Ask HN: Why is WebAuthn so slow to take off?

Re:Ask HN: Why is WebAuthn so slow to take off? by m-p-3 on Sunday April 23, 2023 @12:24PM (#35677602)

Since Microsoft's implementation of FIDO2 is passwordless, you NEED to use a PIN, which is the "something you know" part, the key being "something you have".

And if the PIN is complex enough, bruteforcing or guessing won't work as I believe the default behavior is to wipe the secure element storage after 8 incorrect attempts (with 3 attempts per key being initialized at a time).

[ Parent | on HN ]

Re:Ask HN: Why is WebAuthn so slow to take off? by crote on Monday April 24, 2023 @06:05AM (#35685594)

Those bruteforce protections aren't really worth a lot in practice. If you have physical access to the device, you will eventually be able to find a way to glitch it - as things like Cellebrite have already proven for the iPhone.

[ Parent | on HN ]

Re:Ask HN: Why is WebAuthn so slow to take off? by m-p-3 on Monday April 24, 2023 @02:21PM (#35691215)

Is there any demonstrated case where someone was able to exfiltrate secrets from a Yubikey secure element?

[ Parent | on HN ]