Slashdot Mirror
Firefox Moves Browsers Into Post-Password Future With WebAuthn Tech (cnet.com)
Today, Mozilla released Firefox 60 for Windows, Mac, Linux and Android, and with it arrives Web Authentication API for desktop browsers. From a report: Firefox 60 supports technology called Web Authentication, or WebAuthn for short, that can be used to grant you access to websites with a physical authentication device like a YubiKey dongle, biometric identity proof using an Android phone's fingerprint reader or the iPhone's Face ID, and some other alternatives to passwords.
Passwords are a particular problem on the web. Fake websites can coax you to type in credentials that then can be used to steal money from your bank account or snoop your email -- a problem called phishing. Even if you pick hard-to-guess passwords, never reuse them on multiple sites and always remember them, passwords still aren't that strong a foundation for security these days. We're still a long way away from a post-password future, but WebAuthn is an important step, if nothing else, in making sites more secure.
Passwords are a particular problem on the web. Fake websites can coax you to type in credentials that then can be used to steal money from your bank account or snoop your email -- a problem called phishing. Even if you pick hard-to-guess passwords, never reuse them on multiple sites and always remember them, passwords still aren't that strong a foundation for security these days. We're still a long way away from a post-password future, but WebAuthn is an important step, if nothing else, in making sites more secure.
I already declared the death of Firefox with the release of version 57, and now they are sinking the lifeboats with version 60 replacing the last usable ESR. This will now leave Windows XP which still has 10% market share in China without a updated browser, which means developers will have to make the choice of either sacrificing 10% of their revenue or risk security holes to get that revenue. There is hope for XUL though thanks to the work on Basilisk and Waterfox, plus NPAPI plugins will be supported on these browsers so legacy web apps will continue to work. I will not be attending Firefox's funeral, as Mo$illa decided to put adverts on its gravestone.
I think with all this new AI stuff that was invented we would have something better than typing in a string to authenticate a user. Aren't computers intelligent?
The more sites require you to login with a system like this, the less time I'll waste online.
While I appreciate some of the benign use cases they are supporting, this will be bad for the web in the long term. Creating that level of standardized interaction moves us closer to authentication being performed by persistent identity rather than something in our possession. Whether mandated by law, market fiat, or a combination of the two, we need to be wary of this threat. Cross-site identity is the keystone for wholesale privacy violations and mass censorship,
So just replace the first factor with the second one?
The problem with biometric data for unlocking your devices or websites is that Governments are starting to argue that they can use your biometrics without your permission, as it's publicly available. An officer can hold your phone up to your face to unlock it that way, and they already have your fingerprints after an arrest, so it's not a huge leap to use that power to make you unlock a device.
Whereas a pin or password requires divulging privileged information and thus requires a warrant, at least in the US, biometric data is on shakier legal grounds.
Comment removed based on user account deletion
I would have guessed WebAuth to be a bit smoother...
XML is like violence. If it doesn't solve the problem, use more.
So I have to have a physical key, magically have copies of it on all my devices, and I'm screwed if I want to log into my account on another computer for some reason. No thanks, I'll keep my passwords.
I still have more fans than freaks. WTF is wrong with you people?
"Pocket" is a no-go, no matter how much you try to sugar-coat that turd...
Yes, ads. Apparently they still have too many users.
how do companies this bad stay in business?
just.... no.
if this is supposed to be a new economy, how come they still want my old fashioned money?
Almost 10 years old, and more timely than ever.
Biometrics
Does this mean we will finally be getting a browser JS API for talking to PKCS#11 devices so we can do something more interesting with them besides mutual TLS authentication? I'd love to be able to, for example, bind a web server session to a remote AD using a browser-supplied hardware token, but right now that is virtually impossible unless you've jumped through all the hoops necessary to get NTLM working.
Aren't all of these technologies completely susceptible to a standard man in the middle attack? It is not at all clear how these are any better than passwords in a hostile environment.
MODDOWN! ; creimer spam post again!
creimer wants you to click on his youtube channel, then click on his stupid amazon affiliate link spam on Youtube. There is nothing of value on creimer youtube channel. Only creimer click-bot goes there.
The tests we ran on Chris have shown that Chris has the intelligence of an ameba:
https://en.wikipedia.org/wiki/...
So, technically, he is able to conceive some kind of agenda but it will be silly or impossible to follow on a human scale.
For example, Chris had an agenda to post anything he felt like on Slashdot which did not work well because it was based on his false beliefs that he had an infinite number of karma points as he wrote here several times.
Several people here explained to Chris that karma maxed out at some level like 50 or so but Chris kept on insisting that his python script had confirmed that he had millions of karma points!
Oh well, as I wrote before: "It isn't Chris' fault if he is the way he is. We do the best we can do with him and he is partially integrated into society. We try to cure his abnormal need for attention but he is kind of stubborn and won't listen to anybody."
For the valuable /. users that might already have read the following, please note that there is an important update.
IMPORTANT UPDATE:
Special Education for the Santa Clara County Office of Education has invested money to buy Chris a new chair:
http://www.keynamics.com/image...
