W3C approves WebAuthn as the web standard for password-free logins

Re:W3C approves WebAuthn as the web standard for password-fr... by dontbenebby on Monday March 04, 2019 @07:49PM (#19307183)

I've avoided getting a Yubikey because there's not an easy way to use it on my iPhone, sticking with TOTP. But that's a bit of an edge case. (iPhones lack NFC chips)

[ Parent | on HN ]

Re:W3C approves WebAuthn as the web standard for password-fr... by ak217 on Monday March 04, 2019 @08:25PM (#19307354)

I agree it's annoying. They're working on it, but they should have really enabled it sooner. There's no technical reason, iPhone has the necessary NFC hardware. https://www.wired.com/story/yubikey-lightning-ios-authentica...

[ Parent | on HN ]

Re:W3C approves WebAuthn as the web standard for password-fr... by velosol on Monday March 04, 2019 @09:13PM (#19307562)

Their main page for mobile heavily implies they are already there with iPhone/NFC.

https://www.yubico.com/products/yubikey-for-mobile/

[ Parent | on HN ]

Re:W3C approves WebAuthn as the web standard for password-fr... by ak217 on Monday March 04, 2019 @09:33PM (#19307641)

Actually, you're right - that capability has apparently been available since last year: https://www.yubico.com/2018/05/yubikey-comes-to-iphone-with-.... The link I cited is for lightning-connected Yubikey hardware, which is supposed to come out this year.

[ Parent | on HN ]

Re:W3C approves WebAuthn as the web standard for password-fr... by dontbenebby on Monday March 04, 2019 @08:40PM (#19307415)

Interesting link, thanks!

For the time being, passphrases + TOTP 2F are sufficient, but I will look forward to being able to use a security key instead.

[ Parent | on HN ]

Re:W3C approves WebAuthn as the web standard for password-fr... by ak217 on Monday March 04, 2019 @09:26PM (#19307613)

U2F is fundamentally quite a bit more secure than TOTP - you probably already know this, but just to clarify for those reading.

[ Parent | on HN ]

Re:W3C approves WebAuthn as the web standard for password-fr... by dontbenebby on Monday March 04, 2019 @10:11PM (#19307796)

>U2F is fundamentally quite a bit more secure than TOTP - you probably already know this, but just to clarify for those reading.

Yes, IIRC it's impossible (or nearly so) to phish U2F.

[ Parent | on HN ]

Re:W3C approves WebAuthn as the web standard for password-fr... by Rafert on Tuesday March 05, 2019 @09:17AM (#19310614)

Feitian makes devices with Bluetooth support: https://www.ftsafe.com/Products/FIDO/Multi

[ Parent | on HN ]

Re:W3C approves WebAuthn as the web standard for password-fr... by dboreham on Monday March 04, 2019 @11:11PM (#19308042)

fwiw, in case readers are curious, the NFC Yubikeys work fine on popular NFC-capable Android devices such as my GNote9.

[ Parent | on HN ]