News for hackers. Stuff that matters.
Re:Passwordless authentication with FIDO2–beyond just the web by pabs3 on Wednesday February 22, 2023 @02:50AM (#34892862)
Phones don't act as authenticators for FIDO2 yet AFAIK. You usually have either a separate hardware dongle or the OS implements passkeys (WebAuthn in software), which are cloud synced.

The way to deal with losing an authenticator is you have multiple of them, including several backups, one in your home safe, one at your friend's place etc.

Re:Passwordless authentication with FIDO2–beyond just the web by lll-o-lll on Wednesday February 22, 2023 @03:19AM (#34893025)
No, they do now. Both iOS and Android have full support. Look up “passkey” for more info. Basically, google, apple, MS, etc etc are all supporting this tech now.

The recovery process is defined for both Apple and google, as is the device transfer process.

Here’s a google post explaining their recovery process: https://security.googleblog.com/2022/10/SecurityofPasskeysin...

Re:Passwordless authentication with FIDO2–beyond just the web by timwis on Wednesday February 22, 2023 @04:20AM (#34893418)
But then you have to make sure you're home when you setup any new online account (so you can go into your safe and add your backup key to it), or remember to do so when you get home :/
Re:Passwordless authentication with FIDO2–beyond just the web by saltcured on Wednesday February 22, 2023 @05:07PM (#34903630)
This new passkey stuff adds use of your phone as an authenticator with a laptop or other system via bluetooth with (unfortunate) cloud-mediation.

Before that, some phones could already offer their embedded security chip as a U2F authenticator with the browser app. E.g. I setup the Titan chip in my Pixel 5a as another authenticator with a Google account. But, it only works with a browser on the phone itself. Since the phone browser can also access a Yubikey, I could use the Titan chip to enroll a new Yubikey or vice versa.

I do wish there was a standalone "security key" USB mode I could select alongside file transfer, picture transfer, tethering, or charge-only. Then, I could more reasonably use the phone's embedded security chip as a redundant U2F key for many different services I would normally only access from a PC.