Hacker News Reader

Unfortuately WebAuthn with the native keystores requires Bluetooth, which is a constant source of pain. That's a deal-breaker for me.

View on HN

I don't think that's true. I just logged into my own WebAuthn implementation via my iPhone with an NFC security key. (Bonus points: the key was enrolled on my PC.)

The server operator can choose to reject NFC, but the implementation/standard doesn't require that behavior.

Edit: Actually, I don't understand your question. Are you trying to authenticate on a PC using your phone as the security key? If so, I don't know how to do that. I just enroll Windows Hello and Face ID.

Google built a not as yet standard way for Chrome on a PC to reach out to a Phone and get WebAuthn credentials that way. It has to talk to the nearby phone somehow and so Bluetooth comes into the picture. I've never used this, and I don't know anybody who has, my Security Key plugs into USB, my cheaper FIDO dongle likewise, no Bluetooth here.

I think you're confusing the cloud-assisted Bluetooth (caBLE) transport with actual built-in device keystores. Google is testing this on their properties while it's being standardized in CTAP and WebAuthn, see https://github.com/w3c/webauthn/issues/1381

Reply on news.ycombinator.com