awesome-webauthn

WebAuthn does not mandate any kind of form factor[1], external tokens use CTAP for USB/Bluetooth/NFC, Apple FaceID/TouchID and Windows Hello using proprietary interfaces with the built-in hardware. Blink-based browsers ships with a virtual authenticator for debugging[2] and there are a few more[3]. Apple and Google already announced cloud syncing earlier this year, using "passkey" as a friendlier term for end-users. QR codes already allow for cross-ecosystem non-synced use cases, like using my personal Android phone to log in an account with my work Macbook. https://securitycryptographywhatever.buzzsprout.com/1822302/... is a good listen to catch up on the latest developments. [1]: https://www.w3.org/TR/webauthn-2/#authenticator-model [2]: https://developer.chrome.com/docs/devtools/webauthn/ [3]: https://github.com/herrjemand/awesome-weba

Several WebAuthn Software authenticators: https://github.com/herrjemand/awesome-webauthn#software-auth... https://news.ycombinator.com/item?id=31272867#31274677 > FIDO security keys that explicitly support backing up and restoring their master secrets?

You don't need those either, perhaps https://github.com/herrjemand/awesome-webauthn is more to your liking than the website of a standards organization.

There are some software tokens (Wear OS watch, Android phone), but they are purposely not exportable from the Android Keystore. https://github.com/herrjemand/awesome-webauthn#software-auth... There was mention of a secure backup proposal, but it doesn't appear to have been touched after being a draft for a year: https://github.com/Yubico/webauthn-recovery-extension

> People love wireguard for its simplicity because it doesn’t use certs and PAKEs and whatnot. I don't know of a VPN that uses PAKE, so I don't get this comparison, but whatever. My point about certs was that OP was effectively proposing self-signed X509 client certs. It's unclear to me in what way those are harder to use than the proposal here, except that they actually are a widely accepted standard with user agent support. > WebAuthn’s crowd and browser implementers on the other hand seem fixated on making sure users never have the option to deploy the protocol in such a way. That’s the problem. https://github.com/herrjemand/awesome-webauthn#software-auth...?