Yubikey/U2F-Key-Unterstützung

[Stephen]

Hoping Apple announce something in June. In the UK and North America iOS accounts for ~56% of mobile internet devices, Android accounts for 42%. Really hard for anyone to deploy this at scale until that changes.

[sam (Sam Saffron)]

I am slotting this for 2.4, very unlikely we will get it done for 2.3 but who knows.

[riking (Kane York)]

News on this:

Firefox just enabled the older U2F registration method by default for the next release, due to historical raisins in Android. (WebAuthn was already enabled.)

Intent-to-Ship: Backward-Compatibility FIDO U2F support for Google Accounts

[codinghorror (Jeff Atwood)]

I definitely like this for 2.4, seems like all major browsers are on board except iOS

[murrant (Tony Murray)]

Is the plan to allow password-less login with webauthn or just second factor?

[codinghorror (Jeff Atwood)]

Ideally both, is what I am thinking.

[Starbeamrainbowlabs]

Update: NFC-based webauthn has just landed in Firefox Beta for Android, if I understand it correctly.

[riking (Kane York)]

2FA verfügt jetzt über einen eigenen Einstellungsbildschirm:

Second factor landing page, register multiple TOTP keys

During some flight time, I got curious about how web authentication and auth schemas worked, since I know we want to start to support it as a factor method, and started to investigate how it was implemented in certain spaces. One thing that stands out to me is that all implementations have a landing page listing out all second factor forms - our implementation of TOTP codes currently does not have this page because we had initially only offered a single second factor method. I’d like to propose…

[Stephen]

Freuen uns auf die U2F-Unterstützung, die wir bereits an mehreren anderen Stellen nutzen.

[sam (Sam Saffron)]

Das wird passieren, es steht auf dem Roadmap für Discourse Version 2.4

[Falco]

Eine Sache, die ich gerne diskutieren möchte, ist, wie wir WebAuthn in Discourse einsetzen werden. Wird es nur eine alternative Form der Zwei-Faktor-Authentifizierung sein? Oder werden wir es als alternative Anmeldemethode nutzen können, ähnlich wie eine Social-/E-Mail-Anmeldung (anstelle von Benutzername/Passwort)?

[Falco]

U2F ist tot, es lebe WebAuthn

Webauthn support

Webauthn RFC This topic aims to document the Discourse project goals around FIDO2 / Webauthn authentication. Why? Adding Webauthn support to Discourse will increase the security of user accounts, enabling easily acessible password-less accounts using their devices secure features, like a smartphone fingerprint reader. Authentication Methods Webauthn as a second factor authenticator (act like a Google Authenticator alternative) Webauthn as a first factor authenticator (act like a social login …