Hacker News Reader

Comment by arianvanp | Hacker News Reader

That will already work right now!

Go to https://webauthn.io on your phone and it will ask for your pin or fingerprint and then use the titan chip for the handshake! If it doesn't work. Select "Platform authenticator" in the drop down

Will also work on iOS 13 beta.

If your computer has a TPM 2.0 chip then it will also work on Microsoft Edge in Windows 10 (and maybe also other browsers. If they implement webauthb Microsoft Hello API )

Website is implemented with the excellent https://github.com/duo-labs/webauthn library by the way

View on HN

iOS 13.3 is what's required (not "13 beta"), and 13.3 was released a few weeks ago.

Thanks for the info. This is not really 2FA anymore though, is it? Now WebAuthn authentication is happening on the same device as the one I'm using to log into the service. Is there a way to use my phone as a completely separate factor for WebAuthn authentication?

Webauthn is not a 2fa API. It's an authentication API. One of its usecases is to enhance password login (2fa) but can also be used as a single factor.

That is up to the implementor.

The implementor can ask the browser for certain security features of the authentication device. E.g. is the authentication device the same device as where the authentication flow is happening; is there a biometric check on the device or a pin on the device (i.e. the second factor is there but device-local) who is the manufacturer of the device (with consent of the user; given this is privacy-sensirive info) etc. And the implementor can then make a decision whether a device is 'strong' enough for single factor auth. All this information is cryptographically attested by the device.

You can ignore all that and only use it as a second factor always though. That's totally up to you and how you use the authentication primitives that webauthn provides.

Thanks again for the info. Sounds like I have some more reading up to do on WebAuthn.

I read that iOS 13.3 supports using a hardware token with WebAuthN. It doesn’t say you can just use TouchID to login without a separate WebAuth token....

> Currently, the WebAuthn second-factor use case (the FIDO U2F user experience) is the only log in flow that is supported. Security key-based biometrics or PIN (without the use of username and password) are not supported yet.

https://www.yubico.com/2019/12/native-support-for-webauthn-a...

*webauthn.io, I assume

EDIT: Disregard the rest of what I wrote here previously, I didn't realize it was Duo Labs's own website.

Website is not by me. I fixed the link. Thanks

But webauthn.io and webauthn.guide are both copyright of Duo Labs and so is the library so I guess they can do whatever they want ;) I assume the two websites and the library are by the same author

Also the library lives on the server side ; not client ; and given the license is not AGPL there is no need to state that they're using it either.

(Edit: original comment was accusing me of copyright infringement for some reason)

> But webauthn.io and webauthn.guide are both copyright of Duo Labs and so is the library so I guess they can do whatever they want ;)

Yeah, I didn't realize that. Tried to edit it in, but too late.

> Also the library lives on the server side ; not client ; and given the license is not AGPL there is no need to state that they're using it either.

And I didn't notice that. I thought it was JavaScript, but it was Go all along. Doubly my bad.

> (Edit: original comment was accusing me of copyright infringement for some reason)

I was (wrongly) assuming webauthn.io was in violation of the license of the library because I thought it was a client-side library.

Reply on news.ycombinator.com