Questions tagged [webauthn]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers
41 views

Do passkeys on iCloud Keychain ever exist unencrypted outside the secure enclave?

Regarding Apple's beta feature of storing WebAuthn passkeys in the iCloud Keychain, does anybody know if the unencrypted passkeys ever leave the secure enclave, and get stored in RAM or anything? With ...
user avatar
0 votes
0 answers
49 views

Fido U2F, can a modified client theoretically register the same key multiple times? YubiKey Wrapped PrivateKey Method

Context I was answering a question about how YubiKey can generate "infinite" keypairs for Fido U2F but doesn't need to store them locally. This leads to my initial question: Initial Question ...
user avatar
0 votes
0 answers
52 views

Status of Asynchronous Remote Key Generation in the developing WebAuthn standard?

Today I read this blog entry by Yubico regarding Asynchronous Remote Key Generation. This proposal solves, in my view, the largest outstanding problem in the widescale adoption of challenge-response ...
user avatar
  • 146
0 votes
1 answer
124 views

HTTP authentication with client-side private key

I'm designing a web service meant for storing data for users, but these users don't have proper server-side accounts, just a random master key the user generated and stores on their device (a bip39 ...
user avatar
1 vote
1 answer
135 views

How exactly does the detection of a cloned FIDO2 credential work?

I am trying to understand the FIDO2 standard. I know that a Relying Party has to implement a mechanism that checks the counter of the respective credentials. Most of the time, a counter is stored in ...
user avatar
  • 13
0 votes
1 answer
71 views

Does moving webAuthn API from browser to OS improves security of registration process?

Usually, for all types of authentications, we trust the registration process and assume there is no attack is happening Like in the case of FIDO2 registration. However, as the registration process is ...
user avatar
0 votes
1 answer
141 views

What is the equivalent of "forgot password" in password-less login applications using FIDO2 / Webauthn or later?

I'm assuming instead of saying "forgot password?" the text would say "lost your key?" or "don't have your device?". But what would the process of secondary access look ...
user avatar
10 votes
2 answers
568 views

Why is Webauthn not used as primary authentication method?

In theory, authenticating with a public key should be much simpler than with a password. There is nothing to remember for the end-user, and registration can be done just by clicking a button. For all ...
user avatar
1 vote
1 answer
1k views

Implementing FIDO2 (WebAuthN) in Native iOS

I am currently investigating the idea of implementing FIDO2 (WebAuthN) support in native iOS using Swift. I understand that there is no FIDO2 support in native iOS, and only available through Safari ...
user avatar
1 vote
1 answer
125 views

What are the benefits of using WebAuthn?

The Web Authentication API allows websites served via HTTPS to allow users to authenticate via asymmetric encryption. The procedure for login is basically the following: Server sends a challenge (16 ...
user avatar
  • 133
1 vote
1 answer
333 views

WebAuthn - What am I missing?

I'm trying to learn a bit about authentication and security protocols at a 10,000 foot level. I was reading about WebAuthn here: https://webauthn.guide/ and here: https://webauthn.io/ I'm sure what I'...
user avatar
  • 165
0 votes
1 answer
167 views

Risks with OpenSSL verifying a signature with un-trusted PEM encoded public key

If a website user wants to use WebAuthn, they will start by creating a credential, where their authentication device provides a public key. This key is encoded, and sent back to the server to store ...
user avatar
1 vote
0 answers
96 views

WebAuthn Variation with non-connect dongle Authenticator

As I read through the WebAuthn / FIDO2 documentation, it appears the authentication is done on the local device to create an attestation to the FIDO server. This future implies the "biometrics" or ...
user avatar
3 votes
0 answers
102 views

How to add a new webauthn key if the existing one isn't portable

Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, ...)...
user avatar
3 votes
2 answers
435 views

Why does WebAuthn require a challenge when asking the client to register a new credential?

When registering a new credential as part of WebAuthn, why does the client need to be sent a challenge? Presumably this is to prevent a replay attack, but wouldn't a replay attack be prevented by TLS ...
user avatar
10 votes
1 answer
4k views

FIDO and FIDO2 differences

I've been reading both FIDO and FIDO2 specs for a while tring to understand the similarities and differences between both. Here is how I broke it down so far: FIDO: First iteration in creating a ...
user avatar
1 vote
1 answer
685 views

Why don't online banks use WebAuthn? [closed]

My ideal bank would offer online banking from a browser with user/pwd and WebAuthn, for example with a NFC or USB key. No OTP or SMS or apps on the smartphone or physical devices required. (It goes ...
user avatar
  • 359
3 votes
1 answer
277 views

Yubikey - WebAuthn and U2F

I have a yubikey which supports only U2F. It doesn't support FIDO2. I read about U2F and i understand how it works. When i test my Yubikey for WebAuthn on https://webauthn.io it works. I wanted to ...
user avatar
  • 63
1 vote
1 answer
178 views

2fa attestation object for non-repudiation

I am reading on digital signatures: A valid digital signature gives a recipient reason to believe that the message was created by a known sender (authentication), that the sender cannot deny ...
user avatar
  • 113
9 votes
2 answers
2k views

Is it possible to use WebAuthn for digitally signing documents in the browser?

WebAuthn is a relatively new API for authentication, and it uses public key cryptography instead of something like passwords. I am wondering if it is possible to use the cryptographic part for a ...
user avatar
1 vote
1 answer
209 views

FIDO2: will FIDO foundation MDS 1.0 metadata statements be migrated to MDS 2.0?

The FIDO foundation provides with metadata web service for UAF (MDS 1.0, https://mds.fidoalliance.org/) and a new web services for FIDO2 / WebAuthn metadata (MDS 2.0, see https://fidoalliance.org/...
user avatar
  • 393
1 vote
1 answer
130 views

What is the motivation behind supporting both `none` and `self` attestation in WebAuthN?

WebAuthN seems to provide essentially two different ways of not performing verifiable attestation: Either by the Relying Party requesting none or by the authenticator choosing self attestation. Is ...
user avatar
  • 4,034