W3C Approves WebAuthn as the Web Standard For Password-Free Logins (venturebeat.com)

The World Wide Web Consortium (W3C) today declared that the Web Authentication API (WebAuthn) is now an official web standard. From a report: First announced by the W3C and the FIDO Alliance in February 2016, WebAuthn is now an open standard for password-free logins on the web. It is supported by W3C contributors, including Airbnb, Alibaba, Apple, Google, IBM, Intel, Microsoft, Mozilla, PayPal, SoftBank, Tencent, and Yubico. The specification lets users log into online accounts using biometrics, mobile devices, and/or FIDO security keys. WebAuthn is supported by Android and Windows 10. On the browser side, Google Chrome, Mozilla Firefox, and Microsoft Edge all added support last year. Apple has supported WebAuthn in preview versions of Safari since December.

Comments

Thanks, but no thanks

[DogDude]

Use a *mobile device* for logging in somewhere? That seems like an extraordinarily bad idea. I wouldn't trust a mobile device for anything that requires security. They come already compromised by Google/Apple, and then most people load them up with all sorts of "apps" that are actually tracking/monitoring programs.

I'm sure most people will love it.

Re:Thanks, but no thanks

[AmiMoJo]

Most people use really bad passwords over and over for multiple sites. Thus being able to use their mobile device is a vast improvement to their security.

By the way, do you have any evidence that Google/Apple are actually a security threat to you? For example, it seems like law enforcement is forced to spend hundreds of thousands of dollars to compromise phones because Google/Apple refuse to help them, so I'm wondering exactly what your threat model is.

Re:Thanks, but no thanks

[Anonymous Coward]

"For example, it seems like law enforcement is forced to spend hundreds of thousands of dollars to compromise phones because Google/Apple refuse to help them, so I'm wondering exactly what your threat model is."
 
For a lot of people you just spelt it out. :) Different AC here and I don't find Apple refusing to unlock a phone a threat to me. I do find Google's tracking to be a threat though. Half the web is locked away if you refuse to play with Google. That is by design. I find the inability my phone to work with Google a threat. I mean I bought it from Samsung, why is Google controlling it. Why does Play keep asking to sync my contacts when I have said no many times but if I ever say yes it won't ask again. So yes, I feel threatened by Google because I know they are using what I do, say, who I relate to and with to make money or acquire power. Google should be broken up. We are of course talking about a company that was caught uploading 1GB a month of data from Aussie customers without telling them and tracking users even when location services have been turned off.

Re:Thanks, but no thanks

[WaffleMonster]

Most people use really bad passwords over and over for multiple sites. Thus being able to use their mobile device is a vast improvement to their security.

The vector actually being exploited in the real world is the user. This is addressable by deployment of secure authentication protocols which protect users from themselves.

Throwing up new barriers that either have a negative impact on security (Automated password/device reset/recovery) or increase annoyance and risk of nuisance lockout... (my device broke and I can't login anymore) are not helpful to real people. They are simply annoying and pointless.

Fixing actual problems with password authentication by widespread use of secure authentication helps everyone.

By the way, do you have any evidence that Google/Apple are actually a security threat to you?

The question people face in the real world is "Can I trust x?" not "Can I prove x is untrustworthy?" Humans don't tend to entrust things of value to strangers based on absence of evidence of untrustworthiness. This isn't a useful, practical or reasonable standard.

For example, it seems like law enforcement is forced to spend hundreds of thousands of dollars to compromise phones because Google/Apple refuse to help them, so I'm wondering exactly what your threat model is.

My understanding is it's mostly Apple. Android is way less secure. Misleading to address them as you have on the same level.

Most peoples adversaries are not law enforcement. Our adversaries are stalkers and criminal enterprise that routinely exploit hostile permissive system of take it or leave it demands baked into Android by Google at the behest of app store vendors.

Re: Thanks, but no thanks

[Anonymous Coward]

If you have to ask, that means you aren't invited.

Drumroll please

[TimMD909]

W3C meet your new friend Unintended Consequences. I'm sure you two will get along great...

So I'll be even more locked out now?

[Anonymous Coward]

"using biometrics"
I sure have no such hardware, nor any want to use one...

"mobile devices"
Would never use a surveillance device, and neither would any sane person.

"FIDO security keys"
I haven't the faintest idea what this even is. Fidonet?

One or Many?

[ardmhacha]

"W3C Approves WebAuthn as the Web Standard For Password-Free Logins"

"WebAuthn is now an open standard for password-free logins on the web"

So is there one standard or many?

Re:One or Many?

[bluefoxlucid]

There are probably many, and this is one which is endorsed by the central authority.

I wish they'd have included PKI as part of the FIDO standards. Those security keys would have been amazing for that. Plug in and read your e-mail, all messages end-to-end encrypted.

Re:One or Many?

[DontBeAMoran]

So is there one standard or many?

Yes.

Re:One or Many?

[Fly Swatter]

There is one W3C approved password-free login standard.

There are many open standards.

Context matters.

Re:One or Many?

