Slashdot Mirror
Firefox Moves Browsers Into Post-Password Future With WebAuthn Tech (cnet.com)
Today, Mozilla released Firefox 60 for Windows, Mac, Linux and Android, and with it arrives Web Authentication API for desktop browsers. From a report: Firefox 60 supports technology called Web Authentication, or WebAuthn for short, that can be used to grant you access to websites with a physical authentication device like a YubiKey dongle, biometric identity proof using an Android phone's fingerprint reader or the iPhone's Face ID, and some other alternatives to passwords.
Passwords are a particular problem on the web. Fake websites can coax you to type in credentials that then can be used to steal money from your bank account or snoop your email -- a problem called phishing. Even if you pick hard-to-guess passwords, never reuse them on multiple sites and always remember them, passwords still aren't that strong a foundation for security these days. We're still a long way away from a post-password future, but WebAuthn is an important step, if nothing else, in making sites more secure.
Passwords are a particular problem on the web. Fake websites can coax you to type in credentials that then can be used to steal money from your bank account or snoop your email -- a problem called phishing. Even if you pick hard-to-guess passwords, never reuse them on multiple sites and always remember them, passwords still aren't that strong a foundation for security these days. We're still a long way away from a post-password future, but WebAuthn is an important step, if nothing else, in making sites more secure.
I already declared the death of Firefox with the release of version 57, and now they are sinking the lifeboats with version 60 replacing the last usable ESR. This will now leave Windows XP which still has 10% market share in China without a updated browser, which means developers will have to make the choice of either sacrificing 10% of their revenue or risk security holes to get that revenue. There is hope for XUL though thanks to the work on Basilisk and Waterfox, plus NPAPI plugins will be supported on these browsers so legacy web apps will continue to work. I will not be attending Firefox's funeral, as Mo$illa decided to put adverts on its gravestone.
I think with all this new AI stuff that was invented we would have something better than typing in a string to authenticate a user. Aren't computers intelligent?
gathers G.A.Y N1GGERS from all over America and abroad for one common goal - being G.A.Y N1GGERS.
Are you G.A.Y ?
Are you a N1GGER ?
Are you a G.A.Y N1GGER ?
If you answered "Yes" to any of the above questions, then G_N_A_A (G.A.Y N1GGER ASSOCIATION OF AMERICA) might be exactly what you've been looking for!
Join G_N_A_A (G.A.Y N1GGER ASSOCIATION OF AMERICA) today, and enjoy all the benefits of being a full-time G_N_A_A member.
G_N_A_A (G.A.Y N1GGER ASSOCIATION OF AMERICA) is the fastest-growing G.A.Y N1GGER community with THOUSANDS of members all over United States of America. You, too, can be a part of G_N_A_A if you join today!
Why not? It's quick and easy - only 3 simple steps!
First, you have to obtain a copy of G.A.Y N1GGERS FROM OUTER SPACE THE MOVIE and watch it.
You can watch G.A.Y N1GGERS FROM OUTER SPACE on Youtube.
Second, you need to succeed in posting a G_N_A_A "first post" on slashdot.org , a popular "news for trolls" website
Third, you need to join the official G_N_A_A irc channel #G_N_A_A on EFNet, and apply for membership.
Talk to one of the ops or any of the other members in the channel to sign up today!
If you are having trouble locating #G_N_A_A, the official G.A.Y N1GGER ASSOCIATION OF AMERICA irc channel, you might be on a wrong irc network. The correct network is EFNet, and you can connect to irc.secsup.org or irc.easynews.com as one of the EFNet servers.
If you do not have an IRC client handy, you are free to use the G_N_A_A Java IRC client by clicking here.
If you have mod points and would like to support G_N_A_A, please moderate this post up.
This post brought to you by Penisbird , a proud member of the G_N_A_A
G_____________________________________naann_______ ________G
N_____________________________nnnaa__nanaaa_______ ________A
A____________________aanana__nannaa_nna_an________ ________Y
A_____________annna_nnnnnan_aan_aa__na__aa________ ________*
G____________nnaana_nnn__nn_aa__nn__na_anaann_MERI CA______N
N___________ana__nn_an___an_aa_anaaannnanaa_______ ________I
A___________aa__ana_nn___nn_nnnnaa___ana__________ ________G
A__________nna__an__na___nn__nnn___SSOCIATION_of__ ________G
G__________ana_naa__an___nnn______________________ ________E
N__________ananan___nn___aan_IGGER________________ ________R
A__________nnna____naa____________________________ ________S
A________nnaa_____anan____________________________ ________*
G________anaannana________________________________ ________A
N________ananaannn_AY_____________________________ ________S
A________ana____nn_________IRC-EFNET-#G_N_A_A________ ________S
A_______nn_____na_________________________________ ________O
*_______aaaan_____________________________________ ________C
Gary Niger gary_niger@G_N_A_A.us G_N_A_A Corporate Headquarters 143 Rolloffle Avenue Tarzana, California 91356
Enid Al-Punjabi enid_al_punjabi@G_N_A_A.us G_N_A_A World Headquarters No.33 Kyutei Bld. 2F, Shinjuku 2-11-7, Shinjuku-ku, Tokyo, Japan ????????2??11-6
Copyright (c) 2003-2015 G.A.Y N1GGER Association of America
Ich Bindawalross (London) - G_N_A_A (NYSE:
The more sites require you to login with a system like this, the less time I'll waste online.
