RIP, Passwords. Here’s What’s Coming Next

Re:RIP, Passwords. Here’s What’s Coming Next by mooreds on Thursday January 19, 2023 @12:19PM (#34442866)

Yes, we built out WebAuthn (more here: https://fusionauth.io/docs/v1/tech/passwordless/webauthn-pas... ) and explicitly have it enabled for the re-authentication workflow right now. So WebAuthn is a nice way to reduce friction for existing users, rather than a way to create a new account.

The account recovery issue is a big one when you don't have any other credentials than WebAuthn credentials, as you touch on. I believe the next version of WebAuthn is working on standardizing this, which might help with the ecosystem issues you raise: https://www.w3.org/TR/webauthn-3/#sctn-usecase-new-device-re...

[ Parent | on HN ]

Re:RIP, Passwords. Here’s What’s Coming Next by donmcronald on Thursday January 19, 2023 @02:50PM (#34444725)

From the last link:

> a low-friction means to strongly re-authenticate on client devices having platform authenticators.

IE: People in big tech think everyone on the planet should have at least 2 modern devices and sign in to their big tech cloud accounts on all of their devices.

I'd also be willing to bet there's no thought given to de-authorizing a key, so when my parents/siblings/niblings recycle their 5+ year old devices without wiping them first they better hope there aren't any known security flaws for those devices.

[ Parent | on HN ]