News for hackers. Stuff that matters.

A comment on Ask HN: Did HN just start using Google recaptcha for logins?. Parent comment

Re:Ask HN: Did HN just start using Google recaptcha for logins? by lrvick on Monday January 09, 2023 @04:22PM (#34316266)
If possible, implement WebAuthn even if only for human verification.

Bots will not have access to TouchID, Windows Hello, or a Yubikey but most humans have one of those in the device in front of them right now.

Fallback to captcha for edge cases, but then at least /most/ people can skip it.

Example: https://cloudflarechallenge.com/

[ Parent | on HN ]
Re:Ask HN: Did HN just start using Google recaptcha for logins? by tjohns on Monday January 09, 2023 @04:48PM (#34316656)
Those can all easily be emulated in software, if you're determined enough.

There's nothing about the WebAuthn protocol that forces hardware backed key storage, other than everyone collectively agreeing it's a good idea. A bot author would just ignore that.

Firefox already includes this functionality, gated by flag (security.webauth.webauthn_enable_softtoken).

[ Parent | on HN ]
Re:Ask HN: Did HN just start using Google recaptcha for logins? by lrvick on Tuesday January 10, 2023 @07:34AM (#34323879)
> Those can all easily be emulated in software, if you're determined enough.

Not possible if vendor signature checking is enforced. All major webauthn device manufacturers sign the keys of all the devices they produce. You can prove a given device is unique and issued by Apple, Yubico, Google, Microsoft, etc.

[ Parent | on HN ]