[fbobraga]

Nice! I knew it!

Something you have.

[Anonymous Coward]

So instead of something you have / know / are - choose any two - it's now "Something you have." It's a great improvement over the atrociously insecure "We'll [collect your phone number for our database] and send a text to your cell phone [which might not even be your phone because SS7 is hopelessly insecure]" but killing the password entirely simply shifts the problem to how do you secure a bunch of Yubikeys?

How do I, for example, log in using a CLI? How is this any different than, say, storing my private key in ~/.ssh? How do I, for that matter, do anything with this that doesn't involve a web browser?

Re:Something you have.

[moronoxyd]

So instead of something you have / know / are - choose any two - it's now "Something you have."

WebAuthn is not a replacement for 2FA, but for password logins. So where before you only had "something you know" you can now chose between "something you have (FIDO key) / know (password) / are (biometrics)".

Re:Something you have.

[Meneth]

Both of which are harder to replace when their server counterparts are deleted or leaked.

Re:Something you have.

[moronoxyd]

"Both of which"? I listed three things, so you should specify which two you are talking about (probably somethng you have and something you are).

My comment didn't make any statement about the usefullness or security of WebAuthn but was only meant to point out that ACs comment was based in misrepresentation.

Sell your data to any bidder

[stooo]

>> sell users' info the the highest bidder.

Nope. They sell your data to any bidder. Why would they limit themselves to only one ?

Re:Sell your data to any bidder

[AmiMoJo]

How does one access these user data auctions? Presumably they are wide open to everyone, in order to maximize profit.

The opposite is true

[SuperKendall]

Use a *mobile device* for logging in somewhere? That seems like an extraordinarily bad idea. I wouldn't trust a mobile device for anything that requires security.

That's kind of hilarious because the OPPOSITE is true. You are an idiot if you trust any desktop OS to truly secure material, with years of hidden security holes and apps not really that well sandboxed.

I only deal with banks now through mobile apps if I can help it, because it is WAY more secure. I can control what updates go on my device, I can be far more sure that some random app cannot see what is going on with the banking app.

most people load them up with all sorts of "apps" that are actually tracking/monitoring programs.

Only while I'm using the apps. I'm on iOS, I choose what and when they can see anything related to what I am doing.

Re:The opposite is true

[fbobraga]

I'm on iOS

Now I've got your thoughts... if you need security, open source software OS is not an option

Fucking useless

[Pinky's Brain]

Why is the server standard not also a W3C standard? Then maybe we would have EdDSA as required instead of recommended like in the FIDO2 clusterfuck.

Nobody used the many

[raymorris]

We put several authentication options in the HTTP spec back in the 1990s. Some pretty secure, one was specifically marked as not secure. It was intended to be used the same way you'd use the latch on a bathroom stall. Of the three standards, the only one anyone ever used was trivial one, basic authentication. After that most people started coding their own really bad authentication schemes, often based on PHP sessions.

Then came SAML. A lot of larger companies used SAML, for handing off users after they were originally authenticated by crap homemade authentication.

Now we have an effort by the major companies to standardize on actually using a non-crap (but not perfect) protocol. There are plenty of other decent protocols you can use, but virtually nobody uses them. The problem isn't a lack of decent protocols. The problem is that nobody uses the decent protocols, either because they don't know about them or they think that it'll be easier to come up with some homemade crap. We'll see if this effort gets people actually using a non-crap design.

Re:Nobody used the many

[grep -v '.*' *]

they think that it'll be easier to come up with some homemade crap. We'll see if this effort gets people actually using a non-crap design.

But building new stuff is interesting and I already know exactly how it "works" -- reading books and RFPs is hard, and you have to think about it, and those guys are all just too stuffy and boring in the first place.

I'm a programming literary giant -- like e. e. cummings, Robert Frost, and Katy Perry. *I* don't produce crap -- I produce architectures, masterpieces, just wonderful walls of code that make other people cry.

Re:Nobody used the many

[RespekMyAthorati]

You don't have orange hair do you?

What about SQRL?

[MycoMan]

Isn't this the best answer? Mr. Gibson's carefully thought out technology - and open.
https://www.grc.com/sqrl/sqrl.htm

Re: What about SQRL?

[mu22le]

I kind of like the idea but there are a few downsides:
- They have no backing from large players, partly because of the project aversion to them.
  - No device -> no login. there is no way to login on an internet café if you lose your phone (unless you have a copy of your seed in your wallet and blindly trust the café). This is, again, partly because of the project aversion to big players playing the role of gatekeepers.
  - possibly patent encumbered. The project tries to handwave it away, but they should really pay a lawyer and they probably don't have the money.

WebAuthn is not fit for release

[Srin Tuar]

They rolled their own custom elliptic curve, amateurishly.

They have mandatory support for weak/broken RSA modes.

https://paragonie.com/blog/201...

Re:WebAuthn is not fit for release

[Pinky's Brain]

As long as your client/key doesn't use them it's not much of a problem (for you) that the server does.

Obligatory

[fbobraga]

https://xkcd.com/927/