Hacker News Reader

Comment by p-e-w | Hacker News Reader

> What's my basic authentication method to a site or system I can write down, backup, export or memorize?

There isn't one. This is by design. Logging into your bank or email provider will in the future require mobile device shenanigans that are either proprietary or so complex and opaque that you have no chance of "controlling" anything, or even really understanding what's actually going on.

The main lobby driving this forward consists of Google, Apple, and Microsoft. This should tell you all you need to know.

View on HN

What part of WebAuthn, a W3C standard, is "proprietary or [...] complex and opaque"?

The FIDO alliance also consists of far more companies than just "Google, Apple, and Microsoft", although they're certainly members. https://fidoalliance.org/members/

> What part of WebAuthn, a W3C standard, is "proprietary or [...] complex and opaque"?

Ask Mozilla. FIDO U2F is so complicated that Firefox support was hidden behind a config flag for a long time, then "a hard-coded permission for Google Accounts"[1] was implemented in order to not fall too far behind Chrome.

The linked email thread is an eye-opener on how many intricacies and unresolved questions there are, with multiple mentions of non-standard behavior implemented in the Google ecosystem, undermining WebAuthn. This is how such "standards" work in practice, and passkeys will be no exception.

[1] https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGT...

FIDO U2F is not WebAuthn, and if you had even bothered to skim the link you provided, you probably would have realized that considering:

- they go out of their way to explicitly differentiate them, and

- the entire discussion is about U2F and bringing in support for it in a limited sense so that people adopt WebAuthn instead of U2F.

Like, did you even read the link you provided?

So, again, what about WebAuthn is proprietary or complicated?

I'm not claiming they're the same. What matters is that U2F is what many websites implemented, which is why those problems arose in the first place.

This time, websites will implement "Chrome passkeys", which will be almost-but-not-quite WebAuthn, just like Internet Explorer's box model was almost-but-not-quite CSS.

If there are only two or three major players and the standard is sufficiently complex, "standard" becomes synonymous with "what iOS and Android do".

But to answer your question:

> So, again, what about WebAuthn is proprietary or complicated?

The WebAuthn standard is 184 pages of A4 size. That's a technical document, the length of a typical novel. Are you seriously asking what's "complicated" about that?

U2F has nothing to do with WebAuthn. You bringing it up is literal whataboutism. We aren’t talking about it, we are talking about a completely different technology.

What about WebAuthn, explicitly, is complicated for you to understand? What about it is not a web standard that can be implemented in many different ways?

Furthermore, HTTP 1.1 is 174 pages, yet Firefox was able to implement it. Standards are, generally speaking, technical documents. Because that is what guarantees interoperability, that thing you are so vehemently defending.

Chrome passkeys are WebAuthn. Period. Fin. End of story. There is no separate implementation, they are the same thing. It is a standard that anyone can implement on either side that is inter compatible with whatever implementation is used. What part of this do you not understand?

> It is a standard that anyone can implement

WebAuthn supports attestation of a key storage device. How are you going to persuade site owners to trust your self-signed attestation certificate?

Ask the folks over at SoloKeys, who are both open source and FIDO certified.

It also supports it. Whether it’s enforced is a site owner’s decision, as are the trusted roots they use.

If a site owner wants to limit to only a single type of authenticator, they can already do that by only trusting its key, so I don’t see how that’s relevant to the topic of implementing the standard.

I think they think that Google/Apple/Microsoft are deliberately creating dense standards so that nobody else has the technical means to implement them. The evidence presented was that one of these (U2F?) took a long time for Firefox to implement. Just a little note to dispel all this BS in one swoop: Firefox was the first browser to implement WebAuthn. https://blog.mozilla.org/blog/2018/05/09/firefox-gets-down-t...

it's certainly complex!

https://webauthn.guide/ challenge, attestation, rp, alg -7!? usb, ble, nfc!? it seems very easy to "hold it wrong" :)

and if you add u2f-fido to the mix, which is how most people so far saw webauthn in practice, it's even more complex.

it took me a lot of time to figure out what actually happens when I tap the security key. do I have one keypair? no, actually I have a lot, one for each site, but the site stores it in a clever encrypted encoded scheme.

Which part of passkeys / Webauthn / FIDO requires a mobile device?

In principle, none. In practice, many websites will check the user agent and flat out refuse service unless it's one of a pre-approved list of implementations, regardless of whether it would work or not.

This has been happening for a long, long time already, for many browser features, and such "standards" pushed forward by the major mobile vendors will only make the problem worse.

Well if we're making up things that websites haven't done yet then yeah I'm angry too.

Unless you're using one of the proprietary desktop OSes then you have to use one of the proprietary mobile OSes.

https://developers.google.com/identity/passkeys/supported-en...

No you do not need to use anything proprietary to use WebAuthn. There are open source software[0] and hardware keys[1].

[0]: https://github.com/psanford/tpm-fido

[1]: https://solokeys.com/

WebAuthn supports attestation of key storage and site owners might choose not to trust keys coming from an unknown DIY device.

Fortunately that feature isn't used outside of enterprise environments. Apple's passkeys don't support it so there will not be any mainstream adoption for requiring an attestation cert.

Assuming desktop Chrome doesn’t support third party password managers like 1Password and Lastpass that are similarly part of the FIDO alliance.

Passkeys aren’t a Chrome feature they’re a Webauthn feature. So if Chrome doesn’t provide the features you want on your platform you should be able to use another browser / password manager combo that does.

Reply on news.ycombinator.com