5 ms·

I'm not a huge fan of removing the 'two' from 'two factor authentication'. If people can login with just their device, which could be stolen, I don't think it's

I'm not a huge fan of removing the 'two' from 'two factor authentication'. If people can login with just their device, which could be stolen, I don't think it's as secure as a password+device based 2FA alternative

turnsout 3y ago
On Apple platforms, a biometric authentication is required to proceed with webauthn, so technically it is 2FA (something you have and something you are).
- endofreach 3y ago
  Which is awesome, but worthless, if others don‘t follow.
  - turnsout 3y ago
    Well all the major browsers are on board—it’s really in the hands of the dev/product community now.
    - endofreach 3y ago
      Ok, i thought that only Apple uses biometric ID. Then: it‘s just awesome.
jameswestgate 3y ago
WebAuthn to either a a hardware key protected by a pin, or to a passkey protected by a biometric. Both definitely qualify as 2FA
- watermelon0 3y ago
  But there is no password, so we are back to 1FA, with Passkey being the single factor. This is similar to using password manager, with the exception that malware cannot steal your keys ... however, if it's able to steal passwords from password manager, there is a good chance that malware can also access your browser's cookies.
  - flangola7 3y ago
    It is still 2FA. Something you have (passkey on a device) and something you are (LIDAR map of your face and pulse).
deleted 3y ago
[deleted]
bawolff 3y ago
From a practical standpoint, i dont really think it matters. The real threat 2fa auth solves is the fact people blame the site operator when they are hacked. 90% of the time it is due to reusing a password. The other 10% it is due to phishing. WebAuthn stops both. 2FA works not because it adds another factor, but because it removes choice from the user so they can't screw it up.
- MattPalmer1086 3y ago
  Interesting take on 2FA. The user not being able to screw up is of course important, but the second factor (something you have) works primarily because it is tied to something physical and therefore local to the user, which is not subject to remote attacks.
  - markkitti 3y ago
    Here's the concept. Perhaps we have the order wrong. Maybe the physical factor should be the primary factor. The second factor should never be transmitted, but rather is used to unlock the physical factor.
    - alwaysbeconsing 3y ago
      Requiring a password for a hardware key doesn't add much to the key already being in your pocket or locked in your house/office. It helps against an attack that's specifically targeting you as a person but it's basically just a nuisance for you when considering generalized account attacks.
      - ctoth 3y ago
        Not really part of what you said but this just caught my attention and I thought I'd ponder about it in public a bit. We used to think that > It helps against an attack that's specifically targeting you would be sufficient, because, like who cares about little old me? But in the era of API intelligence, setting up a specific agent to target every person seems automatable. If all that was missing before was a sufficiently-motivated attacker who would learn about you and your patterns, and that couldn't scale because we didn't have enough dedicated bad guys, that seems like it's a bout to change pretty quick.
Apreche 3y ago
Some people, who are not me, say that it's still two because they have to have the device but also have to be able to unlock the device.
- DangitBobby 3y ago
  Devices get snatched out of hands all the time.
  - drexlspivey 3y ago
    Even if they snatch it unlocked they still can’t login because there’s an extra biometrics check required for WebAuthn
    - SgtBastard 3y ago
      In at least Apple's case, Device PIN is also a factor to unlock the secure enclave where the passkeys are kept - so, assuming there's no stronger enforcement that it must use FaceID/TouchID, shoulder surfing a PIN unlock of the device and then swiping it grants access to all accounts.
- deleted 3y ago
  [deleted]
- vbezhenar 3y ago
  That makes sense (as long as device asks for PIN every time you use webauthn). Bank card uses the same logic: you present both card and PIN code and it counts as two factors.
- somat 3y ago
  I have heard arguments that using a password locked ssh key is two factor authentication for the same reason, that is, what you have(the ssh key) and what you know(the password to unlock it) However I am not convinced, I think it comes down to dependency of factors in the auth scheme, if one factor unlocks another factor there only really is one factor, all factors must independently lock.
iudqnolq 3y ago
I currently authenticate with my fingerprint to 1Password, which then autofills a random password and an OTP code. That fulfils my security needs, and I'm unwilling to migrate to something harder to use. Nearly everyone I know has less tolerance for annoying security than me, so I don't see how WebAuth can possibly succeed.

