Collaborate Disseminate
Passkeys seems great for me as an individual, instead of passwords and TOTP tokens I can now slowly ditch the passwords and the somewhat annoying (but important!) TOTP tokens which I have locked in my phone.
I have read that passkeys will … Continue reading Are passkeys a secure replacement for 2FA?
What alternatives for authentication and authorization technologies besides OAuth, SAML, OpenID Connect, and WebAuthn can be used for cloud apps?
I am currently writing my thesis and would like to look into the future and see if there are … Continue reading alternatives for OAuth, SAML, OpenID Connect, and WebAuthn [closed]
User verification in WebAuthn can either be required, preferred, or discouraged. The last two are a hint to the authenticator that may be ignored. I see how they could be used to prevent client-side user verification if the server has alre… Continue reading What is the point of required user verification in WebAuthn?
We’re wanting to support out-of-the-box digital currency wallets for user’s of our web app.
We have passkeys / webauthn working and would ideally like to associate these credentials with wallet access.
Wallets should be self custodial with… Continue reading Passkeys WebAuthN PRF extension to encrypt/decrypt private key of non-custodial wallet
I’ve been reading about WebAuthn and try to write some code to exercise.
One thing I noticed is that the spec doesn’t seem to provide any way to verify the correctness of the public-key being create()’d other than through attestation. And … Continue reading WebAuthn does not guarantee public-key integrity other than trough attestation?
Do passkeys offer more security for intranet websites compared to passwords?
I know there are additional methods like 2FA to get more security, but I just want to look at a optional replacement for simple password-based authentication over… Continue reading Passkeys versus passwords for intranet websites
What is the best practice for allowing users to reset a passkey (WebAuthn)?
Should I just have them click a link in their email like it was a password, or is there a more secure way of doing it? In addition, is there best practice way of a… Continue reading What is the proper procedure to allow users to reset their passkey
Where/what are the technical specifications to sync FIDO passkeys?
FIDO passkeys are a quite hot topic. There is a white paper from FIDO Alliance about it. Several websites provide abstract descriptions which leave a lot to be desired in t… Continue reading FIDO Multi-device Authentication Sync Technical Specification
So Apple syncs FIDO Passkeys across a user’s devices using iCloud Keychain.
Can one inspect those Passkeys in ones own iCloud Keychain e.g. with the macOS app Keychain Access? I have tried with version 11.0 on macOS 13.1, but don’t yet see… Continue reading Can one inspect Passkeys on iCloud Keychain [migrated]
Is it possible to inspect data (pubkeys, domain names used for webauthn, not private keys) related to private keys stored in the TPM on Windows?
I legally own the hardware and have maximum permissions on my user account
I have the necessa… Continue reading Is it possible to see the pubkeys that pair with private keys inside the TPM in Windows?