News for hackers. Stuff that matters.

A comment on Ask HN: Did HN just start using Google recaptcha for logins?. Parent comment

Re:Ask HN: Did HN just start using Google recaptcha for logins? by tjohns on Monday January 09, 2023 @04:48PM (#34316656)
Those can all easily be emulated in software, if you're determined enough.

There's nothing about the WebAuthn protocol that forces hardware backed key storage, other than everyone collectively agreeing it's a good idea. A bot author would just ignore that.

Firefox already includes this functionality, gated by flag (security.webauth.webauthn_enable_softtoken).

[ Parent | on HN ]
Re:Ask HN: Did HN just start using Google recaptcha for logins? by lrvick on Tuesday January 10, 2023 @07:34AM (#34323879)
> Those can all easily be emulated in software, if you're determined enough.

Not possible if vendor signature checking is enforced. All major webauthn device manufacturers sign the keys of all the devices they produce. You can prove a given device is unique and issued by Apple, Yubico, Google, Microsoft, etc.

[ Parent | on HN ]