Questions tagged [webauthn]
The webauthn tag has no usage guidance.
22
questions
1
vote
0
answers
41
views
Do passkeys on iCloud Keychain ever exist unencrypted outside the secure enclave?
Regarding Apple's beta feature of storing WebAuthn passkeys in the iCloud Keychain, does anybody know if the unencrypted passkeys ever leave the secure enclave, and get stored in RAM or anything?
With ...
- 141
0
votes
0
answers
49
views
Fido U2F, can a modified client theoretically register the same key multiple times? YubiKey Wrapped PrivateKey Method
Context
I was answering a question about how YubiKey can generate "infinite" keypairs for Fido U2F but doesn't need to store them locally.
This leads to my initial question:
Initial Question
...
- 133
0
votes
0
answers
52
views
Status of Asynchronous Remote Key Generation in the developing WebAuthn standard?
Today I read this blog entry by Yubico regarding Asynchronous Remote Key Generation. This proposal solves, in my view, the largest outstanding problem in the widescale adoption of challenge-response ...
- 146
0
votes
1
answer
124
views
HTTP authentication with client-side private key
I'm designing a web service meant for storing data for users, but these users don't have proper server-side accounts, just a random master key the user generated and stores on their device (a bip39 ...
- 111
1
vote
1
answer
135
views
How exactly does the detection of a cloned FIDO2 credential work?
I am trying to understand the FIDO2 standard. I know that a Relying Party has to implement a mechanism that checks the counter of the respective credentials. Most of the time, a counter is stored in ...
- 13
0
votes
1
answer
71
views
Does moving webAuthn API from browser to OS improves security of registration process?
Usually, for all types of authentications, we trust the registration process and assume there is no attack is happening Like in the case of FIDO2 registration. However, as the registration process is ...
- 81
0
votes
1
answer
141
views
What is the equivalent of "forgot password" in password-less login applications using FIDO2 / Webauthn or later?
I'm assuming instead of saying "forgot password?" the text would say "lost your key?" or "don't have your device?". But what would the process of secondary access look ...
- 807
10
votes
2
answers
568
views
Why is Webauthn not used as primary authentication method?
In theory, authenticating with a public key should be much simpler than with a password. There is nothing to remember for the end-user, and registration can be done just by clicking a button. For all ...
- 1
1
vote
1
answer
1k
views
Implementing FIDO2 (WebAuthN) in Native iOS
I am currently investigating the idea of implementing FIDO2 (WebAuthN) support in native iOS using Swift. I understand that there is no FIDO2 support in native iOS, and only available through Safari ...
- 11
1
vote
1
answer
125
views
What are the benefits of using WebAuthn?
The Web Authentication API allows websites served via HTTPS to allow users to authenticate via asymmetric encryption. The procedure for login is basically the following:
Server sends a challenge (16 ...
- 133
1
vote
1
answer
333
views
WebAuthn - What am I missing?
I'm trying to learn a bit about authentication and security protocols at a 10,000 foot level. I was reading about WebAuthn here: https://webauthn.guide/ and here:
https://webauthn.io/
I'm sure what I'...
- 165
0
votes
1
answer
167
views
Risks with OpenSSL verifying a signature with un-trusted PEM encoded public key
If a website user wants to use WebAuthn, they will start by creating a credential, where their authentication device provides a public key.
This key is encoded, and sent back to the server to store ...
- 111
1
vote
0
answers
96
views
WebAuthn Variation with non-connect dongle Authenticator
As I read through the WebAuthn / FIDO2 documentation, it appears the authentication is done on the local device to create an attestation to the FIDO server. This future implies the "biometrics" or ...
- 111
3
votes
0
answers
102
views
How to add a new webauthn key if the existing one isn't portable
Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, ...)...
- 131
3
votes
2
answers
435
views
Why does WebAuthn require a challenge when asking the client to register a new credential?
When registering a new credential as part of WebAuthn, why does the client need to be sent a challenge?
Presumably this is to prevent a replay attack, but wouldn't a replay attack be prevented by TLS ...
- 153
10
votes
1
answer
4k
views
FIDO and FIDO2 differences
I've been reading both FIDO and FIDO2 specs for a while tring to understand the similarities and differences between both. Here is how I broke it down so far:
FIDO: First iteration in creating a ...
- 378
1
vote
1
answer
685
views
Why don't online banks use WebAuthn? [closed]
My ideal bank would offer online banking from a browser with user/pwd and WebAuthn, for example with a NFC or USB key. No OTP or SMS or apps on the smartphone or physical devices required. (It goes ...
- 359
3
votes
1
answer
277
views
Yubikey - WebAuthn and U2F
I have a yubikey which supports only U2F. It doesn't support FIDO2. I read about U2F and i understand how it works.
When i test my Yubikey for WebAuthn on https://webauthn.io it works. I wanted to ...
- 63
1
vote
1
answer
178
views
2fa attestation object for non-repudiation
I am reading on digital signatures:
A valid digital signature gives a recipient reason to believe that the
message was created by a known sender (authentication), that the
sender cannot deny ...
- 113
9
votes
2
answers
2k
views
Is it possible to use WebAuthn for digitally signing documents in the browser?
WebAuthn is a relatively new API for authentication, and it uses public key cryptography instead of something like passwords.
I am wondering if it is possible to use the cryptographic part for a ...
- 781
1
vote
1
answer
209
views
FIDO2: will FIDO foundation MDS 1.0 metadata statements be migrated to MDS 2.0?
The FIDO foundation provides with metadata web service for UAF (MDS 1.0, https://mds.fidoalliance.org/) and a new web services for FIDO2 / WebAuthn metadata (MDS 2.0, see https://fidoalliance.org/...
- 393
1
vote
1
answer
130
views
What is the motivation behind supporting both `none` and `self` attestation in WebAuthN?
WebAuthN seems to provide essentially two different ways of not performing verifiable attestation: Either by the Relying Party requesting none or by the authenticator choosing self attestation.
Is ...
- 4,034