Questions tagged [webauthn]
The webauthn tag has no summary.
54 questions
1 vote
1 answer
116 views
Would a passkey client that had a seed for backup break the specification?
I have been thinking about backing up passkeys, I asked a previous question about backing up individual private keys. This procedure requires one to create the backup after creating the account. ...
- 447
2 votes
1 answer
344 views
Is there a reason to not send signed FIDO2/WebAuthn session data to the client rather than storing it server side?
Every WebAuthn implementation I've seen stores the session data server side, but that just seems pointless to me, since what seems to be essentially all the same data is already sent to the client in ...
- 145
2 votes
1 answer
341 views
Is there a good way to keep a paper backup of a passkey?
In exploring the use of passkeys I have used KeePassXC. I followed their instructions to create a paper backup and did not get any private data about the passkey. There is available an entry called ...
- 447
4 votes
2 answers
353 views
Integrating Biometrics with Auth Code Flow (w/ PKCE) on mobile
There is a topic I have been going back and forth with for some time. Here is the premise: we need to create a mobile app for a highly regulated industry the app should leverage oAuth2 for obtaining ...
- 41
1 vote
1 answer
153 views
Does a Passkey authentication system need bootstrapping by username and password?
The Register has an article on Passkeys, and one of the issues they use to argue that they are unlikely to be widely adopted is: The process is bootstrapped by getting the user to authenticate using ...
- 447
1 vote
1 answer
124 views
What is the easiest way to have a standalone implementation of Passkeys on generic hardware with backup?
In previous question I asked about simple login systems, and WebAuthn was the answer. From a brief read of the web pages I THINK it is possible to create a standalone GPL implementation of Passkeys ...
- 447
1 vote
1 answer
139 views
Is clientDataJson and attestationObject required to verify assertion during authentication in WebAuthN?
Currently I am working on implementing/supporting WebAuthN in my service (JAVA). I have a Control Plane which handles the registration ceremony and Data Plane that handles the authentication ceremony. ...
- 13
0 votes
1 answer
256 views
Best Practices for WebAuthn FIDO2 reset
Security Noob here. I am trying to build a secure passwordless login mechanism for my webservice. The authentication mechanisms My idea is to encourage the users to use the following two login methods:...
- 1
2 votes
1 answer
193 views
Storing a server secret in a user passkey user id
I want to implement passkey support as a full replacement for passwords but I have some server-side state that still needs to be encrypted to a specific user in a way that can not be decrypted or ...
- 123
-1 votes
1 answer
205 views
Fido2/Webauthn Passkeys: rsa2048, rsa4096, or Ed25519?
Does anyone know what kind of keys are being generated when you make a Fido2/Webauthn passkey? rsa2048, rsa4096, Ed25519, or something else? Just worried if its rsa2048 it might soon be crackable, at ...
- 199
8 votes
2 answers
3k views
How is a passkey more secure than the regular email/password with U2F key?
Since I use 1Password to store my passkeys along with emails and passwords, it appears to be that passkeys are not as secure as using the email and password with U2F flow that I currently use on many ...
- 181
0 votes
0 answers
143 views
storing user hashed password into webauthn id
I am building a pure client-side app. My users have a .kdbx vault stored in localStorage, and they can open it with a password. In order to add a biometric\quick open feature into the app I thought ...
- 101
0 votes
2 answers
289 views
How does it "allow a malicious website to obtain valid credentials." - WebAuthn
I'm not entirely convinced of the importance of verifying the authenticator attestation, and I've asked a question about it, I'm open to it, and if you want, you can post an answer at that question, ...
- 402
0 votes
1 answer
114 views
Suggestions for implementing a simplified subset of WebAuthn Relaying Party Operation
Previously some good fellow explained the importance of verifying the public key created and offered by authenticators. As before, given the complexity of a FULL implementation of RP operation, I ...
- 402
2 votes
1 answer
262 views
Is 3DS compatible with secure 2FA technologies? (TOTP, WebAuthn)
Is PSD2's Strong Customer Authentication requirement possible to satisfy with secure 2FA solutions, such as TOTP and WebAuthn? For the purposes of this question, I'm classifying all systems where an ...
- 1,196