Questions tagged [webauthn]
The webauthn tag has no usage guidance.
51 questions
4
votes
2
answers
65
views
Integrating Biometrics with Auth Code Flow (w/ PKCE) on mobile
There is a topic I have been going back and forth with for some time. Here is the premise:
we need to create a mobile app for a highly regulated industry
the app should leverage oAuth2 for obtaining ...
- 41
1
vote
1
answer
56
views
Does a Passkey authentication system need bootstrapping by username and password?
The Register has an article on Passkeys, and one of the issues they use to argue that they are unlikely to be widely adopted is:
The process is bootstrapped by getting the user to authenticate using ...
- 375
1
vote
1
answer
51
views
What is the easiest way to have a standalone implementation of Passkeys on generic hardware with backup?
In previous question I asked about simple login systems, and WebAuthn was the answer. From a brief read of the web pages I THINK it is possible to create a standalone GPL implementation of Passkeys ...
- 375
1
vote
1
answer
52
views
Is clientDataJson and attestationObject required to verify assertion during authentication in WebAuthN?
Currently I am working on implementing/supporting WebAuthN in my service (JAVA). I have a Control Plane which handles the registration ceremony and Data Plane that handles the authentication ceremony. ...
- 13
0
votes
1
answer
65
views
Best Practices for WebAuthn FIDO2 reset
Security Noob here. I am trying to build a secure passwordless login mechanism for my webservice.
The authentication mechanisms
My idea is to encourage the users to use the following two login methods:...
- 1
2
votes
1
answer
88
views
Storing a server secret in a user passkey user id
I want to implement passkey support as a full replacement for passwords but I have some server-side state that still needs to be encrypted to a specific user in a way that can not be decrypted or ...
- 123
-1
votes
1
answer
114
views
Fido2/Webauthn Passkeys: rsa2048, rsa4096, or Ed25519?
Does anyone know what kind of keys are being generated when you make a Fido2/Webauthn passkey? rsa2048, rsa4096, Ed25519, or something else? Just worried if its rsa2048 it might soon be crackable, at ...
- 179
6
votes
2
answers
2k
views
How is a passkey more secure than the regular email/password with U2F key?
Since I use 1Password to store my passkeys along with emails and passwords, it appears to be that passkeys are not as secure as using the email and password with U2F flow that I currently use on many ...
- 161
0
votes
0
answers
87
views
storing user hashed password into webauthn id
I am building a pure client-side app.
My users have a .kdbx vault stored in localStorage, and they can open it with a password.
In order to add a biometric\quick open feature into the app I thought ...
- 101
0
votes
2
answers
212
views
How does it "allow a malicious website to obtain valid credentials." - WebAuthn
I'm not entirely convinced of the importance of verifying the authenticator attestation, and I've asked a question about it, I'm open to it, and if you want, you can post an answer at that question, ...
- 374
0
votes
1
answer
76
views
Suggestions for implementing a simplified subset of WebAuthn Relaying Party Operation
Previously some good fellow explained the importance of verifying the public key created and offered by authenticators.
As before, given the complexity of a FULL implementation of RP operation, I ...
- 374
1
vote
1
answer
188
views
Is 3DS compatible with secure 2FA technologies? (TOTP, WebAuthn)
Is PSD2's Strong Customer Authentication requirement possible to satisfy with secure 2FA solutions, such as TOTP and WebAuthn?
For the purposes of this question, I'm classifying all systems where an ...
- 1,098
0
votes
0
answers
14
views
Why does FIDO2's spec not mention FIDO UAF as a related standard? [duplicate]
Why does FIDO2's spec not mention FIDO UAF as a related standard? I wonder if FIDO UAF is still relevant. Will FIDO UAF be deprecated eventually in favor of FIDO2? Why do they co-exist if they fulfil ...
- 101
2
votes
0
answers
165
views
Did Android remove Fingerprint/Passcode for WebAuthN and lower security to push Passkeys?
So, before this year, when you were using WebAuthN to create security keys on an up to date Android phone (Pixel 6 in my case), you had these options (iirc):
When creating a platform authenticator, ...
- 178
2
votes
2
answers
3k
views
Are passkeys a secure replacement for 2FA?
Passkeys seems great for me as an individual, instead of passwords and TOTP tokens I can now slowly ditch the passwords and the somewhat annoying (but important!) TOTP tokens which I have locked in my ...
0
votes
2
answers
873
views
What is the point of required user verification in WebAuthn?
User verification in WebAuthn can either be required, preferred, or discouraged. The last two are a hint to the authenticator that may be ignored. I see how they could be used to prevent client-side ...
