Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I believe webauthn requires end users to perform key management. I suspect that is currently a harder task for the average user than a memorized or written-down password. Special hardware tokens may help, but I'm not sure how we'd convince average users to care or buy them.

Are there any webauthn only sites, besides demos?



The end user's agent (browser) should handle the key management behind the scenes. Even without hardware tokens it's still at least as good as a software-based password manager. A Hierarchical Deterministic key system similar to the BIP32 scheme used by most Bitcoin wallets[0] would only require a single master private key per user to support any number of unrelated identities. That key could be generated from a master password, synced to each device through an enrollment process, or stored on a hardware token.

[0] https://github.com/bitcoin/bips/blob/master/bip-0032.mediawi...


This is new to me, thanks.

Do you know how that supports use cases like if someone wants to change their flight from a hotel computer? I wouldn't want to expose a "master password" to a computer I didn't trust.


If you don't trust the computer then your best option is a hardware token like the Trezor (which already supports WebAuthn in addition to its cryptocurrency functions). The better ones will include a screen where you can see details like which site you're signing into before confirming the request. Either way, the host computer never gets access to any private keys. It can still do whatever it wants with your login session on that site, though, so you'll want to be careful about logging in to sensitive sites from untrusted PCs. The same applies to password-based logins, of course; moreover, any password you've entered into a public PC should immediately be considered compromised and changed (from a secure device) at the earliest opportunity.

Given any choice in the matter I would suggest using your own equipment to change the flight (e.g. a smartphone), even if it's less convenient.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: