> Almost every phone and laptop today supports it

Eh.

I'm super excited for WebAuthn, but unless my sources are out of date it's far from being supported everywhere (https://webauthn.me/browser-support).

A giant challenge with WebAuthn is the lack of platform authenticator integrations, particularly on Linux. You basically need to buy a separate key. And if you're on Android and you swapped out Chrome for Firefox (which you should do) then even the physical key stops working.

I desperately want to start using WebAuthn everywhere and I desperately want to start encouraging devs to swap over to it for most new logins. But I don't think I can. I don't know that I own a single phone or desktop that as configured can use WebAuthn without a security key. If I'm doing something wrong, or if there's some config option that just hasn't gotten flipped by default on platforms like Firefox Linux, then I'd love to know.

I made a FIDO token (a platform authenticator) implementation that uses the TPM to protect your private keys on Linux: https://github.com/psanford/tpm-fido

As I understand this, if malware is on the machine it can do unlimited WebAuthn validations in the background without user interaction.

Anchoring to physical human interaction with a button or biometric sensor is a huge security property I don't think current gen TPMs can solve for.

In a typical implementation someone must be present at the machine expecting a tap, and tapping.

That said, overall this is a clever best effort for when a TPM is all a user has and you at least want to prove a given machine is involved in with.

If malware is on the machine you are basically screwed anyway. A threat model where you happen to never authenticate with a service while you have the malware installed is not especially compelling.

That's really cool. Is it possible to use it without a hardware TPM, for testing? I have used rust-u2f in the past for that purpose.

Yup, there's a flag `-backend memory` that generates ephemeral keys in memory.

It is supported in virtually all current gen phones/laptops.

Giving up WebAuthn and thus trading security for privacy by dumping Chrome for Firefox is a raw deal. If privacy is a concern run a de-googled ROM like CalyxOS which ships defanged Chromium so you get to have vital security features like WebAuthn without giving up privacy.

> so you get to have vital security features like WebAuthn without giving up privacy.

Yes, Chrome phoning home is a concern to me, but a much bigger concern is the lack of mobile extension and adblock support. Defanged Chromium doesn't solve that problem. Even desktop deGoogled Chromium is just an inferior browser when it comes to privacy right now; it has fewer extension APIs than Firefox and it's missing built in Firefox privacy features like containers.

But on mobile, giving up the ability to run extensions entirely? I'm not sure I can substantively argue whether giving up adblocking is a bigger security tradeoff than giving up webauthn. But it's definitely a pretty big privacy tradeoff given the current state of the mobile web.

I don't know, maybe this is a solved problem. I haven't really looked into CalyxOS. Does it patch mobile Chromium to support extensions? Can I trust the devs to do that securely?

----

Edit: so I did look into this, and it looks like MicroG just doesn't support WebAuthn at all: https://github.com/microg/GmsCore/issues/849, https://bugs.chromium.org/p/chromium/issues/detail?id=997538

So if anything, that gives me a lot more confidence to claim that this is not widely supported yet and people shouldn't be calling WebAuthn a universal drop-in replacement for other systems.

Not to say that WebAuthn is bad, I expect these problems will be solved over time and support will widen. I do think WebAuthn is the obviously correct long-term solution. But I think the "virtually all" language used here is not currently accurate. At best I'm seeing some (very small) repos trying to work around the problem, and I'm not convinced it's good security practice to entrust login tokens to under-audited 3rd-party services."

The ideal solution should hopefully handle a "mugged in a foreign country" hypothetical. If a normal person traveling abroad loses both their wallet and phone, would they be able to regain access to their digital life before they got home? With Sprint/T-Mobile's current approach, the answer would be yes. With WebAuthn, it is a big maybe and is probably a no for most people. We are back at the security versus convenience choice.

If someone loses their passport while traveling they are often locked out of access to their home country, let alone their digital life.

It is not permissible to use digital backup copies of paper identity documents in most countries but with digital identity you can make all the backups you want and store them places hard to lose. Travelers would be wise to do so. It is free and reasonably easy. There is just a training gap, the tech is here.

Personally I keep an AES encrypted backup needed for emergency recovery of my digital life implanted in my body. Others I know use NFC rings.

First starting point for "I lost my passport" should be "visit your embassy in the country you are in".

