Hacker News Reader

I don't understand how does it work. If I'm using just desktop and don't have mobile phone or any specialized hardware, I can't login?

View on HN

Correct. You'll need a FIDO key to log in in that case

What in the spec precludes this from being implemented in software?

[edit] Reading more of the spec it definitely seems like they meant for it to be possible to implement this in software. So while a physical FIDO device might be preferable, it shouldn't be necessary.

Where would that software run? In the browser or a separate app?

Probably in a separate app, like the current system level key/password management solutions.

It looks like https://github.com/github/SoftU2F would work for that.

I believe Chrome’s dev channel also has experimental soft webauthn support.

Also Krypt uses it to store keys on your phone: https://krypt.co/

Currently, it does not because the browser aborts when it loses focus: https://github.com/github/SoftU2F/issues/51

https://webauthn.guide is a quite good overview of the spec

Reply on news.ycombinator.com