dwaite

51 ms·

781.
by dwaite 4y ago
I eventually ran out of time for my toy application and just left it with styling regressions. I didn't understand the advice I used to get styling before, and the migration instructions left a big gap in understanding around what styl
782.
by dwaite 4y ago
Indeed - if my goal is a minimal Hello, World, I don't even need javascript, I can put "Hello World" in a text file and name it index.html. Problem is, this doesn't lead me to solve any harder problems.
783.
by dwaite 4y ago
> So what plans can you point me towards where Google/Apple is announcing that they're going to build a generic API for exporting passkeys from the phone? Do they have a timeline up? I'm not privy to their priorities or ti
784.
by dwaite 4y ago
> There are huge caveats to this that people are just glossing over and saying "yeah, they're portable, don't worry about it." It makes it really hard to trust passkey proponents when they talk about what's going
785.
by dwaite 4y ago
> I'm wondering whether these challenges (biometric / knowledge) are enforced via some open standard, or whether it's ultimately up to the implementation how / whether the signing keys are protected. The WebAuthn spe
786.
by dwaite 4y ago
I do too. The ability for a smaller focused company to innovate and pivot to find unique markets is way different than what the platforms will ever offer. I suspect passkeys provide new ways to innovate beyond what they have been able to do
787.
by dwaite 4y ago
I don't know what a service provider is in this case for sure, but I'll assume you mean something like Google Password Manager or iCloud Keychain or 1Password. There's no guarantee that they will act in a user-beneficial mann
788.
by dwaite 4y ago
Actually, the PIN isn't a fallback - the biometric is just a more convenient option once the PIN is "cached". The biometric doesn't exist until you enter your PIN on restart, which is what unlocks the filesystem (includi
789.
by dwaite 4y ago
> it seems strictly worse than a password + password manager Your password manager is likely the exact same thing. The underlying implementation of this is typically a system or third party password manager which added a public key-based
790.
by dwaite 4y ago
"Personal opinion" hat on: multiple factors do not provide perceived user benefit. They benefit the party who is providing service and exposed to risk. The old Battle.net authenticator made it harder for my account to get hacked,
791.
by dwaite 4y ago
> Would this be a thing that the passkey folks would be OK with? That would ease a lot of my hesitation. I mean, I don't _like_ it (if I'm a passkey folk) as a widespread feature. I suspect users may be tricked into giving away
792.
by dwaite 4y ago
> Are Passkeys, at some level of abstraction, permanently replacing "something you know" (password) with "something you have"? Sometimes. The authenticator you choose to use sets the policy of what makes a valid authe
793.
by dwaite 4y ago
> Codebook links passwords to specific websites/RPs. WebAuthn is different: 1. The client (browser) knows which site is requesting credentials, which means a phishing site cannot ask for another legitimate site's credentials 2.
794.
by dwaite 4y ago
Putting on my "personal opinion" hat; If a platform gave users this option per credential, and there was any visibility to that choice on the relying party side, the replying party would likely just reject the credentials they don
795.
by dwaite 4y ago
> Importantly, I don't think there's a single implementation of Passkey that actually allows this. In theory you could move your keys but in practice, there is no way to transfer your private keys off of your phone The google p
796.
by dwaite 4y ago
> Does that not rather imply that, if I log in with faceid on an iphone, my login will be tied to my ability to faceid on an iphone, and hence only available on iphones and macs? The authenticator is given a lot of leeway in how it does
797.
by dwaite 4y ago
The upcoming W3C Web Authentication Level 3 defines a "backup capable" authenticator, which means that it goes beyond a single piece of hardware. Indicating "backups enabled" means that the user has a recovery process, s
798.
by dwaite 4y ago
Windows Hello can supply single-device passkeys at the platform level. Browsers and native apps will leverage Hello in the background (a la WebAuthn.DLL). A passkey is a user facing term. Platforms have been working on technology to support
799.
by dwaite 4y ago
The second. The term passkeys is meant to describe "like what I get with passwords, but easier/more secure'. It's lowercase "p" - it isn't a Google or Apple brand. Developers can use terms like "multi
800.
by dwaite 4y ago
You might like https://passkeys.dev if you want a more implementer-focused overview.
801.
by dwaite 4y ago
> The passkey itself is an encryption key. Close - it is a signing key, e.g. used for integrity and authentication > To authenticate, the site sends the client the encrypted private key and a challenge. The client uses the passkey to
802.
by dwaite 4y ago
> I'm not completely sure, but my understanding is that it's basically the same principle as SSH keypairs, with the added twist that the user never gets direct access to the private keys. Pretty close - in fact you can use pass
803.
by dwaite 4y ago
> AFAIK android will have an open API, iOS however is going to only support iCloud, classic monopoly. The Android implementation allowing for multiple third part passkey providers (typically, existing password manager that want to suppor
804.
by dwaite 4y ago
> Time will tell if Google's implementation will be open source, and if third parties can hook into the OS level integration It is all user terminology for Web Authentication features, so credentials stored on a current Yubikey are
805.
by dwaite 4y ago
It isn't (just) a private key. It is part of a purpose-built authentication process that leverages private keys as a component. You cannot use the private key within a passkey for general purpose data signing, for example.
806.
by dwaite 4y ago
The term "passkey" is not a technical term, it is a user-facing term. Passkeys are a better alternative to passwords. We don't have to think them up to meet arbitrary password complexity requirements. If a website gets breac
807.
by dwaite 4y ago
This is interesting, however to pour a bit of water on the opportunities here: - CUPS has existed for over 20 years - Java has existed for over 25 years However, I still not use CUPS or similar systems on Windows. And Java-based (or other V
808.
by dwaite 4y ago
Many authentication systems push all phishing mitigation onto the user, e.g. "check the lock" (doesn't do anything) or "check the address bar" (not realistic for most users, ignores the ability to register official-
809.
by dwaite 4y ago
OAuth is typically meant for a user (resource owner) to delegate some authorizations on a protected resource to a client. If your headless system is trying to hit an API with authorizations granted by particular users, you'll need some
810.
by dwaite 4y ago
> Most people think about auth in terms of usernames/passwords or API keys. OAuth is hard to explain here because it is not an authentication protocol, and without extensions has severe security flaws in being one. OpenID Connect is

More ›