Hacker GitHub

← All repos

w3c/webauthn

View on GitHub ↗ ★ 1,489 Bikeshed

Web Authentication: An API for accessing Public Key Credentials

40 mentions on Hacker News by 25 people: 2 stories, 38 comments · first 2018-03-26 · latest 2026-07-16

Mentions per year 40 mentions · busiest year 2022 (12)
20082026
AllStoriesComments NewestTopOldest
  1. …without JavaScript[1] was that the big websites don’t care and thus neither do the browsers. [1] https://github.com/w3c/webauthn/issues/1255
    comment by mananaysiempre · 2026-07-16 · in If you want to create a button from scratch, you must first create the universe
  2. …enable encryption directly from a passkey, without having to deal with awkward key storage[1]. [0]: https://github.com/w3c/webauthn/wiki/Explainer:-PRF-extensio... [1]: https://confer.to/blog/2025/12/passkey-encryption
    comment by alexinavar · 2026-01-21 · in SubtleCrypto: GenerateKey() Method
  3. …that kind of thing, so money will inevitably end up being the largest determinant of influence. [1] https://github.com/w3c/webauthn/issues/1255
    comment by mananaysiempre · 2025-09-02 · in Static sites enable a good time travel experience
  4. …they are unwilling to add a "silence" option to webauthn. I am confused about the decision though. https://github.com/w3c/webauthn/issues/199#issuecomment-2669...
    comment by mmis1000 · 2025-05-02 · in Chrome Origin Trial: Device Bound Session Credentials
  5. …a very small API modification, but alas, the WebAuthN working group didn't consider it necessary: https://github.com/w3c/webauthn/issues/1822
    comment by lxgr · 2024-12-30 · in Passkey technology is elegant, but it's most definitely not usable security
  6. …in Github issues as well as on public mailing lists is probably as transparent as it gets. [1] https://github.com/w3c/webauthn/issues/1822
    comment by lxgr · 2024-12-27 · in A Tour of WebAuthn
  7. …where your password manager and your server don't agree and it's very confusing for end users. https://github.com/w3c/webauthn/issues/2038 They apparently came up with a fix for this using something called Signals API but I don't think any…
    comment by arianvanp · 2024-12-27 · in A Tour of WebAuthn
  8. I have been following the discussions closely in https://github.com/w3c/webauthn and I haven't seen anything about exportability there in the past year. The only reference I can find is that post on Hachyderm from a year ago. We're a year…
    comment by arianvanp · 2024-05-03 · in Passkey Implementation: Misconceptions, pitfalls and unknown unknowns
  9. If you want passkeys without Javascript, leave a thumbs-up on [1]. [1] https://github.com/w3c/webauthn/issues/1255
    comment by Mindless2112 · 2024-04-26 · in Passkeys: A shattered dream
  10. …the passkey autocomplete but there hasn't been any traction or appetite for it unfortunately :( https://github.com/w3c/webauthn/issues/1976
    comment by arianvanp · 2024-04-26 · in Passkeys: A shattered dream
  11. …to have given up on one of them? [1] https://github.com/fido-alliance/how-to-fido/issues/16 [2] https://github.com/w3c/webauthn/issues/1612 [3] https://github.com/w3c/webauthn/issues/1822
    comment by lxgr · 2024-03-17 · in Passkeys – Under the Hood
  12. …paradigm". Hardware authenticators somehow don't feel like a first-class API concern anymore. [1] https://github.com/w3c/webauthn/issues/1822 [2] https://github.com/fido-alliance/how-to-fido/issues/16
    comment by lxgr · 2024-03-17 · in Passkeys – Under the Hood
  13. …in the w3c/webauthn repo, or meetings, which is open. Here are the open issues about portability: https://github.com/w3c/webauthn/issues?q=portability Maybe I'm searching wrong? Here's migration: https://github.com/w3c/webauthn/issues?q=mig…
    comment by danShumway · 2024-03-14 · in KeePassXC Issue: [Passkeys] should never be exported in clear text
  14. …is via the WebAuthn specification, which is developed entirely in public via a GitHub repo ( https://github.com/w3c/webauthn ). Passkeys aren't a standard or protocol. A passkey is the name of a type of credential that can be used via the…
    comment by timmyc123 · 2024-03-14 · in KeePassXC Issue: [Passkeys] should never be exported in clear text
  15. …that supports these kind of 3D-Secure usecases. https://www.w3.org/TR/secure-payment-confirmation/ https://github.com/w3c/webauthn/issues/1667
    comment by arianvanp · 2023-06-06 · in Passkeys now support external providers
  16. …(or whether significant portions of users opt out of it, when prompted by their browser). [1]: https://github.com/w3c/webauthn/pull/1491 [2]: https://www.apple.com/certificateauthority/Apple_WebAuthn_Ro...
    comment by woodruffw · 2023-05-19 · in Understanding Passkeys
  17. …and I guess I'll begrudgingly have to switch to using an external FIDO authenticator instead. [1] https://github.com/w3c/webauthn/issues/1714
    comment by lxgr · 2023-05-03 · in Passkeys: The beginning of the end of the password
  18. …impossible to phish if companies completely remove the ability to log in with a password and TOTP. https://github.com/w3c/webauthn/issues/1640 [2] https://github.com/w3c/webauthn/issues/931 [3] https://github.com/w3c/webauthn/issues/865
    comment by knaik94 · 2022-12-09 · in Introducing passkeys in Chrome
