Soporte para Yubikey/Clave U2F

[Stephen]

Hoping Apple announce something in June. In the UK and North America iOS accounts for ~56% of mobile internet devices, Android accounts for 42%. Really hard for anyone to deploy this at scale until that changes.

[sam (Sam Saffron)]

I am slotting this for 2.4, very unlikely we will get it done for 2.3 but who knows.

[riking (Kane York)]

News on this:

Firefox just enabled the older U2F registration method by default for the next release, due to historical raisins in Android. (WebAuthn was already enabled.)

Intent-to-Ship: Backward-Compatibility FIDO U2F support for Google Accounts

[codinghorror (Jeff Atwood)]

I definitely like this for 2.4, seems like all major browsers are on board except iOS

[murrant (Tony Murray)]

Is the plan to allow password-less login with webauthn or just second factor?

[codinghorror (Jeff Atwood)]

Ideally both, is what I am thinking.

[Starbeamrainbowlabs]

Update: NFC-based webauthn has just landed in Firefox Beta for Android, if I understand it correctly.

[riking (Kane York)]

2FA ahora tiene una pantalla de configuración dedicada:

Second factor landing page, register multiple TOTP keys

During some flight time, I got curious about how web authentication and auth schemas worked, since I know we want to start to support it as a factor method, and started to investigate how it was implemented in certain spaces. One thing that stands out to me is that all implementations have a landing page listing out all second factor forms - our implementation of TOTP codes currently does not have this page because we had initially only offered a single second factor method. I’d like to propose…

[Stephen]

Esperando con interés el soporte para U2F, ya lo estoy utilizando en varios otros lugares.

[sam (Sam Saffron)]

Va a suceder, está en la hoja de ruta de Discourse Version 2.4

[Falco]

Una cosa que me gustaría discutir es cómo utilizaremos WebAuthn en Discourse. ¿Será simplemente una forma alternativa de 2FA? ¿O podremos usarlo como un método de inicio de sesión alternativo, similar al inicio de sesión con redes sociales o correo (en lugar de nombre de usuario y contraseña)?

[Falco]

U2F ha muerto, viva WebAuthn

Webauthn support

Webauthn RFC This topic aims to document the Discourse project goals around FIDO2 / Webauthn authentication. Why? Adding Webauthn support to Discourse will increase the security of user accounts, enabling easily acessible password-less accounts using their devices secure features, like a smartphone fingerprint reader. Authentication Methods Webauthn as a second factor authenticator (act like a Google Authenticator alternative) Webauthn as a first factor authenticator (act like a social login …