Windows 10: Why W3C WebAuthn will change the world

Brink · Apr 25, 2019

A little over a month ago, W3C WebAuthn became a real internet specification. Most of you don’t know what WebAuthn is yet, but many of you will feel the impact in short order. In fact, I will go so far as to say that WebAuthn may change how we all authenticate to the resources we use every day. We live in a world where the best parts of our individual local hardware and software collection are rarely leveraged to make cloud security decisions. This is because there has never been a vendor-agnostic and privacy-preserving way for cloud resources to interact with individual hardware configurations in any generic way. Until now!

With WebAuthn, any web entity can call a simple Javascript API and ask for a cryptographically secure credential. What happens next is pretty cool – the world’s browsers have worked with the world’s operating system makers and the world’s hardware manufacturers, so that when a website asks for a credential, the browsers work with the underlying platform to securely locate compliant local hardware and talk to it!

All of a sudden, there is a way for all the devices close to us to speak for us. Whether it is my fitness device, a built-in fingerprint reader, a soft token or a roaming security key, we now have credible alternatives for passwords, because the very proximity of my device makes it hard for an attacker to subvert, my devices need to be either built-in, plugged in, or wirelessly connected.

The ratification of WebAuthn is only a first step. While we have agreement on how we can leverage what is locally connected, deployment is still ongoing and it will take time for all the pieces to be available in a way that can be used anywhere, by anyone. One day, your individual collection of devices will form a flexible, recoverable set of ‘authenticators’ that make it very easy for you to get to your cloud resources. We won’t overwhelm you with technology, but rather use what you already keep with you every day.

The most amazing thing about WebAuthn (and companion specs also ratified at the FIDO Alliance) is how many different companies have had to form consensus before this specification could exist. It has been seven years of debate, proposals, interops, working group meetings, editorial tweaks, liaison work with other specifications, evangelism and working code to get us where we are.

Whatever happens, keep an eye out for W3C WebAuthn and FIDO2. And raise a glass to your neighborhood standards engineer, they deserve it.

Cheers, and congratulations on your ratification, W3C WebAuthn and FIDO2 CTAP2!
Click to expand...

Source: Why WebAuthn will change the world - Microsoft Tech Community - 482286

:)

Brink · Apr 25, 2019

W3C & FIDO Alliance Finalize Web Standard Secure, Passwordless Logins

The World Wide Web Consortium (W3C) and the FIDO Alliance today announced the Web Authentication (WebAuthn) specification is now an official web standard. This advancement is a major step forward in making the web more secure— and usable—for users around the world.

W3C's WebAuthn Recommendation, a core component of the FIDO Alliance's FIDO2 set of specifications, is a browser/platform standard for simpler and stronger authentication. It is already supported in Windows 10, Android, and Google Chrome, Mozilla Firefox, Microsoft Edge and Apple Safari (preview) Web browsers. WebAuthn allows users to log into their internet accounts using their preferred device. Web services and apps can — and should—turn on this functionality to give their users the option to log in more easily via biometrics, mobile devices and/or FIDO security keys, and with much higher security over passwords alone.

“Now is the time for web services and businesses to adopt WebAuthn to move beyond vulnerable passwords and help web users improve the security of their online experiences,” said Jeff Jaffe, W3C CEO. “W3C's Recommendation establishes web-wide interoperability guidance, setting consistent expectations for web users and the sites they visit. W3C is working to implement this best practice on its own site.”

A user-friendly solution to password theft, phishing and replay attacks

It's common knowledge that passwords have outlived their efficacy. Not only are stolen, weak or default passwords behind 81 percent of data breaches, they are a drain of time and resources. According to a recent Yubico study, users spend 10.9 hours per year entering and/or resetting passwords, which costs companies an average of $5.2 million annually. While traditional multi-factor authentication (MFA) solutions like SMS one-time codes add another layer of security, they are still vulnerable to phishing attacks, aren’t simple to use and suffer from low opt-in rates.

With FIDO2 and WebAuthn, the global technology community has come together to provide a shared solution to the shared password problem. FIDO2 addresses all of the issues with traditional authentication:

Security: FIDO2 cryptographic login credentials are unique across every website, biometrics or other secrets like passwords never leave the user’s device and are never stored on a server. This security model eliminates the risks of phishing, all forms of password theft and replay attacks.

Convenience: Users log in with convenient methods such as fingerprint readers, cameras, FIDO security keys, or their personal mobile device.

Privacy: Because FIDO keys are unique for each Internet site, they cannot be used to track you across sites.

Scalability: websites can enable FIDO2 via simple API call across all supported browsers and platforms on billions of devices consumers use every day.

“Web Authentication as an official web standard is the pinnacle of many years of industry collaboration to develop a practical solution for stronger authentication on the web,” said Brett McDowell, executive director of the FIDO Alliance. “With this milestone, we're moving into a new era of ubiquitous, hardware-backed FIDO Authentication protection for everyone using the internet.”

Getting started

For services providers and vendors ready to get started with FIDO2 specifications and browser/platform support, the FIDO Alliance has provided testing tools and launched a certification program. Currently, there are many FIDO2 Certified solutions available to support a wide variety of use cases, including FIDO Certified Universal Servers that support FIDO2 and all prior UAF and U2F devices for full backward compatibility with the full range of certified FIDO authenticators.

Visit the FIDO Alliance website for more information on FIDO2, including resources for developers and product vendors interested in taking part in the FIDO Certified program.
Click to expand...

Source: https://www.w3.org/2019/03/pressrele...hn-rec.html.en

Sasqui · Apr 25, 2019

Overclocking / Undervolting guide for Vega 56 or 64?

Here's a quick laundry list:

List of software to use for overclocking and testing
Examples:
Wattman (and how to find and use it, like an overview, including profiles)
Unigine Valley or Heaven (use this for quick testing while changing settings in Wattman and checking for stability / artifacts) ...just suggesting this
How to monitor cores / mem speeds and temps during testing (I've seen screen overlays, and others using GPUz)

Step-by step overclocking in Wattman
Fan speeds
Power limit
Temp limit
Voltages
Core speeds
Memory speeds

cadaveca · Apr 25, 2019

Good surround sound headset

I know you say you're not that guy, but stepping into the $250+ range really brings a change in build quality that might have you never having to buy another set. Otherwise, getting 6 speakers with decent sound in a headset is hard, and that's what you are asking for, and I have no suggestions, but just a bump up the list. *Stick Out Tongue

Windows 10: Why W3C WebAuthn will change the world

Why W3C WebAuthn will change the world

Why W3C WebAuthn will change the world

Why W3C WebAuthn will change the world

Why W3C WebAuthn will change the world - Similar Threads - Why W3C WebAuthn

Windows Hello support for WebAuthn PRF extension

Windows Hello support for WebAuthn PRF extension

CredentialProvider with Webauthn API feature does not display the CredentialUIBroker.exe...

CredentialProvider with Webauthn API feature does not display the CredentialUIBroker.exe...

CredentialProvider with Webauthn API feature does not display the CredentialUIBroker.exe...

Why in the world does explorer...

Why in the world does explorer...

W3C and WHATWG agree to collaborate on single version of HTML and DOM

Minecraft world: the world disappeared