Information about Christopher Dale Reimer and autistic people:
Autistic people have obsessions about things normal people don't care. For example, one of our autistic patient went haywire when he realized that there was a penny missing in his pocket change.
To calm him down, one of our educator pretended to have found it on the floor and gave a penny to him.
The autistic patient condition went even worse because he realized it wasn't the same penny!
Chris has an obsession with budgeting every penny. He doesn't understand that most people do not budget to the penny and have a flexible amount they allow for miscellaneous items.
I am Nancy Guerrero and I am Director of Special Education for the Santa Clara County Office of Education. We use Chris' (a.k.a. creimer,cdreimer) picture in our document because he is the hardest case we have ever had to handle:
http://www.sccoe.org/depts/stu...
Our artists were inspired by the low carb diet that Christopher follows scrupulously for the small lunch box and by the picture linked below for the rest. I am sure that you will notice the similarities such as the bump on the side of his chest and more:
https://ibb.co/gVad65
Please be easy on Christopher although, I am aware that some of our staff handling Chris post joke comments here and obvoiusly, the Santa Clara County Office of Education disapprove that behavior vehemently:
http://ibb.co/mRVSaG
But it isn't Chris' fault if he is the way he is. We do the best we can do with him and he is partially integrated into society. We try to cure his abnormal need for attention but he is kind of stubborn and won't listen to anybody.
Thank You dear users,
---
Nancy Guerrero
Director
Special Education
Santa Clara County Office of Education
It should be interesting to see which tech is finally decided upon by TPTB.
Having biometric information is in no way proof of an identity.
Passwords are a particular problem on the web. Fake websites can coax you to type in credentials that then can be used to steal money from your bank account or snoop your email -- a problem called phishing. Even if you pick hard-to-guess passwords, never reuse them on multiple sites and always remember them, passwords still aren't that strong a foundation for security these days. We're still a long way away from a post-password future, but WebAuthn is an important step, if nothing else, in making sites more secure.
Is the person who wrote this a moron, or did they just suffer a stroke? If a fake Web site can coax you to type in credentials, why can't it coax you to use your Yubikey or fingerprint scanner? Then, how does it cure the problem of using a single password on multiple sites to have a single piece of hardware or meatware serve as your login on multiple sites?
For this use case Smart Lock is just a password manager.
Comment removed based on user account deletion
Can't be replaced if you want security.
When all the zero days are cleaned up
When all the snoopy alphabet agencies obey the laws
When Linux goes six months without a kernel update
When there are no more russian hackers
When there are international cyberwarfare treaties
Then get back to me about my password hygiene
Man, I'm f*cking tired of this shit.
Stop spreading the false myth that a new standard, biometrics, or whatever is gona "replace" passwords, or that there is a post password future, or bullshit like that.
What passwords provides is fundamentally different from what biometrics can offer.
If you can't understand this, you should not be reporting on these things, period, because you are only contributing to misinformation and misunderstandings on the very basics of security.
It's because of shitty practices like these that we are in the deep privacy end hole that we are now. There is no foreseeable "post password future". And not by a long stretch when it's relying on proprietary and closed off systems for it.
For something to completely replace passwords it needs to be something you know, that can be easily changed, and cannot be taken from you by force, when you are unconscious or something like that. If it can't, it cannot replace passwords, period. It won't end the era of passwords, it won't take it's place, and it cannot by definition, be used in several cases where passwords are required.
Biometrics and this new standard will add convenience to a form of authentication that while it can be enough for lots of things, or can be paired with passwords for added security, it does not offer the same level of security as passwords because it can be taken from you, some of them without you even knowing. They cannot be easily replaced as they are part of your identity, uniquely tied to you. And they'll be highly dependant on proprietary hardware and software schemes to maintain integrity.
And pointing out phishing as a flaw of passwords is just stupid. As soon as biometrics becomes more widespread, social engineering strategies to get what's needed to unlock them will rise. It's just the way it is. And yes, some of them might be very secure these days, but methods will arise to spoof, replicate, and just take it straight from the source. The proper way to see webauthn and biometrics is as a layer of security that is convenient, but isn't perfect and isn't impossible to bypass. You use as many layers you need, and weight the pros and cons of each for your usage. But f*cking stop saying that they'll be replacing passwords. We've been there before. Look how many biometric authentication methods were broken so far, look how many problems this assumption of replacing stuff with biometrics has already brought. Just. Stop. It.
Yeah, because something you have is better security than something you know, right?
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
"Firefox Moves Browsers Into Post-Password Future"
"We're still a long way away from a post-password future..."
There is nothing wrong with passwords. On all the many servers I administer the number of attempted password hacks is almost zero.
There are constant attempts by numerous actors to scare everybody into assuming that something needs to be done. Nothing needs to be done.
In fact, something needs to be done about all of those actors attempting to scare everyone into adopting their technology.
It's been working very well for me.
If for some reason it went away, I would reluctantly go back to FF.
My beliefs do not require that you agree with them.