- 153
0
votes
1
answer
210
views
WebAuthn does not guarantee public-key integrity other than trough attestation?
I've been reading about WebAuthn and try to write some code to exercise.
One thing I noticed is that the spec doesn't seem to provide any way to verify the correctness of the public-key being create()'...
- 374
2
votes
1
answer
186
views
What is the proper procedure to allow users to reset their passkey
What is the best practice for allowing users to reset a passkey (WebAuthn)?
Should I just have them click a link in their email like it was a password, or is there a more secure way of doing it? In ...
- 31
1
vote
0
answers
223
views
FIDO Multi-device Authentication Sync Technical Specification
Where/what are the technical specifications to sync FIDO passkeys?
FIDO passkeys are a quite hot topic. There is a white paper from FIDO Alliance about it. Several websites provide abstract ...
- 201
1
vote
0
answers
395
views
Is it possible to see the pubkeys that pair with private keys inside the TPM in Windows?
Is it possible to inspect data (pubkeys, domain names used for webauthn, not private keys) related to private keys stored in the TPM on Windows?
I legally own the hardware and have maximum ...
- 435
3
votes
2
answers
569
views
FIDO2: should I set user verification to "discouraged" with two-factor authentication?
I provide a web application that uses FIDO2 for two-factor authentication. Recently I got reports that Windows users have to enter a PIN each time they use their hardware token. As far as I understand,...
- 153
1
vote
1
answer
1k
views
Security concerns in using passkey (WebAuthn) to encrypt data
I have a web application that runs on the client side only (no backend server), and I need a way to encrypt user data on the blockchain. Users who encrypted the data needs to be able to decrypt the ...
- 13
1
vote
1
answer
193
views
Does webauthn support mutual authentication? [duplicate]
Does webauthn provide any authentication of the server end?
Or asked differently, is there any defense against a man-in-the-middle attack that pretends to be site X, performs what looks like a ...
- 113
2
votes
1
answer
353
views
Where does Firefox webauthn softtoken save its key?
GitHub is pushing 2FA and offer mostly unreasonable choices; however there is webauthn and Firefox has a software version of it; so a proper security mode can be built.
But in order to do this I need ...
- 1,280
4
votes
2
answers
872
views
How to properly manage WebAuthn challenges?
I'm in the process of evaluating adding WebAuthn/Passkey support to a website, and I'm not really sure how to properly manage challenge nonces.
My understanding is that the main reason for using ...
- 201
1
vote
2
answers
404
views
Using asymmetric encryption as authentication over HTTP?
I've read questions targeting the usage of basic authentication over HTTPS. Since the connection is already secure, except e.g. a compromised certificate, communication should be rather safe.
But I ...
1
vote
1
answer
119
views
Does using TouchID and WebAuthn with a password manager defeat the 2FA?
For quite some time WebKit and others support WebAuthn. This allows for a pretty seamless 2FA experience with a key, like Yubico. On Apple devices TouchID/FaceID can also be used as a hardware key.
...
- 141
1
vote
1
answer
140
views
Set-up Apple Passkey for private users
The demos I've seen for Passkey assume that any public user can register with a website. What about the situation where you want to set up a passkey for an admin user of a website? i.e. How does an ...
- 1,177
5
votes
2
answers
1k
views
Why did WebAuthn beat PAKEs as the preferred password replacement?
Apple and now Google are releasing products that are built on WebAuthn as a replacement for traditional username + passwords. Why did this technology beat out PAKEs?
- 514
4
votes
1
answer
855
views
Use platform TPM as U2F for web applications
The Problem:
Use the platform TMP of my Windows Laptop/PC (no external device or USB token) as U2F in a web application to check if it is a known device.
My intended solution:
I need to store/create ...
- 91
5
votes
1
answer
628
views
Do passkeys on iCloud Keychain ever exist unencrypted outside the secure enclave?
Regarding Apple's beta feature of storing WebAuthn passkeys in the iCloud Keychain, does anybody know if the unencrypted passkeys ever leave the secure enclave, and get stored in RAM or anything?
With ...
- 179
1
vote
0
answers
180
views
Fido U2F, can a modified client theoretically register the same key multiple times? YubiKey Wrapped PrivateKey Method
Context
I was answering a question about how YubiKey can generate "infinite" keypairs for Fido U2F but doesn't need to store them locally.
This leads to my initial question:
Initial Question
...
- 183
0
votes
1
answer
1k
views
HTTP authentication with client-side private key
I'm designing a web service meant for storing data for users, but these users don't have proper server-side accounts, just a random master key the user generated and stores on their device (a bip39 ...
