4 ms·

> If anyone in the comments doesn't like the implementation of webauthn, suggest changes to the spec Rip out resident keys altogether. They aren't needed. You

by crote 2y ago

> If anyone in the comments doesn't like the implementation of webauthn, suggest changes to the spec Rip out resident keys altogether. They aren't needed. You can get 99.9% of the benefits of Passkeys by using non-resident keys - literally the only drawback is that you'd need to enter a username. Resident keys essentially kill physical tokens. Without resident keys a $10 token can support thousands of websites. With resident keys? A couple dozen, if you're lucky.

the_svd_doctor 2y ago
> Resident keys essentially kill physical tokens. Can you elaborate? I'm curious. Is there a storage problem?
- vaylian 2y ago
  Yes, exactly. Resident keys take up storage space. This article that was updated 5 months ago says that the most recent yubikey can support up to 100 discoverable credentials: https://support.yubico.com/hc/en-us/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with https://support.yubico.com/hc/en-us/articles/360013790319-Ho... That might sound like a lot, but given that we want to achieve a migration to passwordless across the internet, you will quickly run out of storage space if every shop on the internet wants a dedicated keypair on your device. Non-resident keys are so much better, because you won't need to worry about this limitation.
MarkMarine 2y ago
Again, ya’ll are living in a different world. Passkeys doesn’t have to support your use case, you’ve already got FIDO 2 keys for this. Physical keys have been readily available for over a decade from yubikey and the market penetration for consumers is basically zero.
- vaylian 2y ago
  I understand your enthusiasm for passkeys and I think there are real benefits, especially for non-technical users. But likewise, there is also enthusiasm for the objectively more secure hardware tokens. Residential keys are a problem for hardware tokens. So yes, we are living in different worlds. But what we all want is to migrate to more secure authentication methods. And pushing non-residential keys to the wayside just for the convenience of not needing to remember user names feels like a bad trade-off.
  - MarkMarine 2y ago
    It's not just needing to remember user names, is everyone in this thread just willfully ignoring what I've been saying about needing multiple (privacy incompatible) channels of data to be able to trust these login methods that aren't passkeys?
    - vaylian 2y ago
      > everyone in this thread just willfully ignoring what I've been saying about needing multiple (privacy incompatible) channels of data to be able to trust these login methods that aren't passkeys? I have reread your top post a few times and I think I'm starting to understand your point. To highlight the core part: > State of the art in industry is basically trying to understand every action that is happening on a device I wasn't aware that this is happening. And I can understand why fintech companies engage in this invasive practice. However, I never used SMS as a second factor, because I know that it is unsafe. I use hardware tokens, because I care about security. I know that many people do not care about security and it is your job to catch them before they do something stupid. I understand why you like passkeys so much. But the original point remains: Resident keys are not necessary. Big tech is propagating resident keys. But they could easily use non-resident keys and offer remembering the usernames for the different sites like password managers do it today. It would be an easy win for everyone.
      - MarkMarine 2y ago
        I understand your point, and I’ve thought a lot about that after discussing it here. I actually prefer the resident keys from my side because I can really trust the device is the device, so I don’t need all that data stream about it. That said, I’m going to make sure I support hardware tokens in my system. My goals are just protecting my user base from fraud and giving them an easy way to login securely. You would probably be shocked at the volume of support calls we get about logging in. It’s 30-40% of the call volume. Easy for a scammer to slip into that stream as well.
- lxgr 2y ago
  So, ruin a thing that works for a few people (and arguably was the primary target of the spec before big tech essentially took it over) for no reason other than marginal relying party convenience? The only thing needed to preserve their utility would be a minimal rewording (e.g. change “preferred” to “possible” or add a “preferred-if-unlimited-storage” for ResidentKeyRequirement), and a requirement of relying parties to add a username field as a fallback.
comex 2y ago
> With resident keys? A couple dozen, if you're lucky. Or, future tokens start bundling a bit of flash storage and make this a non-issue. Considering how cheap it is, that ought to be possible even for low-cost tokens.
- vaylian 2y ago
  You still need to allocate physical space for 1) the cryptographic circuitry of the token 2) the tamperproof and stress-resistant enclosure. Depending on the form factor, you might not have that much physical space left for storage. The physical requirements for a token are much more complex than a plain USB drive.
  - xescure 2y ago
    Google’s security key can already support 250 resident keys. I’m not sure how secure it is compared to Yubikeys, but it can’t be that far behind.
gre345t34 2y ago
Ideally you should not be able to determine whether a username is valid without authenticating.

