Conversation
Haelwenn /элвэн/ 
lanodan@queer.hacktivis.me
TOTP: Good, works everywhere can even be backed by a tamagotchi, I mean an hardware token
Passkeys: Shoo go away you anti-interoperability piece of shit
Passkeys: Shoo go away you anti-interoperability piece of shit
1
0
0
@lanodan without knowing the technical details I know the implementations and "standard" are a huge mess but man I was happy about public key authentication *finally* being normalized...
2
0
0
/Cinny 
Haelwenn /элвэн/
lanodan@queer.hacktivis.me
@novenary We have pubkey auth: client certificates.
Sadly I think only Firefox implemented it and very few websites ever used it (cacert.org did for example).
So these days it's more something used via SASL for IRC and maybe some niche corporate deployments of XMPP/email/…
Real issue behind passkeys is the website can just decide at it's discretion that your authenticator software isn't valid.
Plus the whole mess of how suddenly you need the browser to properly hook up JS APIs to a bunch of software (for password managers backed passkeys) and drivers (for hardware-token backed passkeys), which I hope all your devices can properly have.
(Also written about it here: https://hacktivis.me/articles/webauthn-vs-interoperability )
Sadly I think only Firefox implemented it and very few websites ever used it (cacert.org did for example).
So these days it's more something used via SASL for IRC and maybe some niche corporate deployments of XMPP/email/…
Real issue behind passkeys is the website can just decide at it's discretion that your authenticator software isn't valid.
Plus the whole mess of how suddenly you need the browser to properly hook up JS APIs to a bunch of software (for password managers backed passkeys) and drivers (for hardware-token backed passkeys), which I hope all your devices can properly have.
(Also written about it here: https://hacktivis.me/articles/webauthn-vs-interoperability )
1
0
0
@lanodan mtls is a mess in its own right and it's not necessarily equivalent to webauthn in terms of applicability
but yeah while it's definitely possible to implement webauthn-the-protocol in non-browser contexts, integrating with anything but fido2 hardware authenticators is completely undefined unless you're on a platform that provides its own API for it
and there is a cross-device protocol but it's a cursed mess which requires a bluetooth connection... yeah 😬
anyway yeah I attribute this more to incompetence and lack of care than active sabotage, like everything nowadays it's an overengineered and underspecified mess and the design committees only care about their (apple and google's) own needs
as for sites being able to restrict what authenticators you can use via attestation, that's "necessary" entreprise bullshit
I get it, orgs need to be able to vet what their employees use, but I don't like that there's no protection against abusing this for DRM
no real answer to that other than praying most don't do it (in practice they all tend to fuck up their implementations somehow which makes passkeys barely usable lol)
but yeah while it's definitely possible to implement webauthn-the-protocol in non-browser contexts, integrating with anything but fido2 hardware authenticators is completely undefined unless you're on a platform that provides its own API for it
and there is a cross-device protocol but it's a cursed mess which requires a bluetooth connection... yeah 😬
anyway yeah I attribute this more to incompetence and lack of care than active sabotage, like everything nowadays it's an overengineered and underspecified mess and the design committees only care about their (apple and google's) own needs
as for sites being able to restrict what authenticators you can use via attestation, that's "necessary" entreprise bullshit
I get it, orgs need to be able to vet what their employees use, but I don't like that there's no protection against abusing this for DRM
no real answer to that other than praying most don't do it (in practice they all tend to fuck up their implementations somehow which makes passkeys barely usable lol)
0
0
0