- 111
0
votes
1
answer
659
views
How exactly does the detection of a cloned FIDO2 credential work?
I am trying to understand the FIDO2 standard. I know that a Relying Party has to implement a mechanism that checks the counter of the respective credentials. Most of the time, a counter is stored in ...
- 3
0
votes
1
answer
130
views
Does moving webAuthn API from browser to OS improves security of registration process?
Usually, for all types of authentications, we trust the registration process and assume there is no attack is happening Like in the case of FIDO2 registration. However, as the registration process is ...
- 81
3
votes
1
answer
432
views
What is the equivalent of "forgot password" in password-less login applications using FIDO2 / Webauthn or later?
I'm assuming instead of saying "forgot password?" the text would say "lost your key?" or "don't have your device?". But what would the process of secondary access look ...
- 857
13
votes
2
answers
946
views
Why is Webauthn not used as primary authentication method?
In theory, authenticating with a public key should be much simpler than with a password. There is nothing to remember for the end-user, and registration can be done just by clicking a button. For all ...
user163495
2
votes
1
answer
3k
views
Implementing FIDO2 (WebAuthN) in Native iOS
I am currently investigating the idea of implementing FIDO2 (WebAuthN) support in native iOS using Swift. I understand that there is no FIDO2 support in native iOS, and only available through Safari ...
- 21
1
vote
2
answers
278
views
What are the benefits of using WebAuthn?
The Web Authentication API allows websites served via HTTPS to allow users to authenticate via asymmetric encryption. The procedure for login is basically the following:
Server sends a challenge (16 ...
- 133
3
votes
1
answer
917
views
WebAuthn - What am I missing?
I'm trying to learn a bit about authentication and security protocols at a 10,000 foot level. I was reading about WebAuthn here: https://webauthn.guide/ and here:
https://webauthn.io/
I'm sure what I'...
- 185
0
votes
1
answer
407
views
Risks with OpenSSL verifying a signature with un-trusted PEM encoded public key
If a website user wants to use WebAuthn, they will start by creating a credential, where their authentication device provides a public key.
This key is encoded, and sent back to the server to store ...
- 111
1
vote
0
answers
129
views
WebAuthn Variation with non-connect dongle Authenticator
As I read through the WebAuthn / FIDO2 documentation, it appears the authentication is done on the local device to create an attestation to the FIDO server. This future implies the "biometrics" or ...
- 111
3
votes
0
answers
137
views
How to add a new webauthn key if the existing one isn't portable
Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, ...)...
- 131
4
votes
2
answers
1k
views
Why does WebAuthn require a challenge when asking the client to register a new credential?
When registering a new credential as part of WebAuthn, why does the client need to be sent a challenge?
Presumably this is to prevent a replay attack, but wouldn't a replay attack be prevented by TLS ...
- 173
18
votes
1
answer
8k
views
FIDO and FIDO2 differences
I've been reading both FIDO and FIDO2 specs for a while tring to understand the similarities and differences between both. Here is how I broke it down so far:
FIDO: First iteration in creating a ...
- 478
3
votes
1
answer
1k
views
Why don't online banks use WebAuthn? [closed]
My ideal bank would offer online banking from a browser with user/pwd and WebAuthn, for example with a NFC or USB key. No OTP or SMS or apps on the smartphone or physical devices required. (It goes ...
- 379
4
votes
1
answer
424
views
Yubikey - WebAuthn and U2F
I have a yubikey which supports only U2F. It doesn't support FIDO2. I read about U2F and i understand how it works.
When i test my Yubikey for WebAuthn on https://webauthn.io it works. I wanted to ...
- 173
2
votes
1
answer
295
views
2fa attestation object for non-repudiation
I am reading on digital signatures:
A valid digital signature gives a recipient reason to believe that the
message was created by a known sender (authentication), that the
sender cannot deny ...
- 123
15
votes
3
answers
4k
views
Is it possible to use WebAuthn for digitally signing documents in the browser?
WebAuthn is a relatively new API for authentication, and it uses public key cryptography instead of something like passwords.
I am wondering if it is possible to use the cryptographic part for a ...
- 901
1
vote
1
answer
250
views
FIDO2: will FIDO foundation MDS 1.0 metadata statements be migrated to MDS 2.0?
The FIDO foundation provides with metadata web service for UAF (MDS 1.0, https://mds.fidoalliance.org/) and a new web services for FIDO2 / WebAuthn metadata (MDS 2.0, see https://fidoalliance.org/...
- 453