jtrn
2 hours ago
I'm a bit emotional after an extremely long and aggravating day at work, so this is probably situational based, but I HATE the whole god damn security field, and this is one of many examples of why.
It's impossible to get simple explanations out of anybody in that field. And it's why security has always been a pain. It's like they're allergic to making plain, straightforward sense.
Here’s what this actually means for people who expect stuff to matter in any practical terms.
5.8 changes zero things about how you work. You cannot upgrade older keys to it, you have no reason to buy it, and the two features actually in there have never once been used by anyone outside a lab. The WebAuthn thing could, in theory, make the browser remember your key so you don't have to pin every time you use it, but that only happens when Apple, Google and others implement this proposed standard. Right now, no browser can call it. Not Chrome, not Safari, not anything. The spec is an open pull request. If it ever ships it's years out, and it wont be you that starts using it first, it would have to be some big auth entity.
The ARKG thing: same, plus it needs a wallet ecosystem that doesn't exist yet.
Yubico shipped firmware whose headline features nothing can currently use, is not relevant for existing hardware, and wrote three pages about AI to sell it. That's the actual story.
bleh.
deepsun
2 hours ago
But a manager came to my desk and asked "what can we do for the AI era"?
locknitpicker
an hour ago
> The WebAuthn thing could, in theory, make the browser remember your key so you don't have to pin every time you use it, but that only happens when Apple, Google and others implement this proposed standard. Right now, no browser can call it. Not Chrome, not Safari, not anything.
Wikipedia says that "WebAuthn is supported by Google Chrome, Mozilla Firefox, Microsoft Edge, Apple Safari[13] and Opera.[32]"
https://en.wikipedia.org/wiki/WebAuthn
Here's a Chrome link published back in 2018
https://developer.chrome.com/docs/identity/webauthn
Here's a Chrome DevTools article on their support for WebAuthn
https://developer.chrome.com/docs/devtools/webauthn
Perhaps you should check your notes?.If you know something that everyone around you doesn't, please update wikipedia's article.
jtrn
38 minutes ago
Perhaps you should look at the announcement. Of course webauthin is in the browsers. They didn’t announced that they now support webauthn??? I said the webauthn THING because it’s an addition to that functionality!
A 2018 page announcing the base API, and a devtool page about the virtual authenticator debugger is not relevant to this new extensions.
The thing that’s an unshipped proposal is the sign extension.
So my point stands, nothing new and useful in this at all and nothing they announced is usable for anybody today.
Or am I mistaken? What new thing will you, or anybody, do with this 5.8 announcement?
mixmastamyk
an hour ago
What does the word “pin” mean in this sentence? Looks like a typo.
entrope
15 minutes ago
It means entering a personal identification number (PIN) as an authentication step.