by crote 2y ago

the_svd_doctor 2y ago

> Resident keys essentially kill physical tokens. Can you elaborate? I'm curious. Is there a storage problem?

vaylian 2y ago
Yes, exactly. Resident keys take up storage space. This article that was updated 5 months ago says that the most recent yubikey can support up to 100 discoverable credentials: https://support.yubico.com/hc/en-us/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with https://support.yubico.com/hc/en-us/articles/360013790319-Ho... That might sound like a lot, but given that we want to achieve a migration to passwordless across the internet, you will quickly run out of storage space if every shop on the internet wants a dedicated keypair on your device. Non-resident keys are so much better, because you won't need to worry about this limitation.

MarkMarine 2y ago

Again, ya’ll are living in a different world. Passkeys doesn’t have to support your use case, you’ve already got FIDO 2 keys for this. Physical keys have been readily available for over a decade from yubikey and the market penetration for consumers is basically zero.

vaylian 2y ago
I understand your enthusiasm for passkeys and I think there are real benefits, especially for non-technical users. But likewise, there is also enthusiasm for the objectively more secure hardware tokens. Residential keys are a problem for hardware tokens. So yes, we are living in different worlds. But what we all want is to migrate to more secure authentication methods. And pushing non-residential keys to the wayside just for the convenience of not needing to remember user names feels like a bad trade-off.
- MarkMarine 2y ago
  It's not just needing to remember user names, is everyone in this thread just willfully ignoring what I've been saying about needing multiple (privacy incompatible) channels of data to be able to trust these login methods that aren't passkeys?
  - vaylian 2y ago
    > everyone in this thread just willfully ignoring what I've been saying about needing multiple (privacy incompatible) channels of data to be able to trust these login methods that aren't passkeys? I have reread your top post a few times and I think I'm starting to understand your point. To highlight the core part: > State of the art in industry is basically trying to understand every action that is happening on a device I wasn't aware that this is happening. And I can understand why fintech companies engage in this invasive practice. However, I never used SMS as a second factor, because I know that it is unsafe. I use hardware tokens, because I care about security. I know that many people do not care about security and it is your job to catch them before they do something stupid. I understand why you like passkeys so much. But the original point remains: Resident keys are not necessary. Big tech is propagating resident keys. But they could easily use non-resident keys and offer remembering the usernames for the different sites like password managers do it today. It would be an easy win for everyone.
    - MarkMarine 2y ago
      I understand your point, and I’ve thought a lot about that after discussing it here. I actually prefer the resident keys from my side because I can really trust the device is the device, so I don’t need all that data stream about it. That said, I’m going to make sure I support hardware tokens in my system. My goals are just protecting my user base from fraud and giving them an easy way to login securely. You would probably be shocked at the volume of support calls we get about logging in. It’s 30-40% of the call volume. Easy for a scammer to slip into that stream as well.
lxgr 2y ago
So, ruin a thing that works for a few people (and arguably was the primary target of the spec before big tech essentially took it over) for no reason other than marginal relying party convenience? The only thing needed to preserve their utility would be a minimal rewording (e.g. change “preferred” to “possible” or add a “preferred-if-unlimited-storage” for ResidentKeyRequirement), and a requirement of relying parties to add a username field as a fallback.

comex 2y ago

> With resident keys? A couple dozen, if you're lucky. Or, future tokens start bundling a bit of flash storage and make this a non-issue. Considering how cheap it is, that ought to be possible even for low-cost tokens.

vaylian 2y ago
You still need to allocate physical space for 1) the cryptographic circuitry of the token 2) the tamperproof and stress-resistant enclosure. Depending on the form factor, you might not have that much physical space left for storage. The physical requirements for a token are much more complex than a plain USB drive.
- xescure 2y ago
  Google’s security key can already support 250 resident keys. I’m not sure how secure it is compared to Yubikeys, but it can’t be that far behind.

gre345t34 2y ago

Ideally you should not be able to determine whether a username is valid without authenticating.