3 ms·

This seems a bit odd to me - is setting up WebAuthn in your main backend so hard that an external service like this for validating credentials is required?

• cormacrelf 4y ago
  Quoting the docs: it’s “WebAuthn - without reading the w3c spec”. So apparently yes. It does seem very silly that this has to be a third party service instead of open source code you just plug in to Rails or whatever. I guess they had to find some way to get paid for all the expertise they accumulated. Stuff running on external servers is the way tech companies as a whole have decided to remunerate work like that, and now everything looks like a nail. I note that since logging in is such a crucial part of online business, running consulting around open source software would appear to be a a good model. That’s what the people behind the C# OAuth2/OpenID code known as IdentityServer do.
• 9dev 4y ago
  I recently implemented WebAuthn for a toy project, and while it took a bit to wrap my head around the details, it’s fairly straightforward if you know the problem domain a bit. I’d say we’re going to see polished libraries soon that will abstract all the details away, but services like this may help less experienced developers to quickly get secure auth working.