Supporto per chiavi Yubikey/U2F

[Stephen]

Hoping Apple announce something in June. In the UK and North America iOS accounts for ~56% of mobile internet devices, Android accounts for 42%. Really hard for anyone to deploy this at scale until that changes.

[sam (Sam Saffron)]

I am slotting this for 2.4, very unlikely we will get it done for 2.3 but who knows.

[riking (Kane York)]

News on this:

Firefox just enabled the older U2F registration method by default for the next release, due to historical raisins in Android. (WebAuthn was already enabled.)

Intent-to-Ship: Backward-Compatibility FIDO U2F support for Google Accounts

[codinghorror (Jeff Atwood)]

I definitely like this for 2.4, seems like all major browsers are on board except iOS

[murrant (Tony Murray)]

Is the plan to allow password-less login with webauthn or just second factor?

[codinghorror (Jeff Atwood)]

Ideally both, is what I am thinking.

[Starbeamrainbowlabs]

Update: NFC-based webauthn has just landed in Firefox Beta for Android, if I understand it correctly.

[riking (Kane York)]

2fa ora ha una schermata delle impostazioni dedicata:

Second factor landing page, register multiple TOTP keys

During some flight time, I got curious about how web authentication and auth schemas worked, since I know we want to start to support it as a factor method, and started to investigate how it was implemented in certain spaces. One thing that stands out to me is that all implementations have a landing page listing out all second factor forms - our implementation of TOTP codes currently does not have this page because we had initially only offered a single second factor method. I’d like to propose…

[Stephen]

Non vedo l’ora di avere il supporto U2F, che uso già in diversi altri contesti.

[sam (Sam Saffron)]

Accadrà, è nella roadmap per Discourse Version 2.4

[Falco]

Una cosa che vorrei discutere è come utilizzeremo WebAuthn in Discourse. Sarà solo una forma alternativa di 2FA? O potremo utilizzarlo come metodo di accesso alternativo, simile a un login tramite social o email (al posto di nome utente e password)?

[Falco]

U2F è morto, viva WebAuthn

Webauthn support

Webauthn RFC This topic aims to document the Discourse project goals around FIDO2 / Webauthn authentication. Why? Adding Webauthn support to Discourse will increase the security of user accounts, enabling easily acessible password-less accounts using their devices secure features, like a smartphone fingerprint reader. Authentication Methods Webauthn as a second factor authenticator (act like a Google Authenticator alternative) Webauthn as a first factor authenticator (act like a social login …