
      U2F has nothing to do with WebAuthn. You bringing it up is literal whataboutism. We aren’t talking about it, we are talking about a completely different technology. What about WebAuthn, explicitly, is complicated for you to understand? What about it is not a web standard that can be implemented in many different ways? Furthermore, HTTP 1.1 is 174 pages, yet Firefox was able to implement it. Standards are, generally speaking, technical documents. Because that is what guarantees interoperability, that thing you are so vehemently defending. Chrome passkeys are WebAuthn. Period. Fin. End of story. There is no separate implementation, they are the same thing. It is a standard that anyone can implement on either side that is inter compatible with whatever implementation is used. What part of this do you not understand?
      - cormacrelf 4y ago
        I think they think that Google/Apple/Microsoft are deliberately creating dense standards so that nobody else has the technical means to implement them. The evidence presented was that one of these (U2F?) took a long time for Firefox to implement. Just a little note to dispel all this BS in one swoop: Firefox was the first browser to implement WebAuthn. https://blog.mozilla.org/blog/2018/05/09/firefox-gets-down-to-business-and-its-personal/ https://blog.mozilla.org/blog/2018/05/09/firefox-gets-down-t...
      - codedokode 4y ago
        > It is a standard that anyone can implement WebAuthn supports attestation of a key storage device. How are you going to persuade site owners to trust your self-signed attestation certificate?
        mynameisvlad 4y ago
        Ask the folks over at SoloKeys, who are both open source and FIDO certified. It also supports it. Whether it’s enforced is a site owner’s decision, as are the trusted roots they use. If a site owner wants to limit to only a single type of authenticator, they can already do that by only trusting its key, so I don’t see how that’s relevant to the topic of implementing the standard.
pas 4y ago
it's certainly complex! https://webauthn.guide/ https://webauthn.guide/ challenge, attestation, rp, alg -7!? usb, ble, nfc!? it seems very easy to "hold it wrong" :) and if you add u2f-fido to the mix, which is how most people so far saw webauthn in practice, it's even more complex. it took me a lot of time to figure out what actually happens when I tap the security key. do I have one keypair? no, actually I have a lot, one for each site, but the site stores it in a clever encrypted encoded scheme.

p-e-w 4y ago

> What part of WebAuthn, a W3C standard, is "proprietary or [...] complex and opaque"? Ask Mozilla. FIDO U2F is so complicated that Firefox support was hidden behind a config flag for a long time, then "a hard-coded permission for Google Accounts"[1] was implemented in order to not fall too far behind Chrome. The linked email thread is an eye-opener on how many intricacies and unresolved questions there are, with multiple mentions of non-standard behavior implemented in the Google ecosystem, undermining WebAuthn. This is how such "standards" work in practice, and passkeys will be no exception. [1] https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGTEA/m/lC834665BQAJ https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGT...

mynameisvlad 4y ago
FIDO U2F is not WebAuthn, and if you had even bothered to skim the link you provided, you probably would have realized that considering: - they go out of their way to explicitly differentiate them, and - the entire discussion is about U2F and bringing in support for it in a limited sense so that people adopt WebAuthn instead of U2F. Like, did you even read the link you provided? So, again, what about WebAuthn is proprietary or complicated?
- p-e-w 4y ago
  I'm not claiming they're the same. What matters is that U2F is what many websites implemented, which is why those problems arose in the first place. This time, websites will implement "Chrome passkeys", which will be almost-but-not-quite WebAuthn, just like Internet Explorer's box model was almost-but-not-quite CSS. If there are only two or three major players and the standard is sufficiently complex, "standard" becomes synonymous with "what iOS and Android do". But to answer your question: > So, again, what about WebAuthn is proprietary or complicated? The WebAuthn standard is 184 pages of A4 size. That's a technical document, the length of a typical novel. Are you seriously asking what's "complicated" about that?
  - mynameisvlad 4y ago
    U2F has nothing to do with WebAuthn. You bringing it up is literal whataboutism. We aren’t talking about it, we are talking about a completely different technology. What about WebAuthn, explicitly, is complicated for you to understand? What about it is not a web standard that can be implemented in many different ways? Furthermore, HTTP 1.1 is 174 pages, yet Firefox was able to implement it. Standards are, generally speaking, technical documents. Because that is what guarantees interoperability, that thing you are so vehemently defending. Chrome passkeys are WebAuthn. Period. Fin. End of story. There is no separate implementation, they are the same thing. It is a standard that anyone can implement on either side that is inter compatible with whatever implementation is used. What part of this do you not understand?
    - cormacrelf 4y ago
      I think they think that Google/Apple/Microsoft are deliberately creating dense standards so that nobody else has the technical means to implement them. The evidence presented was that one of these (U2F?) took a long time for Firefox to implement. Just a little note to dispel all this BS in one swoop: Firefox was the first browser to implement WebAuthn. https://blog.mozilla.org/blog/2018/05/09/firefox-gets-down-to-business-and-its-personal/ https://blog.mozilla.org/blog/2018/05/09/firefox-gets-down-t...
    - codedokode 4y ago
      > It is a standard that anyone can implement WebAuthn supports attestation of a key storage device. How are you going to persuade site owners to trust your self-signed attestation certificate?
      - mynameisvlad 4y ago
        Ask the folks over at SoloKeys, who are both open source and FIDO certified. It also supports it. Whether it’s enforced is a site owner’s decision, as are the trusted roots they use. If a site owner wants to limit to only a single type of authenticator, they can already do that by only trusting its key, so I don’t see how that’s relevant to the topic of implementing the standard.

pas 4y ago

it's certainly complex! https://webauthn.guide/ https://webauthn.guide/ challenge, attestation, rp, alg -7!? usb, ble, nfc!? it seems very easy to "hold it wrong" :) and if you add u2f-fido to the mix, which is how most people so far saw webauthn in practice, it's even more complex. it took me a lot of time to figure out what actually happens when I tap the security key. do I have one keypair? no, actually I have a lot, one for each site, but the site stores it in a clever encrypted encoded scheme.