Questions tagged [webauthn]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
0answers
38 views

How to add a new webauthn key if the existing one isn't portable

Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, ...)...
1
vote
2answers
73 views

Why does WebAuthn require a challenge when asking the client to register a new credential?

When registering a new credential as part of WebAuthn, why does the client need to be sent a challenge? I guess this prevents replay attacks, but how does this work? And how would a replay attack ...
0
votes
0answers
49 views

FIDO and FIDO2 differences

I've been reading both FIDO and FIDO2 specs for a while tring to understand the similarities and differences between both. Here is how I broke it down so far: FIDO: First iteration in creating a ...
-1
votes
1answer
133 views

Why don't online banks use WebAuthn? [closed]

My ideal bank would offer online banking from a browser with user/pwd and WebAuthn, for example with a NFC or USB key. No OTP or SMS or apps on the smartphone or physical devices required. (It goes ...
2
votes
1answer
78 views

Yubikey - WebAuthn and U2F

I have a yubikey which supports only U2F. It doesn't support FIDO2. I read about U2F and i understand how it works. When i test my Yubikey for WebAuthn on https://webauthn.io it works. I wanted to ...
1
vote
1answer
58 views

2fa attestation object for non-repudiation

I am reading on digital signatures: A valid digital signature gives a recipient reason to believe that the message was created by a known sender (authentication), that the sender cannot deny ...
5
votes
1answer
266 views

Is it possible to use WebAuthn for digitally signing documents in the browser?

WebAuthn is a relatively new API for authentication, and it uses public key cryptography instead of something like passwords. I am wondering if it is possible to use the cryptographic part for a ...
1
vote
1answer
123 views

FIDO2: will FIDO foundation MDS 1.0 metadata statements be migrated to MDS 2.0?

The FIDO foundation provides with metadata web service for UAF (MDS 1.0, https://mds.fidoalliance.org/) and a new web services for FIDO2 / WebAuthn metadata (MDS 2.0, see https://fidoalliance.org/...
1
vote
1answer
54 views

What is the motivation behind supporting both `none` and `self` attestation in WebAuthN?

WebAuthN seems to provide essentially two different ways of not performing verifiable attestation: Either by the Relying Party requesting none or by the authenticator choosing self attestation. Is ...