Re:Web Authentication: Proposed API for accessing Public Key...
by zaarn on Wednesday April 11, 2018 @03:04AM
(#16808729)
In theory a yubikey is safer than simply logging into a website using passwords when the device is untrusted.
A USB device like a yubikey could provide an untrusted (or even trusted) devices with only a temporary access token. The untrusted device can only manipulate a user session with the user present, once the user has left, the session expires and the computer has no access token.
WebAuth makes it impossible to continue or begin a session without being authorized to do so if a USB device is used.
TOTP is one implementation of a "trusted device authorizes untrusted device" protocol that Yubikey/WebAuth/others enable.
Compare with password logins: Once you enter your password you trust the device you entered it on to not compromise it.
A USB device like a yubikey could provide an untrusted (or even trusted) devices with only a temporary access token. The untrusted device can only manipulate a user session with the user present, once the user has left, the session expires and the computer has no access token.
WebAuth makes it impossible to continue or begin a session without being authorized to do so if a USB device is used.
TOTP is one implementation of a "trusted device authorizes untrusted device" protocol that Yubikey/WebAuth/others enable.
Compare with password logins: Once you enter your password you trust the device you entered it on to not compromise it.