|
- Fido2 Webauthn Passkeys: rsa2048, rsa4096, or Ed25519?
Does anyone know what kind of keys are being generated when you make a Fido2 Webauthn passkey? rsa2048, rsa4096, Ed25519, or something else? Just worried if its rsa2048 it might soon be crackable, at least by state actors
- nonce - How to properly manage WebAuthn challenges? - Information . . .
I'm in the process of evaluating adding WebAuthn Passkey support to a website, and I'm not really sure how to properly manage challenge nonces My understanding is that the main reason for using
- Best Practices for WebAuthn FIDO2 reset - Information Security Stack . . .
WebAuthn is very useful for registering and logging in on a daily basis, but in case of loss or damage it fails I am looking for existing best practices in that domain, regulations or just examples that have done something like this before
- What is the point of required user verification in WebAuthn?
Similarly for webauthn (or FIDO2 in general), the server can tell the client to require user verification, the authenticator can ignore this requirement, and companies who purchase authenticators by the truckload can cancel all their contracts with the maker of the authenticator
- Is there a reason to not send signed FIDO2 WebAuthn session data to the . . .
Every WebAuthn implementation I've seen stores the session data server side, but that just seems pointless to me, since what seems to be essentially all the same data is already sent to the client
- multi factor - Is clientDataJson and attestationObject required to . . .
Is clientDataJson and attestationObject required to verify assertion during authentication in WebAuthN? Ask Question Asked 1 year ago Modified 1 year ago
- How does it allow a malicious website to obtain valid credentials . . .
How does it "allow a malicious website to obtain valid credentials " - WebAuthn Ask Question Asked 1 year, 8 months ago Modified 1 year, 8 months ago
- webauthn - How is a passkey more secure than the regular email password . . .
Passkeys aren't more secure – but they're a great way to bring the phishing resistance of WebAuthn FIDO U2F to the masses, without having to buy expensive hardware keys
|
|
|