Questions tagged [webauthn]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
84 views

Is 3DS compatible with secure 2FA technologies? (TOTP, WebAuthn)

Is PSD2's Strong Customer Authentication requirement possible to satisfy with secure 2FA solutions, such as TOTP and WebAuthn? For the purposes of this question, I'm classifying all systems where an ...
Michael Altfield's user avatar
0 votes
0 answers
14 views

Why does FIDO2's spec not mention FIDO UAF as a related standard? [duplicate]

Why does FIDO2's spec not mention FIDO UAF as a related standard? I wonder if FIDO UAF is still relevant. Will FIDO UAF be deprecated eventually in favor of FIDO2? Why do they co-exist if they fulfil ...
kinafu's user avatar
  • 101
0 votes
0 answers
41 views

Webauthn: Access control for the public key credential uploaded by the user's device

I'm experimenting with adding passkeys to Drupal. I'm using webauthn-lib 4.7. When registering a passkey, the device generates a Public Key Credential, which is then sent to the server as stringified ...
Patrick Kenny's user avatar
2 votes
0 answers
81 views

Did Android remove Fingerprint/Passcode for WebAuthN and lower security to push Passkeys?

So, before this year, when you were using WebAuthN to create security keys on an up to date Android phone (Pixel 6 in my case), you had these options (iirc): When creating a platform authenticator, ...
xsrf's user avatar
  • 168
1 vote
2 answers
888 views

Are passkeys a secure replacement for 2FA?

Passkeys seems great for me as an individual, instead of passwords and TOTP tokens I can now slowly ditch the passwords and the somewhat annoying (but important!) TOTP tokens which I have locked in my ...
Anthon Nilsson's user avatar
0 votes
1 answer
271 views

What is the point of required user verification in WebAuthn?

User verification in WebAuthn can either be required, preferred, or discouraged. The last two are a hint to the authenticator that may be ignored. I see how they could be used to prevent client-side ...
tobib's user avatar
  • 153
0 votes
1 answer
122 views

WebAuthn does not guarantee public-key integrity other than trough attestation?

I've been reading about WebAuthn and try to write some code to exercise. One thing I noticed is that the spec doesn't seem to provide any way to verify the correctness of the public-key being create()'...
DannyNiu's user avatar
  • 370
0 votes
0 answers
84 views

Passkeys versus passwords for intranet websites

Do passkeys offer more security for intranet websites compared to passwords? I know there are additional methods like 2FA to get more security, but I just want to look at a optional replacement for ...
fitcfitcfatc's user avatar
1 vote
1 answer
109 views

What is the proper procedure to allow users to reset their passkey

What is the best practice for allowing users to reset a passkey (WebAuthn)? Should I just have them click a link in their email like it was a password, or is there a more secure way of doing it? In ...
reesericci's user avatar
1 vote
0 answers
120 views

FIDO Multi-device Authentication Sync Technical Specification

Where/what are the technical specifications to sync FIDO passkeys? FIDO passkeys are a quite hot topic. There is a white paper from FIDO Alliance about it. Several websites provide abstract ...
ndbd's user avatar
  • 201
1 vote
0 answers
215 views

Is it possible to see the pubkeys that pair with private keys inside the TPM in Windows?

Is it possible to inspect data (pubkeys, domain names used for webauthn, not private keys) related to private keys stored in the TPM on Windows? I legally own the hardware and have maximum ...
mikemaccana's user avatar
3 votes
2 answers
321 views

FIDO2: should I set user verification to "discouraged" with two-factor authentication?

I provide a web application that uses FIDO2 for two-factor authentication. Recently I got reports that Windows users have to enter a PIN each time they use their hardware token. As far as I understand,...
tobib's user avatar
  • 153
1 vote
1 answer
618 views

Security concerns in using passkey (WebAuthn) to encrypt data

I have a web application that runs on the client side only (no backend server), and I need a way to encrypt user data on the blockchain. Users who encrypted the data needs to be able to decrypt the ...
yuetloo's user avatar
  • 13
0 votes
1 answer
117 views

Does webauthn support mutual authentication? [duplicate]

Does webauthn provide any authentication of the server end? Or asked differently, is there any defense against a man-in-the-middle attack that pretends to be site X, performs what looks like a ...
TvE's user avatar
  • 103
2 votes
1 answer
231 views

Where does Firefox webauthn softtoken save its key?