  19. …will frequently have multiple passkeys, thus not be 'locked in' to any one sync ecosystem. From https://github.com/w3c/webauthn/wiki/Explainer:-broadening-t... > When signing in on a different computer, either the credential will already…
    comment by windlep · 2022-11-04 · in Passage Is Joining 1Password
  20. …the space going through some exciting changes and it may be much more feasible in a few years! [1] https://github.com/w3c/webauthn/wiki/Explainer:-WebAuthn-Con... [2] https://github.com/w3c/webauthn/pull/1576
    comment by mcstempel · 2022-10-14 · in Ask HN: WebAuthn – Replace Password or Second Factor?
  21. …JavaScript, currently every website has to implement their own login protocol in JavaScript. https://github.com/w3c/webauthn/issues/1255 https://github.com/w3c/webauthn/issues/1616
    comment by pabs3 · 2022-10-13 · in Bringing passkeys to Android and Chrome
  22. …own login protocol in JavaScript. https://www.cloudflare.com/learning/access-management/what-i... https://github.com/w3c/webauthn/issues/1255 https://github.com/w3c/webauthn/issues/1616
    comment by pabs3 · 2022-10-11 · in AI-driven thermal cameras used to obtain passwords
  23. Found some possibly related issues: https://github.com/w3c/webauthn/issues/1616 https://github.com/w3c/webauthn/issues/1255
    comment by pabs3 · 2022-09-23 · in Passkeys
  24. …But recently serialisation and deserialisation _has_ been added to the standard. So it's something: https://github.com/w3c/webauthn/pull/1703 Github maintains a Ponyfill for browsers that don't support this standardised serialisation…
    comment by arianvanp · 2022-09-23 · in Passkeys
  25. …the risk of lock-in beyond that of any of the other major Webauthn authenticator providers. [0]: https://github.com/w3c/webauthn/issues/865#issuecomment-3804... [1]: https://github.com/Yubico/webauthn-recovery-extension [2]:…
    comment by garrettr_ · 2022-09-15 · in iOS 16 Available September 12th
  26. I wondered this too, and found https://github.com/w3c/webauthn/issues/151 . The short answer is "not easily". According to Mozilla's docs & that issue, it seems like WebAuthn considers the UA and the "authenticator" different. The…
    comment by deathanatos · 2022-06-23 · in Guide to Web Authentication
  27. …much of a concern as is security. [1] https://fidoalliance.org/multi-device-fido-credentials/ [2] https://github.com/w3c/webauthn/issues/1714
    comment by lxgr · 2022-05-05 · in Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard
  28. …would require a very explicit opt-out, not an opt-in, on the relying party's side. [1] https://github.com/w3c/webauthn/issues/1714
    comment by lxgr · 2022-05-05 · in Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard
  29. https://github.com/w3c/webauthn/issues/1462
    comment by raggi · 2022-04-26 · in WebAuthn Browser Support
  30. …Google is testing this on their properties while it's being standardized in CTAP and WebAuthn, see https://github.com/w3c/webauthn/issues/1381
    comment by Rafert · 2021-04-17 · in What I Wish I Knew About U2F and Other Hardware MFA Protocols
  31. …no WebAuthn browser implementation exposes this extension to web apps. [0]: see e.g. discussion on https://github.com/w3c/webauthn/issues/199 [1]: https://fidoalliance.org/specs/fido-v2.1-rd-20210309/#sctn-h... [2]:…
    comment by Rafert · 2021-04-17 · in What I Wish I Knew About U2F and Other Hardware MFA Protocols
  32. …interest to you. It's better than 2fa codes, since it's effectively FIDO/web AuthN (unphishable). https://github.com/w3c/webauthn/pull/909
    comment by hirsin · 2021-03-13 · in Show HN: Authenticator by 2Stable
  33. …that, can you point us to the docs/examples? OTOH, I see that someone right now posted a reply to https://github.com/w3c/webauthn/issues/1175#issuecomment-570... trying to downplay the issue of purely software tokens Funnily,…
    comment by sam_lowry_ · 2020-01-05 · in A Guide to WebAuthn
  34. …referring to the caBLE (cloud-assisted Bluetooth LE) transport: this is still being worked on ( https://github.com/w3c/webauthn/pull/909 but the actual discussion in the FIDO Alliance is non-public) and at the time of writing only works on…
    comment by Rafert · 2020-01-05 · in A Guide to WebAuthn
  35. Working group's repo: https://github.com/w3c/webauthn
    comment by aboutruby · 2019-03-04 · in W3C approves WebAuthn as the web standard for password-free logins
  36. …published meeting minutes[2], and JCJ (Mozilla) and JeffH (Paypal) seem to be highly involved. [1]: https://github.com/w3c/webauthn/graphs/contributors [2]: https://www.w3.org/blog/webauthn/2018/01/11/meeting-minutes-... EDIT: add…
    comment by ilikepi · 2018-05-08 · in Yubico and Microsoft Introduce Passwordless Login
  37. …the W3C copy from being used as an implementation reference, even as an outdated standard. Example: https://github.com/w3c/webauthn/issues/257 So the W3C copy is not authoritative, nor can it be in its current state, regardless of what the…
    comment by mattur · 2018-04-14 · in Microsoft, Google, Mozilla, and Apple Object to W3C Fork of DOM Spec
  38. …about this, but no one cares. https://www.reddit.com/r/programming/comments/7p5yha/proposa... https://github.com/w3c/webauthn/issues/820 https://github.com/whatwg/html/issues/3337
    comment by xialvjun · 2018-03-26 · in Ask HN: What percentage of your users are using social login?