It may not be an instant solution, but should normally result in a temporary passport you can use to travel home with, then once home you should be able to bootstrap from there.

if you lose your passport while in a foreign country you’re permanently locked out of ever traveling back home? that can’t possibly be true. I can see it being hard if you have no living family though

I think most people carry their security keys on their keyring. And since most muggers don't demand keys I think people should generally be safe.

Except many people keep their keyring in their bag and muggers often just grab the bag.

Then keep another key somewhere else, like with a fellow traveler or at the hotel. This is why people make copies of physical keys.

All security is physical security. We need to end the delusion that it is not or can somehow be bypassed, and embrace it instead.

And when you get mugged in transit from the hotel to the airport or vis-versa your plan falls apart. Unless you are going to pay someone to drive a different route in a different car with your hardware key...

Good luck making a copy of a security key - most are designed to prevent that (for valid-ish reasons) and the only other option (always enroll two keys) has a host of other problems, especially since in the "always carry two" case you need to also keep a third one at home.

I have encrypted backups and duplicates of all my security keys.

You simply need to choose a security key that supports BIP39 backups like a Trezor or Ledger.

As an alternative most sites support enrolling multiple keys.

You can’t duplicate hardware MFA keys. You’d have to individually set up the second device everywhere you use MFA, and many services only support a single device (looking at you, AWS).

> many services only support a single device (looking at you, AWS)

I really wish people would stop doing this.

It's not "many services" it's one service. "Many women have played the role of Ellen Ripley in the Alien movies (looking at you, Sigourney Weaver)". No. One woman did that and you just named her, not many.

Don't use "many" to mean, "Well, one, but when I wrote that it didn't seem like I had a point worth making". If you instead present this as "AWS is broken" then we see what the problem actually is and who needs to fix it.

> many services only support a single device (looking at you, AWS).

We can (finally) take AWS off that list.

I can say I was pleasantly surprised recently by being able to enroll multiple MFA Tokens and device types, for a single IAM SSO User.

Don't know the restrictions on it, but https://aws.amazon.com/iam/features/mfa/ probably has more details.

This is inaccurate.

You can't duplicate entry level devices like Yubikeys but hardware wallets like Ledger and Trezor both support backup of FIDO seeds in the form of 24 english words you can store endless ways, or recover to a secondary device.

I have duplicates of all my MFA keys.

These devices are also more secure as they show you the website you are approving on screen to avoid being tricked by malware.

> Then keep another key somewhere else, like with a fellow traveler or at the hotel

Hotels aren’t safe for valuables and people travel alone. We’re getting pretty far removed from convenience here as well. Might as well suggest people keep their keys shoved up their ass.

Buttplug with yubikey integrated. Startup idea of the year :P

A 24 word mnemonic FIDO backup seed can fit AES256 encrypted in a 1K NFC tag, which come in sizes as small as a grain of rice.

You can store it in a subdermal implant, under the sole of your shoe, a belt buckle, or in a finger ring or other jewelry.

Options are endless.

Maybe we could just use something that can't be stolen. Something like a shared secret that is exchanged through secure channels beforehand and then only resides in the users permanent memory. The second party could even use some kind of novel mathematical function that maps arbitrarily sized secrets to a seemingly random fixed size value that is both sufficiently different for similiar inputs and big enough to avoid collisions. That would allow them to not store the secret in plain text as they could just compare the output of the function with the previously saved one to verify that the secret the user gave is most likely correct.

> If they have lost all their devices it would be like if they lost all citizenship paperwork

If you're running something like a phone company in the US, millions of the people you service probably aren't citizens. If your process is "longer, generally in person, process involving reference verification and a waiting period", then your competitor will get those customers instead. Prepaid plans first became very popular in the US in part because they do not require bank accounts or SSNs.

"24 words written on paper."

That's cool, I didn't realise it was possible to backup the webauthn secret this way.

I googled but couldn't find any documentation on how to set this up, could you let me know how you set this up?

Not being able to make backup of the Webauthn secret is why I have stuck with TOTP so far.

It's not exactly part of the webauthn standard. Or at least not a described part, it falls under the 'roaming authenticator' and 'backup credentials' mentioned in the spec, effectively it's a function that generates a crypto key where the key matter is the 24 randomly chosen words. It's basically just _another_ key that a service can setup and store for your, but encrypted with the secret they share with you up front in the form of those words.

The Ledger hardware wallet can act as a FIDO U2F (probably other hardware wallets as well). And to back up a hardware wallet you write down the 24 words…

People can't recall their 4 pin password, but you think they will store docs in a safe?

The problem is, no matter what you tell the average person, they are not capable of such diligence.

