Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
101010.pl is one of the many independent Mastodon servers you can use to participate in the fediverse.
101010.pl czyli najstarszy polski serwer Mastodon. Posiadamy wpisy do 2048 znaków.

Administered by:

Server stats:

507
active users

101010.pl: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.0-beta.1

#webauthn

1 post1 participant0 posts today
Naty

I've stopped using Firefox since the drama a while back... Using #ZenBrowser and #LibreWolf mainly on macOS and on #Android, #Ironfox and #Cromite (as an alt browser). But I'm having quite a lot of website functionality problems when using Ironfox. Can't create accounts, forms not working, can't use #webauthn, pages not loading correctly, checkouts or shopping sites broken, etc. I guess I need to have #Firefox still installed... It's annoying. What's your workaround? #browsers #androidbrowser

Replied in thread
Claus Holm Christensen

@sarahjamielewis I would like to hear answers to that question as well. I have not tried it myself, but I'm considering #Keycloak for something like that.

I would also suggest the hashtags #passkey #webauthn and #fido to gather the attention of the right people?

If you're ready to learn the technical details, then there is a Tour of WebAuthN here: imperialviolet.org/tourofwebau

www.imperialviolet.orgA Tour of WebAuthn
Erik van Straten

Passkey advice (ncsc.gov.uk)

From ncsc.gov.uk/blog-post/passkeys (highly condensed by me):
❝
What then are the remaining problems with passkeys?
🔸 Inconsistent support and experiences
🔸 Device loss scenarios
🔸 Migration issues
🔸 Account recovery processes
🔸 Platform differences
🔸 Implementation complexity
🔸 Inconsistent use
🔸 Uncertainty around multi-factor status
❞

🔹 I recently wrote about a number of Android an iOS/iPadOS vulnerabilities (including account lock-out risks) in infosec.exchange/@ErikvanStrat and a couple of follow-up toots.

🔹 People wanting to know the basics of passkeys can read a somewhat acceptable translation from Dutch to English of my writeup "Passkeys for laymen", which can be seen by opening www-security-nl.translate.goog (which seems to work in Chrome). The original article, in Dutch, can be seen in security.nl/posting/798699/Pas.

🔹 A good source of (unbiased!) info is also Dan Goodin's article in arstechnica.com/security/2024/.

🔹 Finally: the problem with passwords starts with a 'p': it's PEOPLE. Use a password manager as I describe in infosec.exchange/@ErikvanStrat (with Android screenshot: infosec.exchange/@ErikvanStrat).

www.ncsc.gov.ukPasskeys: they're not perfect but they're getting betterPasskeys are the future of authentication, offering enhanced security and convenience over passwords, but widespread adoption faces challenges that the NCSC is working to resolve.
#Passkeys#WebAuthn#FIDO2
Matthew Miller :donor:

SimpleWebAuthn v13.1.0 is out! Changes include addressing a DeprecationWarning in the console about a "punycode" module; and startRegistration() and startAuthentication() now warn about but try to handle calls made using the older API call structure seen in lots of existing tutorials (with a link to help explain how to refactor.)

github.com/MasterKale/SimpleWe

GitHubRelease v13.1.0 · MasterKale/SimpleWebAuthnChanges: [server] The cross-fetch dependency has been removed from the project to silence in the console DeprecationWarning's about a "punycode" module (#661) [browser] startRegistration() and sta...
#webauthn#passkeys#typescript
Replied in thread
*
Erik van Straten

@adamshostack : apart from marketing purposes, I fail to see the advantage of using public keys for WebAuthn (FIDO2 and passkeys).

IMO *the* advantage of WebAuthn is that software refuses to authenticate if the domain name is incorrect (AitM attacks are possible only if the attacking server possesses a certificate considered valid by the user's browser).

The fact that a (WebAuthn) public key is (hopefully) randomly chosen, and is a lot longer than most passwords are, has nothing to do with cryptography.

Of course, if an attacker is able to copy a (Webauthn) public key from a server, it is of no use to them. However, the same applies to a randomly chosen unique password (in the end, the attacker already had access to the user's account on the server).

OTOH, if an attacker obtains access to a server, they may silently *add* their own public key (something typically not possible in the case of a password). They may choose to *replace* the public key (or password), but that would lock out the user - which may not be what the attacker wants.

Even if it is typically extremely hard for an attacker (with remote access to a user device) to obtain a (WebAuthn) private key, grabbing a session cookie (or JWT etc.) is likely a lot easier. That is, until we have Device Bound Session Credentials (wicg.github.io/dbsc/).

But even then, if a user device is sufficiently compromised, the user may be fooled by what they see and how the attacker manipulates their input. Device compromise means game over.

Another aspect is that the better the WebAuthn private keys are protected, the harder it is to make backups of them, increasing the risk of account lockout and vendor lock-in.

@andre

wicg.github.ioDevice Bound Session Credentials
#WebAuthn#FIDO2#Passkeys
Matthew Miller :donor:

Heya TypeScript + WebAuthn fans, I just published v13 of SimpleWebAuthn! This one includes (opinionated) registration hints support, improved support for attestation trust anchors, and a surprise retirement of the types library (for baking-in the types instead into both the browser and server libraries.) Check out the release notes for more info!

github.com/MasterKale/SimpleWe

GitHubRelease v13.0.0 - The one where they share a type · MasterKale/SimpleWebAuthnHot on the heels of the last major release, v13 introduces support for registration hints! Refined types and improved attestation trust anchor verification are also included. Last but not least, we...
#simplewebauthn#webauthn#passkeys
Replied to stf
Matthew Miller :donor:

Hey, great callout @stf, thanks for the nudge! I'm happy to report that as of a couple of minutes ago you can now test out Ed25519 support on webauthn.io, check it out!

I ran through a couple of YubiKey registrations and confirmed I got back Ed25519 public keys. They validated just fine thanks to long-time support for the algorithm in py_webauthn 🐍

#webauthn.io #passkeys #webauthn

ExploreLive feeds
About