• @bitfucker@programming.dev
    link
    fedilink
    English
    1017 days ago

    Be careful since it is a double edged sword. Device bound session means the browser has the capabilities to differentiate devices, and thus can be used for more accurate tracking information. Of course I’m not saying it is not useful, having created a fair share of websites myself, I know the pain of authentication on the web and how it can be challenging to secure from tons of possible attack vectors. And in my experience, the weakest link is always the user.

    • @dev_null@lemmy.ml
      link
      fedilink
      English
      517 days ago

      the browser has the capabilities to differentiate devices

      The browser can do it whether this exists or not. The only information the website gets is that the browser supports this feature or not, and nothing else.

      • @bitfucker@programming.dev
        link
        fedilink
        English
        217 days ago

        My bad, I worded that badly. What I meant is that the website now has access to those features via the browser (js or some other mechanism). Now suddenly fingerprinting a device can be made easier.

        • @dev_null@lemmy.ml
          link
          fedilink
          English
          1
          edit-2
          17 days ago

          That’s a valid concern, but according to the article all the website can access is the random public key, or the fact that the feature is unsupported in this browser (for an unspecified reason).

          • @bitfucker@programming.dev
            link
            fedilink
            English
            117 days ago

            Yeah, I’ve also read the article. I am just being cautious on how it can be used for other things that cause privacy concern. And so far, I’ve come up blank too.

  • @blackfire@lemmy.world
    link
    fedilink
    English
    217 days ago

    This is an incredibly important step forward but I have to wonder why its taken this long to come up with.

    • @dracs@programming.dev
      link
      fedilink
      English
      517 days ago

      I don’t think WebAuthn protects against cookie theft. WebAuthn better protects the login process. But if the result of the login process is still a session/auth cookie, that can be stolen like any other cookie.