I'm here to talk about a secure and inclusive alternative for multi-factor authentication.
It's called WeboutN.
But first, maybe a little bit more about me.
I'm Stormack.
My pronouns are here in aim.
I help from the Netherlands.
In my day job, I'm an independent contractor and I build websites with spectral CMS in
Django.
And I do that since 2019.
I love open source.
I'm a member of the Black and CMS Core Team.
Most people here, I'm organized from the room are as well.
I'm also an admin for the Django Comments Initiative, which is some initiative to help
facilitate maintenance of packages that extend Django in some way.
And I also create open source of my own search as Django OTP WeboutN more about that later.
So quickly, briefly, what I'm going to talk about, a multi-factor authentication-wise
importance, security first, usability trade-offs, come to introduce WeboutN and then how
can you use it yourself.
So first, let's take a step back.
Passwords.
We all know passwords, but they have some shortcomings.
They're not enough.
For one, they are hard to remember.
That's why people choose welcome 1, 2, 3, exclamation mark as their passwords.
They're preyed on by fishing attacks.
So criminals, they try to convince your user to enter their password to your surface
on their fishing websites and yeah, then you have a problem.
And one other thing, when it password is that they are commonly reused across websites.
So a user has used the same password on multiple websites.
If they're password leaks, then certainly criminals can try to use this password on your
surface as well.
See, hey, maybe I can log in here.
Yes, password managers exist.
They do solve a lot of problems, but not everyone use them or knows how to use them.
And with multi-factor authentication, we are trying to add another layer of security.
So typically, that's something you know, like a password, something you have, like a phone
or security key, or your access to your email account to receive the email there, or sometimes
something you are like biometrics.
Now, as this effort happened to you, you are waiting for an email to arrive with a code
to log in.
And another writing, raise your hand, has this habit to you?
I see a lot of hands.
You need an SMS code, raise your phone as no reception.
True story.
Or even worse, you switched phone numbers, and now you can't log in, because you didn't update
your number at all, so I'm sure you'll never use.
An eye, right?
It's inconvenience to wait for something to arrive, or to take out your phone, to approve
a log in.
But we all do this in the name of security, right?
OK, it's inconvenient, but we solved security problem, right?
Sort of.
We made it a bit harder for an attacker, but pushing is still a thing.
You can still enter an SMS code you receive, or convince someone that receives an
SMS code to enter it on your fishing website.
It's just a little bit more difficult.
Also, it's not very intuitive for everyone to use.
OK, so I'm trying to look in here, but now I have to do something with my phone.
And what this creates friction to your surface for your users.
And I don't think that's very inclusive.
Not everyone is like well aware of how this work and why
a multi-factor authentication is important.
So it isn't there a better way to do this.
There is.
Otherwise, there wouldn't be standing here, if I didn't leave it to us a better way.
Many of you have heard of it already, in the name Palskis.
But the more official standard behind this is called WeboutN, or short-for-web authentication.
It's a standard for secure Palsworthless authentication.
It's based on a public key cryptography.
So there are no shared secrets like with a Palskworth.
Most media browsers support it.
It's around since 2020 or so in the form I'm describing here, but still relatively
a known I think.
But it's gain in traction.
Mostly due to Apple, they made a big thing out of this with the launch of their iOS 16 operating
system.
Now what I think is really great about this API is that the prompts to log in or to create
an credential are very predictable.
They are native.
This is the prompt from Safari on MacOS and it's asking me, hey, do I want to use my fingerprint
to sign in under my account storm hack at GitHub.
And I think this is the future of authentication.
So quick overview of how this works because maybe it's all magic to you now.
When we want to register a new Palskis, a new credential, we ask the browser to do this.
So this is about API, navigate.quadentures.create.
And we ask the browser, hey, please create a public private key pair.
The private key is stored securely on your device of the user.
And the public key is sent off to your server with a reference, a new server, you store
this public key with a reference to which user is this bit like an SH key maybe.
And this public private key pair is informally called a Palskis, roughly definition of
Palskis.
I find it a bit fake, but I think it refers to the public private key pair or more generally
this whole mechanism of authentication.
Now when I use it once to log in, we again, we ask the browser like, hey, sign a challenge
with the private key that's stored on your device.
So this, when we call this API, navigate.create.create.get in the browser, browser prompts
to use it like, hey, this side is asking you to log in.
I have these key stores available, which account do you want to use.
