Hacker News Reader

Comment by _1tem | Hacker News Reader

I’ve actually seriously been thinking of using WebAuthn to “authenticate” every single page load with a passkey unlocked by a biometric device only, so that I can be sure that every single page load had a meat finger on TouchID or a meat face in front of FaceID before showing the page to them.

In the future I imagine that there will be biometrically secure browsers that will be required for top security applications, that can guarantee that a single physical person is actually physically present while using it.

View on HN

Webauthn doesn't reveal if someone's a human and you can't see whether they used FaceID or whatever, and once someone proves they're human you should just give then a session token.

But I believe there is a spoof-proof way to accept hardware keys only? Limit yourself to known good hardware manufacturers and you should be good.

That'll just exclude most of your visitors. The visitors you're not refusing are using TPMs or secure elements you can't trust anyway because of a long history of side channel attacks for "known-good" hardware manufacturers.

Couldn't someone just write a software key that lies and says it's biometric?

AFAIK end-to-end manufacturer attestation isn't part of the spec (yet...).

There's even an emulator built in to Chrome

Dev Tools -> 3 dots -> More tools -> WebAuthn -> Enable virtual authenticator environment

Attestation statements can be used to restrict WebAuthn use to certain hardware keys only.

But is there a chain of trust going all the way back to the manufacturer? Or is that simply metadata which could be spoofed?

Yes. That's what attestation is for.

WebAuthn doesn't work the way you think it does. Most computers don't have fingerprint readers or even webcams, let alone webcams capable of verifying a user. Instead, you'll end up making people type in their Windows password or scanning QR codes.

Remote attestation concepts already exists to solve this problem: https://httptoolkit.com/blog/apple-private-access-tokens-att...

Cloudflare ran an experiment with it, and I think Apple and Cloudflare are working to make it into a proper RFC. It's only a matter of time before other browsers will support it too with the way things are going right now.

Please don’t use WebAuthn on every page load.

Two reasons: the protocol is not designed to do this - and the UI/UX is not designed to support this. There are better ways.

2) it will likely not work. There are virtual/software authenticatators (available in dev tools) that could generate a valid response without a human.

FWIW using WebAuthn to start a session, set up a cookie, and validating that cookie to get access seems like a pretty usable pattern. Not much more invasive than the "checking your connection" screen Cloudflare likes to throw.

That sounds awful. From there it's a miniscule step to actually needing to authenticate with every website, like a cookie you can't erase if you want to continue using the internet

C'mon folks, PNG? Webauthn on every page?

If we're talking lunars, why don't you print posters and distribute physically in your neighborhood?

100% bot safe & "meat finger" guarantee.

Reply on news.ycombinator.com