Then they will experience pain at some point, and that pain will cause them to seek out ways to not have that pain in the future.

Ask anyone who makes diligent backups why they do it. You will hear a story of pain that taught them.

This is sadly just how most humans work.

There are those which learn from such things, this is true.

There are those which will never, ever learn. Ever. And it is a large part of the population.

Why are only very few services supporting WebAuthn?

Google and github supprot WebAuthn, but most services only support OATH-TOTP, OATH-HOTP or even worse only their own app.

If something doesn't support Web'n'Auth you can use TOTP with a Yubikey, the TOTP moves with the key, much better than those dumb authenticator possibly-spyware apps.

Generating the 6 digit codes from a TOTP seed is < 10 lines of python and requires only core modules. Meaning it's pretty easy to find or make a client you would trust.

Since moving my totp keys onto a yubikey, I device hop with wild abandon since I know I can't accidentally bork my 2fa, it's great.

> much better than those dumb authenticator possibly-spyware apps

If the google or microsoft TOTP app is spyware, I have bigger problems.

I don't see what's dumb about them either.

They are dumb because

- they involve storing secrets on a readable filesystem

- are tied to a particular instance of a filesystem, not actually tied to a piece of hardware, which fails the "something you have" part of 2FA

- either (a) fail if you reinstall your OS, OR (b) need to transmit secrets to Google and Microsoft to allow you to reinstall the OS, both bad

With Yubikey TOTP you cannot read back the secret, the hardware itself doesn't provide an interface to do that.

For a normal user with an app that doesn't allow export, it's more or less equivalent to a yubikey. There's no reasonable way to get the secrets out of a locked phone or a yubikey, but an expert with a lot of resources probably could. And a normal user isn't reinstalling their phone OS so that worry's out of the way.

For apps that do allow export/transfer, it's up to the user if they want to keep the secret safe. But really at some point it's up to the user no matter what method or hardware you use.

And since most sites don't have an easy way to have multiple tokens, allowing export/transfer also reduces the temptation to insecurely store a copy of enrollment QR codes.

Reluctantly I think my conclusion is the majority of services do not care.

>drivers license

How does anyone keep their drivers license in a safe? If they don't drive?

SWIM can confirm it is easy to get duplicate ID documents if you "lose" one.

Always have backups of these. I know people who lost all their docs and ID in a fire and it took over a year to recover.

At one point all they had to go on was an old scan of a drivers license they could fax people as "proof" of ID.

At least in the places I've been in the US, law enforcement doesn't seem to care if you have your physical license with you. They just look it up, since they are doing that anyway...whether you have it or not. I'm sure that varies, though.

No--in CA you need a drivers license, proof of insurance in your vechicle, or you get a fat ticket.

(It makes no sence because they have a digital picture of you provided by DMV in their cruisers, along with proof of insurance?)

That's very surprising. How do they look up your license? Using your name?

Driving is without a license in your "immediate possession" is definitely against the law in California[1] and I've never met someone that intentionally leaves it at home. Restaurants that card for alcohol also makes this a no-go for most people.

1: https://leginfo.legislature.ca.gov/faces/codes_displaySectio...

In the UK you don't have to carry your license or insurance while driving - although you can be required to give your name, and to take those documents to a police station within 7 days. For certain crimes they can also arrest you and/or seize your vehicle.

Of course, in the UK car registration plates are issued and attached by the dealer, before a car's first sale, and they never expire. So they can find the registered keeper of a vehicle just by looking at the plates.

>Of course, in the UK car registration plates are issued and attached by the dealer, before a car's first sale, and they never expire. So they can find the registered keeper of a vehicle just by looking at the plates.

Yet another situation where foreign registered vehicles are essentially immune from UK traffic enforcement.

That's not that big a deal since the UK is essentially cut off from foreign countries by water (except for northern Ireland, but there's already a ton of exceptions around that...) I wouldn't be too surprised if foreign plates got pulled over randomly just because it's so rare.

At least London is completely full of foreign cars, and it's really easy to drive to the UK thanks to eurotunnel and the ferries.

> with other things they can't afford to lose like their SSN card and drivers license.

Both of those things are trivial to replace.

If you lose all your ID and don't have family to vouch for you, getting ID back is a real nightmare. I have seen it take months even with living family in the picture.

Getting access to an AWS root account you are locked out of however just requires -photos- of identity documents and billing verification etc.

I would way rather have the latter problem.