4 ms·
I’ve actually seriously been thinking of using WebAuthn to “authenticate” every single page load with a passkey unlocked by a biometric device only, so that I c
by _1tem 2y ago
I’ve actually seriously been thinking of using WebAuthn to “authenticate” every single page load with a passkey unlocked by a biometric device only, so that I can be sure that every single page load had a meat finger on TouchID or a meat face in front of FaceID before showing the page to them.
In the future I imagine that there will be biometrically secure browsers that will be required for top security applications, that can guarantee that a single physical person is actually physically present while using it.
- hamandcheese 2y agoCouldn't someone just write a software key that lies and says it's biometric? AFAIK end-to-end manufacturer attestation isn't part of the spec (yet...).
- KomoD 2y agoThere's even an emulator built in to Chrome Dev Tools -> 3 dots -> More tools -> WebAuthn -> Enable virtual authenticator environment
- _1tem 2y agoAttestation statements can be used to restrict WebAuthn use to certain hardware keys only.
- hamandcheese 2y agoBut is there a chain of trust going all the way back to the manufacturer? Or is that simply metadata which could be spoofed?
- gruez 2y agoYes. That's what attestation is for.
- dyml 2y agoPlease don’t use WebAuthn on every page load. Two reasons: the protocol is not designed to do this - and the UI/UX is not designed to support this. There are better ways. 2) it will likely not work. There are virtual/software authenticatators (available in dev tools) that could generate a valid response without a human.
- jeroenhd 2y agoFWIW using WebAuthn to start a session, set up a cookie, and validating that cookie to get access seems like a pretty usable pattern. Not much more invasive than the "checking your connection" screen Cloudflare likes to throw.
- threatofrain 2y agoWebauthn doesn't reveal if someone's a human and you can't see whether they used FaceID or whatever, and once someone proves they're human you should just give then a session token.
- _1tem 2y agoBut I believe there is a spoof-proof way to accept hardware keys only? Limit yourself to known good hardware manufacturers and you should be good.
- jeroenhd 2y agoThat'll just exclude most of your visitors. The visitors you're not refusing are using TPMs or secure elements you can't trust anyway because of a long history of side channel attacks for "known-good" hardware manufacturers.
- Aachen 2y agoThat sounds awful. From there it's a miniscule step to actually needing to authenticate with every website, like a cookie you can't erase if you want to continue using the internet
- rmbyrro 2y agoC'mon folks, PNG? Webauthn on every page? If we're talking lunars, why don't you print posters and distribute physically in your neighborhood? 100% bot safe & "meat finger" guarantee.
- jeroenhd 2y agoWebAuthn doesn't work the way you think it does. Most computers don't have fingerprint readers or even webcams, let alone webcams capable of verifying a user. Instead, you'll end up making people type in their Windows password or scanning QR codes. Remote attestation concepts already exists to solve this problem: https://httptoolkit.com/blog/apple-private-access-tokens-attestation/ https://httptoolkit.com/blog/apple-private-access-tokens-att... Cloudflare ran an experiment with it, and I think Apple and Cloudflare are working to make it into a proper RFC. It's only a matter of time before other browsers will support it too with the way things are going right now.