1

I am trying to figure out the implications of authentication technologies. Answers to a previous question indicate my real question is more "meta than that.

The primary requirements for an authentication system from my point of view are below, roughly in order of importance. They do not seem too unusual for a web site.

  • Private
    • This is my top concern. The users must not have to trust anyone with their identity. The primary "threats" would be the users government (possibly authoritarian), big tech and the web site owner. It should be possible for the user to ensure there is no risk of multiple accounts created on the same machine being linked, even if all the web sites are controlled by the same malicious actor (with perhaps tor to prevent IP address "attacks").
  • Easy
    • It should be usable on a general purpose computer running only open source software with no additional hardware requirements. Using tpm-fido seems like a possibility if there is not an easier option. GPG cli is easy enough, but a tool purpose built for the job would be best.
  • Secure
    • It has to have better security than passwords. Not relying on third party systems would be an advantage.
  • Backupable
    • Assuming this is the primary (or sole) method of authentication there must be a way for users to manage their credentials in such as way as the loss of a device does not prevent them accessing their account

The options I have examined:

  • Username/password
    • This has poor security
  • TOTP
    • This has better security, but still not great
  • WebAuthn/Passkey
  • mTLS
    • This seems to fit most of the requirements except easy, as cloudflare says to use widely would be a problem as "generating, managing, and verifying the billions of certificates necessary for this is a near-impossible task", though they do not explain why.
  • DIDs
    • These seem conceptually perfect, but are not actually available today as I understand it, as there is a blockchain requirement that is not implemented?
  • PGP
    • Some web sites (particularly less savoury ones) use PGP to log in. The public key is the "username" and a one time password is provided encrypted with that private key. This does seem to meet all the requirements, but is not designed for the job.

What is the best log in system for a privacy focused website to choose given these requirements?

Improve this question
1

1 Answer 1

Reset to default
1

The answer is WebAuthn.

I don't know what your concerns over the privacy of WebAuthn are, but I don't see it. The link you posted - to privacy considerations - just demonstrates the fact that WebAuthn is a privacy aware standard.

For backups - register multiple devices / keys. If you lose one you can still authenticate with one of the others.

Improve this answer
14
  • 1
    Or use a solution that allows backups. Google Chrome/Androis puts them in google cloud solution; Bitwarden in their cloud solution, and allows export as JSON. After all passkeys is just a set of bytes.
    – vidarlo
    Commented Sep 5 at 20:02
  • There could be something I do not understand with WebAuthn. If the only hardware I have is a single general purpose computer with a tpm module and a memory stick for backup. I want to create two accounts and I do not want the web site operator to know they are the same person. I want to be able to lose the computer and get access on a new computer from the memory stick. How much of that can I do with WebAuthn?
    – User65535
    Commented Sep 5 at 20:08
  • corbado.com/blog/webauthn-user-id-userhandle gives an introduction.
    – vidarlo
    Commented Sep 5 at 20:14
  • @User65535 You'll register different public keys with each account so the website operator won't be able to track you through WebAuthn (but of course might be able to through other methods). Different services will have different recovery options, restoring from a usb will work if they use recovery codes for example. Of course, recovery codes on a usb weaken the overall system. Personally, I have a couple of Yubikeys.
    – andycaine
    Commented Sep 5 at 20:29
  • 1
    @User65535 for a private, secure, and easy login system - I don't think a couple of Yubikeys is a big ask. Especially as WebAuthn gets more widely adopted, they can be used with more and more sites. And if you don't want to spend the extra, just use the hardware that is the device you have, and if you only have one device, accept that you'll need another recovery option.
    – andycaine
    Commented Sep 5 at 21:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .