Matthias Friedrich's Blog

Playing with WebAuthn

On the internet today, our online accounts are exposed to a lot of risks. Leaked passwords from break-ins at major Internet properties or phishing attacks have lead to many account breaches. In order to protect my high-value accounts, I have either enabled two-factor authentication or I use federated sign-in, delegating to an account that has 2FA enabled (usually Google).

Recently, the FIDO industry association and the W3C have come up with WebAuthn, an open standard to promote passwordless sign-in using hardware tokens. If you run Android 7 or newer, you can use your phone as a token, and I have additionally bought a hardware Security Key from Yubikey to give this a try.

The idea behind the WebAuthn is relatively simple - it uses public-key cryptography for the client to authenticate itself (over TLS, of course). In a nutshell, the client creates a key pair and registers the public key with the server, while keeping the private key to itself. To authenticate, the server sends a challenge that the client signs using the private key. If the server is able to validate the signature with the previously stored public key, the client is considered authenticated.

Obviously, the hardware token must make sure the private key can never be extracted. Android phones use the built-in TPM module for that and hardware tokens have similar capabilities.

In order to try this out, I decided to use my tokens as a second factor for GitHub, replacing Google Authenticator with it's TOTP-based algorithm. I don't plan on using WebAuthn as a single factor - that is, without a password - for anything important, but it's nice having a standard that browsers support.

I got my Security Key working out of the box on Ubuntu 18.04.02 LTS without having to fiddle with udev rules. Chrome immediately supported it, I only had to plug it into the USB port. The process was straightforward via GitHub's 2FA configuration page (I had to switch the phone to desktop mode though). You can see both the Security Key and my phone registered:

security-keys

When logging in, GitHub even lets you choose which second factor you want to use in case you still have TOTP enabled, for example. If you only have one device, don't forget to print the recovery codes! You don't want to lock yourself out of the account if you lose your phone or key. And generally, even if you use 2FA, make sure your recovery mechanisms aren't vulnerable to attacks (SMS comes to mind).

If you find out more about WebAuthn, check the WebAuthn Guide, or the fantastic Auth0's demo site, which gives you a look behind the scenes of the protocol.

Other articles

Retries Can Kill You

Published: Mon 30 July 2018
By mafr

In best practices.

tags: distributed systems networking

In a large-scale distributed system, it's inevitable that some requests will fail. Even if your collaborating systems work perfectly, sooner or later you will experience temporary network issues and other intermittent errors. That's why a lot of people try to paint over this issue by implementing retries in their applications …
read more
The Curse of Convenience Methods

Published: Sun 05 February 2017
By mafr

In best practices.

tags: quality

In the old days, many Java APIs were fairly low level and pretty generic. You often had to explicitly select a concrete implementation, provide lots of parameters, and generally needed to know how things worked. This has changed in recent years - modern APIs provide lots of convenience functionality that raises …
read more
Let's Use TLS

Published: Sun 17 January 2016
By mafr

In best practices.

tags: security server web

I have followed the HTTP/2 specification process closely and I like how the new protocol improves web performance and makes old workarounds obsolete. One drawback of deploying HTTP/2 is that most browser vendors only implement it on top of TLS. Since I've seen a lot of broken TLS …
read more
Preventing Cascading Failure

Published: Sun 28 June 2015
By mafr

In best practices.

tags: distributed systems java networking

With the advent of reactive programming and frameworks like Netflix' Hystrix, classic stability patterns like Nygard's Circuit Breaker Pattern have entered mainstream software development. The circuit breaker is used inside your clients to cut the connection to a collaborating system (the server) once you notice the server doesn't answer in …
read more
A Case for Guard Clauses
Published: Fri 12 June 2009
By mafr

In best practices.

tags: opinion quality

One of my pet peeves in programming is that few people use guard clauses. A guard clause is an almost trivial concept that greatly improves readability. Inside a method, handle your special cases right away and return immediately.

Have a look at the following example:
```
private int doSomething() {
    if (everythingIsGood …
```
read more
Development Done Right

Published: Sun 01 March 2009
By mafr

In best practices.

tags: maven opinion quality rcs standards

In my projects, I've always been the one who took care of infrastructure, standardization and quality assurance from the development perspective. The funny thing is that I'm no admin and no QA guy, so most of it wasn't even my job. In this article, I'm going to list a few …
read more
Saving Session Data in Web Applications

Published: Sun 04 January 2009
By mafr

In best practices.

tags: scalability server web

There are many ways to store session data in web applications. They all differ in scalability, failover capabilities, and complexity. I'll give you a quick rundown on the major themes.

Session Data on the Client

You can often implement simple personalization features or workflows by storing state on the client …
read more
Efficient Development Environment Setup

Published: Sun 26 October 2008
By mafr

In best practices.

tags: build systems

Development environments and their configuration can become quite complex. It's not unusual that a complete workstation setup takes half a day or more and requires extensive help from other project members. Using virtual machines for the runtime environment can help to reduce setup and maintenance costs.

For large Java web …
read more
Professional Deployment and Operation of Web Applications

Published: Sun 07 September 2008
By mafr

In best practices.

tags: build systems deployment productivity server standards

There are millions of web applications on the Internet that are under constant development. Paying software developers to work on bug fixes and new features is quite expensive already, but what's often neglected is the cost for deployment and operation. Well-run organizations invest in their deployment and runtime infrastructure and …
read more

Other articles

Session Data on the Client

social