GitHub is pushing 2FA and offer mostly unreasonable choices; however there is webauthn and Firefox has a software version of it; so a proper security mode can be built. But in order to do this I need ...
Joshua's user avatar
  • 1,147
3 votes
2 answers
434 views

How to properly manage WebAuthn challenges?

I'm in the process of evaluating adding WebAuthn/Passkey support to a website, and I'm not really sure how to properly manage challenge nonces. My understanding is that the main reason for using ...
Dolda2000's user avatar
  • 181
1 vote
2 answers
252 views

Using asymmetric encryption as authentication over HTTP?

I've read questions targeting the usage of basic authentication over HTTPS. Since the connection is already secure, except e.g. a compromised certificate, communication should be rather safe. But I ...
David Fischer's user avatar
1 vote
1 answer
95 views

Does using TouchID and WebAuthn with a password manager defeat the 2FA?

For quite some time WebKit and others support WebAuthn. This allows for a pretty seamless 2FA experience with a key, like Yubico. On Apple devices TouchID/FaceID can also be used as a hardware key. ...
kiler129's user avatar
  • 141
1 vote
1 answer
100 views

Set-up Apple Passkey for private users

The demos I've seen for Passkey assume that any public user can register with a website. What about the situation where you want to set up a passkey for an admin user of a website? i.e. How does an ...
Ian Warburton's user avatar
5 votes
2 answers
1k views

Why did WebAuthn beat PAKEs as the preferred password replacement?

Apple and now Google are releasing products that are built on WebAuthn as a replacement for traditional username + passwords. Why did this technology beat out PAKEs?
Prime's user avatar
  • 514
4 votes
1 answer
662 views

Use platform TPM as U2F for web applications

The Problem: Use the platform TMP of my Windows Laptop/PC (no external device or USB token) as U2F in a web application to check if it is a known device. My intended solution: I need to store/create ...
MrMaavin's user avatar
5 votes
1 answer
477 views

Do passkeys on iCloud Keychain ever exist unencrypted outside the secure enclave?

Regarding Apple's beta feature of storing WebAuthn passkeys in the iCloud Keychain, does anybody know if the unencrypted passkeys ever leave the secure enclave, and get stored in RAM or anything? With ...
Mohamed Hafez's user avatar
1 vote
0 answers
140 views

Fido U2F, can a modified client theoretically register the same key multiple times? YubiKey Wrapped PrivateKey Method

Context I was answering a question about how YubiKey can generate "infinite" keypairs for Fido U2F but doesn't need to store them locally. This leads to my initial question: Initial Question ...
PathToLife's user avatar
0 votes
1 answer
837 views

HTTP authentication with client-side private key

I'm designing a web service meant for storing data for users, but these users don't have proper server-side accounts, just a random master key the user generated and stores on their device (a bip39 ...
Rafael Korbas's user avatar
0 votes
1 answer
485 views

How exactly does the detection of a cloned FIDO2 credential work?

I am trying to understand the FIDO2 standard. I know that a Relying Party has to implement a mechanism that checks the counter of the respective credentials. Most of the time, a counter is stored in ...
Konsi's user avatar
  • 3
0 votes
1 answer
107 views

Does moving webAuthn API from browser to OS improves security of registration process?

Usually, for all types of authentications, we trust the registration process and assume there is no attack is happening Like in the case of FIDO2 registration. However, as the registration process is ...
tarun14110's user avatar
3 votes
1 answer
375 views

What is the equivalent of "forgot password" in password-less login applications using FIDO2 / Webauthn or later?

I'm assuming instead of saying "forgot password?" the text would say "lost your key?" or "don't have your device?". But what would the process of secondary access look ...
eternaltyro's user avatar
13 votes
2 answers
888 views

Why is Webauthn not used as primary authentication method?

