News for hackers. Stuff that matters.

A comment on Ask HN: WebAuthn – Replace Password or Second Factor?. Parent comment

Re:Ask HN: WebAuthn – Replace Password or Second Factor? by twodave on Friday October 14, 2022 @12:05PM (#33205365)
Overall I agree with this, but I think there's a genuine need for a general self-destruct mechanism. Having a key confiscated or taken by force should be preventable in some way, and even if I have a backup key, there needs to be a low-friction way to make a key unusable and unrecoverable.

It would also be nice to have a way to quickly de-register a lost key. Having a back-up is great, but it's still a pain to go de-register the thing on each individual provider's platform. And if I miss one provider it could easily be game over. I'm not a huge fan of centralization but a single registry for dead keys would make a lot of sense for the different providers to cooperate on.

[ Parent | on HN ]
Re:Ask HN: WebAuthn – Replace Password or Second Factor? by iwillbenice on Friday October 14, 2022 @12:25PM (#33205606)
Agree completely with your concerns with regards to lost/stolen keys.

Most of the places where I've been able to use my Yubikeys (FIDO2) also offer a very clear list of enrolled/registered keys, along with either a hash or serial number of the key. It makes revoking a key pretty easy in my experience.

I'm less keen on the idea of centralized repo for dead keys - each key is unique to the site in question, so there will be no need to share the existence of that revoked key's identifer with other providers - the data is meaningless to anyone else.

[ Parent | on HN ]
Re:Ask HN: WebAuthn – Replace Password or Second Factor? by number6 on Friday October 14, 2022 @12:43PM (#33205882)
You can Set a PIN for the Token.
[ Parent | on HN ]
Re:Ask HN: WebAuthn – Replace Password or Second Factor? by nicoburns on Friday October 14, 2022 @01:30PM (#33206478)
I agree that revocation is important, but it's a little tricky. Make it too easy, and the attacker can steal a key and then immediately use it revoke your other keys, locking you out permanently.
[ Parent | on HN ]
Re:Ask HN: WebAuthn – Replace Password or Second Factor? by PassageNick on Monday October 17, 2022 @03:13PM (#33238215)
Passkeys cannot be taken or stolen by force.
[ Parent | on HN ]