Welcome to twenty years ago and client SSL certificates.

I'm glad the future is catching up.

There was a real big industry push back then and many expected smartcards to take over, but it fizzled as hardware companies generally doesn't do software well and nobody really wanted the added complexity of extra hardware.

Maybe it will go better now as individual users have a use case, as things like gmail and coinbase supports it, and not just the usual enterprise platforms.

It is true that I don't know of any currently existing authenticators that support biometric authentication, but what's nice about this spec is that the biometric/PIN/etc stuff is never exposed to the server. When new kinds of authenticators enter the market (like if Google adds the feature in an Android system update), they can immediately be used without having to change any code on the servers. And like you say, even without the multi-factor stuff it'll be a fantastic improvement over the current dumpster fire that is passwords.

Full disclosure: I work at Yubico and am one of the editors of the Web Authentication spec.

Fitting keyboards with NFC devices could make it even better.

As long as the user must do something on the device to approve it, otherwise you can have proximity scanning attacks as with RFID.

You could conceivably have a login sessions page and access it from a trusted computer to force logout of a session from an untrusted computer.

But it seems the bigger problem with login from a malicious computer is that the computer could do whatever it wants with your session while you're logged in, regardless of how securely you can logout later.

(1) people frequently (and rightly) do that anyway, so we might as well make it less bad.

(2) Building a trustworthy computer is largely about isolating different components in a way that hurts malware more than it does the user-experience. Sticking keys on a USB key is one instance of such isolation.

This would leave a window of x seconds after logging out in which attacks could occur but that could be mitigated by requiring a failed request on logout (perhaps require the usb key to be removed upon logout, send an auth-ping, and only give a successful logout message if the auth-ping fails. (Even without this mitigation I'm not sure what kind of attack would work for the inbetween X seconds, but might as well mitigate it in case someone else could think of something)

Of course there's only so much you can do if your hardware is compromised, you can just try to mitigate the issue as much as possible and hope for the best.

All signed access token, when logged out or revoked, should be marked so on the server side. Of course the untrusted computer should at the very least send the logout request.

Typically, a service should also let you see all your active sessions and let you revoke them.

You're describing plugging a USB key containing your identity into an "untrusted computer".

It's hard to call that a "fantastic improvement" or really anything other than a "terrible idea".

This is miles better than password-based login.

Tell that to Yubico et al, who have based their businesses exactly on this "terrible idea", making secure USB devices that can be plugged in to insecure computers.

Well, no machines more untrusted than the ones I do work or internet banking on.

I hope people don't think of Yubikey-type devices and "magic security pixie dust" that somehow makes it OK to do sensitive things on an internet cafe pc??? (Fully prepared to be told anecdotes of people doing stuff I'd consider crazy in response to this...)

A USB device like a yubikey could provide an untrusted (or even trusted) devices with only a temporary access token. The untrusted device can only manipulate a user session with the user present, once the user has left, the session expires and the computer has no access token.

WebAuth makes it impossible to continue or begin a session without being authorized to do so if a USB device is used.

TOTP is one implementation of a "trusted device authorizes untrusted device" protocol that Yubikey/WebAuth/others enable.

Compare with password logins: Once you enter your password you trust the device you entered it on to not compromise it.

But we still need the phones to support U2F.

As it stands, my pass phrase and fingerprint are the weak links, as phone logins rely on TOTP. One day I’ll be able to tap my phone against my Yubikey along with my pass phrase, and/or my fingerprint. That would be lovely.

That works fine for me on Android.

What segregation between these is there within the phone? Doesn't it mean the fingerprint gets you the keypair for free?