Questions tagged [webauthn]

The tag has no usage guidance.

16 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5 votes
1 answer
506 views

Do passkeys on iCloud Keychain ever exist unencrypted outside the secure enclave?

Regarding Apple's beta feature of storing WebAuthn passkeys in the iCloud Keychain, does anybody know if the unencrypted passkeys ever leave the secure enclave, and get stored in RAM or anything? With ...
Mohamed Hafez's user avatar
4 votes
2 answers
512 views

How to properly manage WebAuthn challenges?

I'm in the process of evaluating adding WebAuthn/Passkey support to a website, and I'm not really sure how to properly manage challenge nonces. My understanding is that the main reason for using ...
Dolda2000's user avatar
  • 191
3 votes
0 answers
131 views

How to add a new webauthn key if the existing one isn't portable

Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, ...)...
Jonas Osburg's user avatar
2 votes
0 answers
106 views

Did Android remove Fingerprint/Passcode for WebAuthN and lower security to push Passkeys?

So, before this year, when you were using WebAuthN to create security keys on an up to date Android phone (Pixel 6 in my case), you had these options (iirc): When creating a platform authenticator, ...
xsrf's user avatar
  • 178
2 votes
1 answer
3k views

Implementing FIDO2 (WebAuthN) in Native iOS

I am currently investigating the idea of implementing FIDO2 (WebAuthN) support in native iOS using Swift. I understand that there is no FIDO2 support in native iOS, and only available through Safari ...
Go James 's user avatar
1 vote
0 answers
151 views

FIDO Multi-device Authentication Sync Technical Specification

Where/what are the technical specifications to sync FIDO passkeys? FIDO passkeys are a quite hot topic. There is a white paper from FIDO Alliance about it. Several websites provide abstract ...
ndbd's user avatar
  • 201
1 vote
0 answers
258 views

Is it possible to see the pubkeys that pair with private keys inside the TPM in Windows?

Is it possible to inspect data (pubkeys, domain names used for webauthn, not private keys) related to private keys stored in the TPM on Windows? I legally own the hardware and have maximum ...
mikemaccana's user avatar
1 vote
1 answer
116 views

Set-up Apple Passkey for private users

The demos I've seen for Passkey assume that any public user can register with a website. What about the situation where you want to set up a passkey for an admin user of a website? i.e. How does an ...
Ian Warburton's user avatar
1 vote
0 answers
154 views

Fido U2F, can a modified client theoretically register the same key multiple times? YubiKey Wrapped PrivateKey Method

Context I was answering a question about how YubiKey can generate "infinite" keypairs for Fido U2F but doesn't need to store them locally. This leads to my initial question: Initial Question ...
PathToLife's user avatar
1 vote
0 answers
122 views

WebAuthn Variation with non-connect dongle Authenticator

As I read through the WebAuthn / FIDO2 documentation, it appears the authentication is done on the local device to create an attestation to the FIDO server. This future implies the "biometrics" or ...
mazecreator's user avatar
1 vote
2 answers
1k views

Are passkeys a secure replacement for 2FA?

Passkeys seems great for me as an individual, instead of passwords and TOTP tokens I can now slowly ditch the passwords and the somewhat annoying (but important!) TOTP tokens which I have locked in my ...
Anthon Nilsson's user avatar
0 votes
0 answers
44 views

storing user hashed password into webauthn id

I am building a pure client-side app. My users have a .kdbx vault stored in localStorage, and they can open it with a password. In order to add a biometric\quick open feature into the app I thought ...
Wazime's user avatar
  • 101
0 votes
0 answers
64 views

Webauthn: Access control for the public key credential uploaded by the user's device

I'm experimenting with adding passkeys to Drupal. I'm using webauthn-lib 4.7. When registering a passkey, the device generates a Public Key Credential, which is then sent to the server as stringified ...
Patrick Kenny's user avatar
0 votes
2 answers
402 views

What is the point of required user verification in WebAuthn?

User verification in WebAuthn can either be required, preferred, or discouraged. The last two are a hint to the authenticator that may be ignored. I see how they could be used to prevent client-side ...
tobib's user avatar
  • 153
0 votes
0 answers
106 views

Passkeys versus passwords for intranet websites

Do passkeys offer more security for intranet websites compared to passwords? I know there are additional methods like 2FA to get more security, but I just want to look at a optional replacement for ...
fitcfitcfatc's user avatar
0 votes
1 answer
382 views

Risks with OpenSSL verifying a signature with un-trusted PEM encoded public key

If a website user wants to use WebAuthn, they will start by creating a credential, where their authentication device provides a public key. This key is encoded, and sent back to the server to store ...
Craig Francis's user avatar