Webauthn; Don’t do it wrong when doing it right

on YouTube ↗25m

" summary

Recounts an audit of WebAuthn and FIDO2 libraries and services that finds inconsistent handling of origins and RP IDs, with 16 validations (22 if extended) and a critical ambiguity at Step 13 about origin matching. Demonstrations show a subdomain XSS can forward a signed assertion to an attacker and Android’s credential provider flow plus pending intents and a sample exported activity let a malicious app forge getCredential requests, bypass prompts, and reuse responses; fixes: exact-origin checks, signed-app verification, avoid exported activities, and security reviews.

AI-written summary · about

" chapters (13)

1. 0:00WebAuthn introduction
2. 1:02What is WebAuthn
3. 3:07WebAuthn flows
4. 5:55WebAuthn phishing resistance
5. 7:45Relying Party ID risks
6. 10:15Library origin validation
7. 11:49Live demo: response theft
8. 13:47WebAuthn standard fixes
9. 14:51Android 14 API
10. 17:37Malicious app spoofing
11. 19:25Exported activities risks
12. 21:51Live demo: activity spoofing
13. 23:57WebAuthn best practices

" related talks

• 01h 14mWebAuthn: Theory and practiceMartin Splitt, Semyon Levenson · HolyJS 2020 Moscow
• 40mWebAuthn 201: How to FIDOChristiaan Brand · RSAC 2021
• 26mWebAuthn 101 - Demystifying WebAuthnChristiaan Brand · Black Hat USA 2019
• 25mHow do I..? Answering common questions from RP devsMatthew Miller · Authenticate 2024
• 29mWebAuthn and security keys - unlocking the key to authenticationChristiaan Brand · PasswordsCon 2018 Stockholm
• 42mBeyond Passwords: How WebAuthn Actually WorksEli Holderness · GOTO Amsterdam 2023
• 18mA Developers Guide to WebAuthnWill Johnson · React Miami 2023
• 45mSecure your application with WebAuthnArnaud Locquet · Devoxx France 2021