Hacker News Reader

Comment by dyml | Hacker News Reader

This is wonderful news! If anyone is interested in experimenting we built an API that makes it very simple to add WebAuthn (passkeys) to your existing web app.

It’s available at https://passwordless.dev

Note: We also maintain the open source fido2-net-lib, the API just lowers the friction for devs.

View on HN

You might at least want to put a warning there for people who access the page with unsupported browsers? There's nothing on the left of "⬅ Go ahead... click it." for me.

Good idea, thanks!

I've used this gem for rails apps https://github.com/cedarcode/webauthn-ruby

This is really cool! And well-timed - I have a project coming up this would be perfect for. The only thing I wonder is, if a user didn’t have biometrics on their device, how would they authenticate? Would I have to maintain a backup system for these users?

In general they just need _something_. If Windows Hello has even a pin number, Chrome and FF webauthn prompts will use Windows Hello as a TPM provider (assuming the website is using actual Webauthn and not the older U2F-compatible standard, which some sites still use for compatibility, eg google). If they don't have anything, then they will definitely need at least a usb hardware key.

Biometrics are not needed, however device support is not 100%.

If the user is not running a model OS they could still be supported by using what is known as a security key (yubico) etc.

The Passwordless API can also help with out of band authentication (using a iOS device to sign in on unsupported old laptop)

i use fido2-net-lib for a personal auth site, it works great! thanks for all your work!

Hey! Happy to hear Making this tech available has been our goal since inception

Reply on news.ycombinator.com