2 ms·
If I want a user login mechanism that's tied to a single machine, where the credentials are partitioned per-site, access is controlled by the OS login mechanism
by michaelt 4y ago
If I want a user login mechanism that's tied to a single machine, where the credentials are partitioned per-site, access is controlled by the OS login mechanism, and I don't need protection against a compromised OS or the user choosing to copy their secrets between machines - isn't that just cookies?
- FreakLegion 4y agoYou're absolutely right that correctly configured cookies enjoy a protection that passwords don't: The browser won't send them to the wrong place, same as in WebAuthn. On that basis I'm sure we could come up with a cookie-based scheme that solves a lot of problems, too. It wouldn't be as strong as WebAuthn (even in software -- TPMs aren't the only protection against a compromised OS, and software authenticators can still do plenty to defend themselves), but it wouldn't need to be to have enormous value.
- pabs3 4y agoI'm pretty sure WebAuthn still needs session cookies too, since you only login once, not with every request like TLS client certs or HTTP Basic Auth.