In theory, authenticating with a public key should be much simpler than with a password. There is nothing to remember for the end-user, and registration can be done just by clicking a button. For all ...
user avatar
2 votes
1 answer
3k views

Implementing FIDO2 (WebAuthN) in Native iOS

I am currently investigating the idea of implementing FIDO2 (WebAuthN) support in native iOS using Swift. I understand that there is no FIDO2 support in native iOS, and only available through Safari ...
Go James 's user avatar
1 vote
2 answers
240 views

What are the benefits of using WebAuthn?

The Web Authentication API allows websites served via HTTPS to allow users to authenticate via asymmetric encryption. The procedure for login is basically the following: Server sends a challenge (16 ...
D. Pardal's user avatar
  • 133
3 votes
1 answer
776 views

WebAuthn - What am I missing?

I'm trying to learn a bit about authentication and security protocols at a 10,000 foot level. I was reading about WebAuthn here: https://webauthn.guide/ and here: https://webauthn.io/ I'm sure what I'...
Chris's user avatar
  • 185
0 votes
1 answer
371 views

Risks with OpenSSL verifying a signature with un-trusted PEM encoded public key

If a website user wants to use WebAuthn, they will start by creating a credential, where their authentication device provides a public key. This key is encoded, and sent back to the server to store ...
Craig Francis's user avatar
1 vote
0 answers
112 views

WebAuthn Variation with non-connect dongle Authenticator

As I read through the WebAuthn / FIDO2 documentation, it appears the authentication is done on the local device to create an attestation to the FIDO server. This future implies the "biometrics" or ...
mazecreator's user avatar
3 votes
0 answers
121 views

How to add a new webauthn key if the existing one isn't portable

Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, ...)...
Jonas Osburg's user avatar
3 votes
2 answers
1k views

Why does WebAuthn require a challenge when asking the client to register a new credential?

When registering a new credential as part of WebAuthn, why does the client need to be sent a challenge? Presumably this is to prevent a replay attack, but wouldn't a replay attack be prevented by TLS ...
johnnyodonnell's user avatar
17 votes
1 answer
7k views

FIDO and FIDO2 differences

I've been reading both FIDO and FIDO2 specs for a while tring to understand the similarities and differences between both. Here is how I broke it down so far: FIDO: First iteration in creating a ...
Filipe Rodrigues's user avatar
1 vote
1 answer
1k views

Why don't online banks use WebAuthn? [closed]

My ideal bank would offer online banking from a browser with user/pwd and WebAuthn, for example with a NFC or USB key. No OTP or SMS or apps on the smartphone or physical devices required. (It goes ...
jj_p's user avatar
  • 359
3 votes
1 answer
385 views

Yubikey - WebAuthn and U2F

I have a yubikey which supports only U2F. It doesn't support FIDO2. I read about U2F and i understand how it works. When i test my Yubikey for WebAuthn on https://webauthn.io it works. I wanted to ...
Jack's user avatar
  • 163
2 votes
1 answer
258 views

2fa attestation object for non-repudiation

I am reading on digital signatures: A valid digital signature gives a recipient reason to believe that the message was created by a known sender (authentication), that the sender cannot deny ...
thalisk's user avatar
  • 123
13 votes
3 answers
3k views

Is it possible to use WebAuthn for digitally signing documents in the browser?

WebAuthn is a relatively new API for authentication, and it uses public key cryptography instead of something like passwords. I am wondering if it is possible to use the cryptographic part for a ...
Mad Scientist's user avatar
1 vote
1 answer
230 views

FIDO2: will FIDO foundation MDS 1.0 metadata statements be migrated to MDS 2.0?

The FIDO foundation provides with metadata web service for UAF (MDS 1.0, https://mds.fidoalliance.org/) and a new web services for FIDO2 / WebAuthn metadata (MDS 2.0, see https://fidoalliance.org/...
Tangui's user avatar
  • 433
1 vote
1 answer
208 views

What is the motivation behind supporting both `none` and `self` attestation in WebAuthN?

WebAuthN seems to provide essentially two different ways of not performing verifiable attestation: Either by the Relying Party requesting none or by the authenticator choosing self attestation. Is ...
lxgr's user avatar
  • 4,233