Web Authentication: Proposed API for accessing Public Key Credentials

Re:Web Authentication: Proposed API for accessing Public Key... by bigiain on Tuesday April 10, 2018 @07:46PM (#16806777)

For the record, I have never plugged either of my Yubikeys into an "untrusted" computer.

Well, no machines more untrusted than the ones I do work or internet banking on.

I hope people don't think of Yubikey-type devices and "magic security pixie dust" that somehow makes it OK to do sensitive things on an internet cafe pc??? (Fully prepared to be told anecdotes of people doing stuff I'd consider crazy in response to this...)

[ Parent | on HN ]

Re:Web Authentication: Proposed API for accessing Public Key... by zaarn on Wednesday April 11, 2018 @03:04AM (#16808729)

In theory a yubikey is safer than simply logging into a website using passwords when the device is untrusted.

A USB device like a yubikey could provide an untrusted (or even trusted) devices with only a temporary access token. The untrusted device can only manipulate a user session with the user present, once the user has left, the session expires and the computer has no access token.

WebAuth makes it impossible to continue or begin a session without being authorized to do so if a USB device is used.

TOTP is one implementation of a "trusted device authorizes untrusted device" protocol that Yubikey/WebAuth/others enable.

Compare with password logins: Once you enter your password you trust the device you entered it on to not compromise it.

[ Parent | on HN ]