3 ms·
TOTP/HOTP is phishable. Webauthn is not. > Until open source, free roaming, implementations of passkeys exist that expose the private key to the end user, it's
by psanford 4y ago
TOTP/HOTP is phishable. Webauthn is not.
> Until open source, free roaming, implementations of passkeys exist that expose the private key to the end user, it's effectively a locked-in ecosystem.
As I said above, there already are free implementations of FIDO keys that give you control over the keys.
- knaik94 4y agoFor Webauthn, Recoverability is still an open issue of ongoing research. From these issues [2], Webauthn having inbuilt recovery is out of scope. In fact a mobile phone becomes a single point of failure and unlike with 2FA, and with the likely requirement of attestation I don't know if free implementations of FIDO keys would be allowed. [3] This limitation was known and was considered out of scope since 2018. Webauthn can only be considered impossible to phish if companies completely remove the ability to log in with a password and TOTP. https://github.com/w3c/webauthn/issues/1640 https://github.com/w3c/webauthn/issues/1640 [2] https://github.com/w3c/webauthn/issues/931 https://github.com/w3c/webauthn/issues/931 [3] https://github.com/w3c/webauthn/issues/865 https://github.com/w3c/webauthn/issues/865
- psanford 4y agoAttestation is not a likely requirement. Apple doesn't support it for their implementation of passkeys so it won't see any mainstream adoption. This matches with how WebAuthn has been rolled out by early adopters. Virtually no public services that support WebAuthn require attestation.