While I appreciate some of the benign use cases they are supporting, this will be bad for the web in the long term. Creating that level of standardized interaction moves us closer to authentication being performed by persistent identity rather than something in our possession. Whether mandated by law, market fiat, or a combination of the two, we need to be wary of this threat. Cross-site identity is the keystone for wholesale privacy violations and mass censorship,
So just replace the first factor with the second one?
The problem with biometric data for unlocking your devices or websites is that Governments are starting to argue that they can use your biometrics without your permission, as it's publicly available. An officer can hold your phone up to your face to unlock it that way, and they already have your fingerprints after an arrest, so it's not a huge leap to use that power to make you unlock a device.
Whereas a pin or password requires divulging privileged information and thus requires a warrant, at least in the US, biometric data is on shakier legal grounds.
Comment removed based on user account deletion
I would have guessed WebAuth to be a bit smoother...
XML is like violence. If it doesn't solve the problem, use more.
So I have to have a physical key, magically have copies of it on all my devices, and I'm screwed if I want to log into my account on another computer for some reason. No thanks, I'll keep my passwords.
I still have more fans than freaks. WTF is wrong with you people?
"Pocket" is a no-go, no matter how much you try to sugar-coat that turd...
Yes, ads. Apparently they still have too many users.
how do companies this bad stay in business?
just.... no.
if this is supposed to be a new economy, how come they still want my old fashioned money?
Almost 10 years old, and more timely than ever.
Biometrics
Does this mean we will finally be getting a browser JS API for talking to PKCS#11 devices so we can do something more interesting with them besides mutual TLS authentication? I'd love to be able to, for example, bind a web server session to a remote AD using a browser-supplied hardware token, but right now that is virtually impossible unless you've jumped through all the hoops necessary to get NTLM working.
Aren't all of these technologies completely susceptible to a standard man in the middle attack? It is not at all clear how these are any better than passwords in a hostile environment.
It should be interesting to see which tech is finally decided upon by TPTB.
Having biometric information is in no way proof of an identity.
Passwords are a particular problem on the web. Fake websites can coax you to type in credentials that then can be used to steal money from your bank account or snoop your email -- a problem called phishing. Even if you pick hard-to-guess passwords, never reuse them on multiple sites and always remember them, passwords still aren't that strong a foundation for security these days. We're still a long way away from a post-password future, but WebAuthn is an important step, if nothing else, in making sites more secure.
Is the person who wrote this a moron, or did they just suffer a stroke? If a fake Web site can coax you to type in credentials, why can't it coax you to use your Yubikey or fingerprint scanner? Then, how does it cure the problem of using a single password on multiple sites to have a single piece of hardware or meatware serve as your login on multiple sites?
For this use case Smart Lock is just a password manager.
Comment removed based on user account deletion
Can't be replaced if you want security.
When all the zero days are cleaned up
When all the snoopy alphabet agencies obey the laws
When Linux goes six months without a kernel update
When there are no more russian hackers
When there are international cyberwarfare treaties
Then get back to me about my password hygiene
Man, I'm f*cking tired of this shit.
Stop spreading the false myth that a new standard, biometrics, or whatever is gona "replace" passwords, or that there is a post password future, or bullshit like that.
What passwords provides is fundamentally different from what biometrics can offer.
If you can't understand this, you should not be reporting on these things, period, because you are only contributing to misinformation and misunderstandings on the very basics of security.
It's because of shitty practices like these that we are in the deep privacy end hole that we are now. There is no foreseeable "post password future". And not by a long stretch when it's relying on proprietary and closed off systems for it.
For something to completely replace passwords it needs to be something you know, that can be easily changed, and cannot be taken from you by force, when you are unconscious or something like that. If it can't, it cannot replace passwords, period. It won't end the era of passwords, it won't take it's place, and it cannot by definition, be used in several cases where passwords are required.
Biometrics and this new standard will add convenience to a form of authentication that while it can be enough for lots of things, or can be paired with passwords for added security, it does not offer the same level of security as passwords because it can be taken from you, some of them without you even knowing. They cannot be easily replaced as they are part of your identity, uniquely tied to you. And they'll be highly dependant on proprietary hardware and software schemes to maintain integrity.
And pointing out phishing as a flaw of passwords is just stupid. As soon as biometrics becomes more widespread, social engineering strategies to get what's needed to unlock them will rise. It's just the way it is. And yes, some of them might be very secure these days, but methods will arise to spoof, replicate, and just take it straight from the source. The proper way to see webauthn and biometrics is as a layer of security that is convenient, but isn't perfect and isn't impossible to bypass. You use as many layers you need, and weight the pros and cons of each for your usage. But f*cking stop saying that they'll be replacing passwords. We've been there before. Look how many biometric authentication methods were broken so far, look how many problems this assumption of replacing stuff with biometrics has already brought. Just. Stop. It.
Yeah, because something you have is better security than something you know, right?
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
"Firefox Moves Browsers Into Post-Password Future"
"We're still a long way away from a post-password future..."
There is nothing wrong with passwords. On all the many servers I administer the number of attempted password hacks is almost zero.
There are constant attempts by numerous actors to scare everybody into assuming that something needs to be done. Nothing needs to be done.
In fact, something needs to be done about all of those actors attempting to scare everyone into adopting their technology.
It's been working very well for me.
If for some reason it went away, I would reluctantly go back to FF.
My beliefs do not require that you agree with them.