Yubikey/U2F Key Support

[Stephen]

Hoping Apple announce something in June. In the UK and North America iOS accounts for ~56% of mobile internet devices, Android accounts for 42%. Really hard for anyone to deploy this at scale until that changes.

[sam (Sam Saffron)]

I am slotting this for 2.4, very unlikely we will get it done for 2.3 but who knows.

[riking (Kane York)]

News on this:

Firefox just enabled the older U2F registration method by default for the next release, due to historical raisins in Android. (WebAuthn was already enabled.)

https://groups.google.com/d/msg/mozilla.dev.platform/q5cj38hGTEA/1IKq9vSDAwAJ

[codinghorror (Jeff Atwood)]

I definitely like this for 2.4, seems like all major browsers are on board except iOS

[murrant (Tony Murray)]

Is the plan to allow password-less login with webauthn or just second factor?

[codinghorror (Jeff Atwood)]

Ideally both, is what I am thinking.

[Starbeamrainbowlabs]

Update: NFC-based webauthn has just landed in Firefox Beta for Android, if I understand it correctly.

[riking (Kane York)]

2fa now has a dedicated settings screen:

Second factor landing page, register multiple TOTP keys

During some flight time, I got curious about how web authentication and auth schemas worked, since I know we want to start to support it as a factor method, and started to investigate how it was implemented in certain spaces. One thing that stands out to me is that all implementations have a landing page listing out all second factor forms - our implementation of TOTP codes currently does not have this page because we had initially only offered a single second factor method. I’d like to propose…

[Stephen]

Looking forward to U2F support, already using it in several other places.

[sam (Sam Saffron)]

It is going to happen, on the roadmap for Discourse Version 2.4

[Falco]

One thing that I would like to discuss is how we will use webauthn in Discourse. Will it just be an alternative form of 2FA? Or will we be able to use it as an alternate form of login, like a social/mail login (in place of username/password)?

[Falco]

U2F is dead, long live webauthn

Webauthn support

Webauthn RFC This topic aims to document the Discourse project goals around FIDO2 / Webauthn authentication. Why? Adding Webauthn support to Discourse will increase the security of user accounts, enabling easily acessible password-less accounts using their devices secure features, like a smartphone fingerprint reader. Authentication Methods Webauthn as a second factor authenticator (act like a Google Authenticator alternative) Webauthn as a first factor authenticator (act like a social log…