• @jetA
    link
    English
    323 days ago

    Fido2 solves this already …

    • NaN
      link
      fedilink
      English
      1
      edit-2
      23 days ago

      Passkeys are FIDO2. The issue is the tokens don’t have much storage for them. For passwordless vs use as a second factor, it has to store it instead of dynamically generating a response to a challenge. They are two features of the protocol.

      https://www.yubico.com/blog/a-yubico-faq-about-passkeys/

      • @jetA
        link
        English
        323 days ago

        https://developers.yubico.com/Passkeys/Passkey_concepts/Discoverable_vs_non-discoverable_credentials.html

        While non-discoverable credentials are not considered passkeys, you should still be aware of them as there are still a number of valid scenarios where your application will need to support the use of them - especially as they are still valid WebAuthn credentials. These are credentials that cannot be generically invoked by a relying party. Instead a user will need to prompt the relying party with a username (user handle) to have the application provide a list of credential IDs to denote which credential(s) can be leveraged for authentication.

        Fido2 webauthn non-discoverable credentials are completely unlimited. Because the private key is on the yubikey directly. The only downside of this, is you have to type in your username first, but I think that’s an upside personally. I do not want anybody who compels disclosure of my hardware security key, to see all the accounts on it.

        • NaN
          link
          fedilink
          English
          2
          edit-2
          23 days ago

          Are your non-discoverable credentials also locked on the key, or can someone who knows your handle and possesses your key access your accounts? Online usernames are not well protected, I’d rather my key lock out after a few failed attempts to access it.

          • @jetA
            link
            English
            2
            edit-2
            23 days ago

            The non-discoverable keys cannot be removed from the device. The secret is non-transferable.

            In the yubikey bio series, this is implemented as a second factor. So you log in, and then present your hardware key as a second factor. You need your fingerprint, the key, your username. Fairly secure.

            I think this is a more secure model than pass keys as they’re being promoted today

            • NaN
              link
              fedilink
              English
              1
              edit-2
              23 days ago

              Yes, but do you need to unlock your key to use it? Possession is not enough to access discoverable credentials.

              You edited, but I don’t see this as significantly more secure than the Passkeys, and most keys are not the bio series (not that I trust fingerprint readers anyway).

              • @jetA
                link
                English
                123 days ago

                Yes you need to unlock the The hardware key

                • NaN
                  link
                  fedilink
                  English
                  223 days ago

                  In that case it does sound better, and many sites using passkeys still have you enter your username first anyway, at least at this point. I don’t know how Android implements it, I think iOS likely supports this use case and know that it also works as a second factor to a password through the same Passkey workflow. Unlike the Yubikey it always stores the key when you register though, even if it isn’t fully passwordless. Unfortunately what’s easy for the consumer will dominate.

                  • @jetA
                    link
                    English
                    123 days ago

                    I think the argument and the article is users just are going to avoid this whole confusing mess

                    And I would absolutely like the ability to use hardware key to log into multiple accounts on the same service.