3 ms·

I think the biggest roadblock to widespread adoption outside major corporations is how complex they are to implement on the server side, in particular in compar

by donatj 3y ago

I think the biggest roadblock to widespread adoption outside major corporations is how complex they are to implement on the server side, in particular in comparison to passwords which are trivial. Every implementation I've seen so far has been multiple thousands of lines, whereas password auth can be done in several lines. Libraries will come for every major language in time, we'll see how easy it becomes to implement. I'm hopeful.

andix 3y ago
Safe password authentication is also not trivial to implement, especially not with a second factor. Let's hope even more people will use authentication frameworks created by experts, instead of some badly salted password databases.
teeray 3y ago
> Every implementation I've seen so far has been multiple thousands of lines… Libraries will come for every major language in time, we'll see how easy it becomes to implement. I'm hopeful. This becomes a liability for security when everyone becomes a user and very few people are contributing. OpenSSL has been an example of this in the past.
aseipp 3y ago
> whereas password auth can be done in several lines. Secure password auth is complex and because of externally imposed constraints like phishing, generally needs more work to support. You also need recovery flows, etc, since just losing access typically isn't acceptable. So I don't think password auth can really be "done in several lines." Realistically, I think the takeaway is that no matter what you're talking about, storing private material on behalf of someone sucks complete ass, and is not easy to accomplish on a modern computer in a secure manner, no matter how you slice it. But we still have to do it. Luckily Passkeys do have actual tangible benefits beyond passwords (e.g. unphishable, no private key material stored by the server), so getting this right does come with actual benefits beyond the status quo.
dwaite 3y ago
A webauthn library will likely support things which you don't need for simply accepting passkeys, such as attestations and extension support. A minimal implementation can be dramatically simpler; the problem comes in conveying to an application developer what their requirements are for implementing the minimal flow.

by donatj 3y ago

andix 3y ago

Safe password authentication is also not trivial to implement, especially not with a second factor. Let's hope even more people will use authentication frameworks created by experts, instead of some badly salted password databases.

teeray 3y ago

> Every implementation I've seen so far has been multiple thousands of lines… Libraries will come for every major language in time, we'll see how easy it becomes to implement. I'm hopeful. This becomes a liability for security when everyone becomes a user and very few people are contributing. OpenSSL has been an example of this in the past.

aseipp 3y ago

> whereas password auth can be done in several lines. Secure password auth is complex and because of externally imposed constraints like phishing, generally needs more work to support. You also need recovery flows, etc, since just losing access typically isn't acceptable. So I don't think password auth can really be "done in several lines." Realistically, I think the takeaway is that no matter what you're talking about, storing private material on behalf of someone sucks complete ass, and is not easy to accomplish on a modern computer in a secure manner, no matter how you slice it. But we still have to do it. Luckily Passkeys do have actual tangible benefits beyond passwords (e.g. unphishable, no private key material stored by the server), so getting this right does come with actual benefits beyond the status quo.

dwaite 3y ago

A webauthn library will likely support things which you don't need for simply accepting passkeys, such as attestations and extension support. A minimal implementation can be dramatically simpler; the problem comes in conveying to an application developer what their requirements are for implementing the minimal flow.