zlacker

[parent] [thread] 2 comments
1. lxgr+(OP)[view] [source] 2024-12-27 04:45:44
There is no technical requirement for discoverable credentials in most scenarios.

Sure, not having to type your username is nice, but I'll gladly still do that if it allows "passphrase-based paper-restore-able authenticators" such as the one you describe. (I have one of these, in fact!)

Many services I use that do support WebAuthN allow either variant to be used (i.e. they'll prefer discoverable credentials but will work just fine with non-discoverable ones), and arguably that should be how almost everybody ought to implement it.

Unfortunately, at least as many other services completely botch it, e.g. by making discoverable credentials mandatory, by allowlisting browsers (e.g. Paypal), allowlisting authenticators (e.g. my government's e-signature platform), or by using them in a functionally braindead way (e.g. Amazon, who for completely unfathomable reasons still requires TOTP behind WebAuthn, i.e. they replace the password with it, not the second factor).

So far I haven't noticed a strong trend towards enforcing discoverable credentials, but let's please name and shame everybody doing that. It's completely unnecessary.

replies(1): >>tgsovl+WM1
2. tgsovl+WM1[view] [source] 2024-12-27 23:02:31
>>lxgr+(OP)
> Many services I use that do support WebAuthN allow either variant

The problem with "many" is that unless it's 100% of the ones someone cares about, the solution can't really solve the problem, adding an additional pain in the ass and making it easier to just stick with passwords.

Sometimes, a lack of choices is a feature. (Compare e.g.: IPSec vs. Wireguard).

replies(1): >>lxgr+ra2
◧◩
3. lxgr+ra2[view] [source] [discussion] 2024-12-28 03:32:08
>>tgsovl+WM1
How so? You can use the exact same password manager for both.

> Sometimes, a lack of choices is a feature. (Compare e.g.: IPSec vs. Wireguard).

HTTP vs. HTTPS seems like a more appropriate comparison in this context. Passwords and OTPs are really, really phishable.

[go to top]