KeePassXC pull request to add basic support for WebAuthn

Re:KeePassXC pull request to add basic support for WebAuthn by lima on Monday May 08, 2023 @07:21AM (#35860358)

> Your bank and soon every other service will see how 'cheap' it is to fight spam and abuse simply by restricting accounts attested by [apple,google,microsoft] and nobody else, specially 'None' like this one.

If that's what they want, they can have it today via OAuth/OIDC (and many sites do just that). It's not a panacea - Google & Co catch some spam accounts but not all of them and not always before the damage is already done.

Passkeys/WebAuthn improve the situation by giving site operators more choices.

[ Parent | on HN ]

Re:KeePassXC pull request to add basic support for WebAuthn by gdubchcb on Monday May 08, 2023 @09:58AM (#35861567)

not even close the same thing.

oauth/oidc gives too much signal to the identity providers. it's a 1990s solution at the time advertisers were writing the specs alone. and the implementation required oath-nascar-sponsorship pattern to have dozen of providers. no bank would accept that.

webauth is a spec of this time, were it's still owned by advendors, but with a couple device vendors now for a semblance of balance. and it also solve the implementation issue of having to show too many logos on the login page.

so, no, it wasn't possible before webauth. webauth solves the oauth issues for 3rd party attestation with a semblance of anonymity (which is meaningless if both party exchange data on back channels)

[ Parent | on HN ]