Google: Security Keys Neutralized Employee Phishing

Re:Google: Security Keys Neutralized Employee Phishing by Tomte on Monday July 23, 2018 @01:24PM (#17594226)

I‘d like to add a related question: I already have three or four U2F keys. Is there any reason to upgrade to FIDO2 keys?

[ Parent | on HN ]

Re:Google: Security Keys Neutralized Employee Phishing by StavrosK on Monday July 23, 2018 @06:30PM (#17596557)

Not yet. I'm writing a Django library for webauthn support (i.e. logins without usernames or passwords), but no browser supports that yet, that I can see. They only support the second-factor mode, not the first-factor.

[ Parent | on HN ]

Re:Google: Security Keys Neutralized Employee Phishing by dwaite on Tuesday July 24, 2018 @02:22AM (#17598553)

If you request resident keys the browsers seem to switch over. Chrome Canary had it hidden behind a command-line flag last I checked (a month ago, which is an eternity considering how hard they are pushing)

[ Parent | on HN ]

Re:Google: Security Keys Neutralized Employee Phishing by dwaite on Tuesday July 24, 2018 @02:27AM (#17598578)

Yeah looks like it is now chrome://flags/#enable-web-authentication-ctap2-support

[ Parent | on HN ]

Re:Google: Security Keys Neutralized Employee Phishing by StavrosK on Tuesday July 24, 2018 @05:30AM (#17599357)

That's fantastic to know, thank you!

[ Parent | on HN ]