W3C approves WebAuthn as the web standard for password-free logins

Re:W3C approves WebAuthn as the web standard for password-fr... by ak217 on Monday March 04, 2019 @08:25PM (#19307354)

I agree it's annoying. They're working on it, but they should have really enabled it sooner. There's no technical reason, iPhone has the necessary NFC hardware. https://www.wired.com/story/yubikey-lightning-ios-authentica...

[ Parent | on HN ]

Re:W3C approves WebAuthn as the web standard for password-fr... by velosol on Monday March 04, 2019 @09:13PM (#19307562)

Their main page for mobile heavily implies they are already there with iPhone/NFC.

https://www.yubico.com/products/yubikey-for-mobile/

[ Parent | on HN ]

Re:W3C approves WebAuthn as the web standard for password-fr... by ak217 on Monday March 04, 2019 @09:33PM (#19307641)

Actually, you're right - that capability has apparently been available since last year: https://www.yubico.com/2018/05/yubikey-comes-to-iphone-with-.... The link I cited is for lightning-connected Yubikey hardware, which is supposed to come out this year.

[ Parent | on HN ]

Re:W3C approves WebAuthn as the web standard for password-fr... by dontbenebby on Monday March 04, 2019 @08:40PM (#19307415)

Interesting link, thanks!

For the time being, passphrases + TOTP 2F are sufficient, but I will look forward to being able to use a security key instead.

[ Parent | on HN ]

Re:W3C approves WebAuthn as the web standard for password-fr... by ak217 on Monday March 04, 2019 @09:26PM (#19307613)

U2F is fundamentally quite a bit more secure than TOTP - you probably already know this, but just to clarify for those reading.

[ Parent | on HN ]

Re:W3C approves WebAuthn as the web standard for password-fr... by dontbenebby on Monday March 04, 2019 @10:11PM (#19307796)

>U2F is fundamentally quite a bit more secure than TOTP - you probably already know this, but just to clarify for those reading.

Yes, IIRC it's impossible (or nearly so) to phish U2F.

[ Parent | on HN ]