News for hackers. Stuff that matters.
Re:Ask HN: Mozilla Persona Post-Mortem by JoshTriplett on Wednesday January 17, 2018 @08:58PM (#16174000)
https://www.w3.org/TR/webauthn/

Disclaimer: I have not reviewed this spec in detail yet, and my confidence in the W3C is not high.

Re:Ask HN: Mozilla Persona Post-Mortem by cpeterso on Wednesday January 17, 2018 @09:30PM (#16174162)
Firefox 60 will ship the WebAuthn API. Here's a Mozilla blog post with examples of how to use WebAuthn and FIDO U2F devices:

https://hacks.mozilla.org/2018/01/using-hardware-token-based...

Re:Ask HN: Mozilla Persona Post-Mortem by JoshTriplett on Wednesday January 17, 2018 @10:11PM (#16174364)
Will it work with a key stored in the "software security device", rather than a hardware token?

For that matter, the description shown on that page suggests that it supports using the key on the hardware token as the only authentication factor. That seems dangerous. Unlike a key stored on an encrypted disk, a U2F key typically works for anyone who steals it. Firefox needs to use that key together with another key stored in the browser, or otherwise ensure that someone who steals the U2F key does not gain access to every account secured with WebAuthn.

Re:Ask HN: Mozilla Persona Post-Mortem by cpeterso on Thursday January 18, 2018 @02:50AM (#16175431)
Yes, I think Firefox will support U2F "soft tokens". Code for a U2FSoftTokenManager was added in Firefox bug 1323339.

https://bugzilla.mozilla.org/show_bug.cgi?id=1323339