turnsout 3y ago

On Apple platforms, a biometric authentication is required to proceed with webauthn, so technically it is 2FA (something you have and something you are).

endofreach 3y ago
Which is awesome, but worthless, if others don‘t follow.
- turnsout 3y ago
  Well all the major browsers are on board—it’s really in the hands of the dev/product community now.
  - endofreach 3y ago
    Ok, i thought that only Apple uses biometric ID. Then: it‘s just awesome.

jameswestgate 3y ago

WebAuthn to either a a hardware key protected by a pin, or to a passkey protected by a biometric. Both definitely qualify as 2FA

watermelon0 3y ago
But there is no password, so we are back to 1FA, with Passkey being the single factor. This is similar to using password manager, with the exception that malware cannot steal your keys ... however, if it's able to steal passwords from password manager, there is a good chance that malware can also access your browser's cookies.
- flangola7 3y ago
  It is still 2FA. Something you have (passkey on a device) and something you are (LIDAR map of your face and pulse).

deleted 3y ago

[deleted]

bawolff 3y ago

From a practical standpoint, i dont really think it matters. The real threat 2fa auth solves is the fact people blame the site operator when they are hacked. 90% of the time it is due to reusing a password. The other 10% it is due to phishing. WebAuthn stops both. 2FA works not because it adds another factor, but because it removes choice from the user so they can't screw it up.

MattPalmer1086 3y ago
Interesting take on 2FA. The user not being able to screw up is of course important, but the second factor (something you have) works primarily because it is tied to something physical and therefore local to the user, which is not subject to remote attacks.
- markkitti 3y ago
  Here's the concept. Perhaps we have the order wrong. Maybe the physical factor should be the primary factor. The second factor should never be transmitted, but rather is used to unlock the physical factor.
  - alwaysbeconsing 3y ago
    Requiring a password for a hardware key doesn't add much to the key already being in your pocket or locked in your house/office. It helps against an attack that's specifically targeting you as a person but it's basically just a nuisance for you when considering generalized account attacks.
    - ctoth 3y ago
      Not really part of what you said but this just caught my attention and I thought I'd ponder about it in public a bit. We used to think that > It helps against an attack that's specifically targeting you would be sufficient, because, like who cares about little old me? But in the era of API intelligence, setting up a specific agent to target every person seems automatable. If all that was missing before was a sufficiently-motivated attacker who would learn about you and your patterns, and that couldn't scale because we didn't have enough dedicated bad guys, that seems like it's a bout to change pretty quick.

Apreche 3y ago

Some people, who are not me, say that it's still two because they have to have the device but also have to be able to unlock the device.

DangitBobby 3y ago
Devices get snatched out of hands all the time.
- drexlspivey 3y ago
  Even if they snatch it unlocked they still can’t login because there’s an extra biometrics check required for WebAuthn
  - SgtBastard 3y ago
    In at least Apple's case, Device PIN is also a factor to unlock the secure enclave where the passkeys are kept - so, assuming there's no stronger enforcement that it must use FaceID/TouchID, shoulder surfing a PIN unlock of the device and then swiping it grants access to all accounts.
deleted 3y ago
[deleted]
vbezhenar 3y ago
That makes sense (as long as device asks for PIN every time you use webauthn). Bank card uses the same logic: you present both card and PIN code and it counts as two factors.
somat 3y ago
I have heard arguments that using a password locked ssh key is two factor authentication for the same reason, that is, what you have(the ssh key) and what you know(the password to unlock it) However I am not convinced, I think it comes down to dependency of factors in the auth scheme, if one factor unlocks another factor there only really is one factor, all factors must independently lock.

iudqnolq 3y ago

I currently authenticate with my fingerprint to 1Password, which then autofills a random password and an OTP code. That fulfils my security needs, and I'm unwilling to migrate to something harder to use. Nearly everyone I know has less tolerance for annoying security than me, so I don't see how WebAuth can possibly succeed.