The browser then signs a challenge, we sense.
And with that sign challenge, we can verify the signature is correct with the public key.
We have, okay, this signature was created with the private key that belongs to this
public key.
You must be in possession of the private key and so you must be who you say you are.
And if that's the case, well, then we can lock you in because we know which user is associated
with that public key and no password is necessary.
That's immediately the first benefit.
There's nothing to remember, no shared secrets, another thing is there is a new key pair
for every site.
So it's not possible to reuse like with a password.
Every key pair is unique.
So it does not matter if that side has a database, then yeah, that does not affect any of
the other sites that you might be using, a passkeys with.
Another benefit is that you can register separate passkeys from multiple devices.
So you have to use the same password all the time or with your account because you can't
have multiple passports for your account.
With the passkeys, you can register multiple passkeys to your account.
So if I register a passkey on my phone, I can use that to lock in or on my laptop, I can
use that to lock in.
I think that's a benefit as well.
So if I lose one device, I have a passkey stored on another.
There also a fishing assistant, the only work on the site they were registered on because
the browser says, well, I don't know Google.com.
Whatever type of squatting a fishing site did, it just does match the site, I have a passkey
stored for so you have no passkeys, you can use here.
Passkeys, you can also see them as being multifaceted because the passkey, the private
key is something you have and still protect it by metrics, something you are or your
device, pin or password, something you know.
So your device that is stored to the passkey, typically ask you like, hey, you need to
confirm who you are, before I will actually assign this challenge.
That's what you saw on the previous slide, it asked for my fingerprints, but can also
be the pin of your device or your password of your laptop and that's something we get
to see as a server, it's just necessary for the browser to unlock and assign this challenge.
That's an additional factor, so yeah.
I'd say there's also a couple of drawbacks or maybe things that passkeys don't solve,
not technically, she's perfect.
Yeah, losing your passkey is still a risk, I mean if you passkey register on my laptop,
my laptop breaks and my phone is stolen and yeah, my my my passkeys are gone.
The solution to this could be a cloud sink, but that could also be a risk because, for
example, Apple, it stores all your passkeys on the iCloud key chain, so your Apple
accounts or whatever big tech accounts you're using to sink these passkeys with, then
I was seeing a point of failure, but so what's your password manager already, so I don't
think we are taking a step back in that regard, quick side notes, most password managers
can also do wrap out and so you can use your password manager instead of your Apple account
or whatever, I think that's a pretty cool feature.
So what do you need to implement web authentication on your platform website?
Well, I'd say it's quite involves, I made a quick rough overview, I'll have a overview
checklist on the server side, well you need API and points for the registration and
authentication ceremonies because it's not just one API call you need to make your
server it's always to want to start and want to complete the process, so you can
integrate those API endpoints, you need some database mechanism or something to store
the public key if the pass key, you need to verify the signature of the passkeys, so there's
some cryptography involved on the client side, well we need to communicate with your
server, make the appropriate browser API calls and handle any exceptions that may arise,
but it can happen, no passkeys are available, maybe there's a configuration error, a lot
of things can happen and well ideally you should show some sort of actionable feedback to
the user, web authentication also has some additional features like a pass key out of
a file and to use this you need to call the browser API slightly differently, without
a file I mean when you land on a login page or for websites then sometimes your browser
shows you like an out of a file request like your password manager might do and this is also
like triggered by that website like hey if this this has passkeys show a prompt now
and also on your website well you need an area to manage the passkeys, okay I have these
passkeys registered to my user account, you need some interface on your site to manage
this and general you need to spend quite some effort to make it a smooth experience.
Well I took a look at the open source options there are to make this a bit easier, I know
not everyone here is using Django so I included some other frameworks here as well don't
know anything about them first results on Google don't trust me, yeah let's lots of libraries
that make this easier for you to implement quick shout out to myself I'm the offer of Django
OTP WebRFN which is a library I created to integrate WebRFN with a second factor authentication
because I'm not quite ready to go full passwordless for all my clients and websites but it would
be nice that if I have to implement no defect of authentication I can do it with like offering
a print scan yeah this is it thank you and any questions yeah so the issue that I'm
seeing currently with passkeys is that as server or as application people we cannot enforce
second factor and because usually it's done on the device yes anything like security
levels that I can raise so it needs to have second factor on the game yes that this is something
I didn't include in my presentation for BFT but there's like a lot of mobs in the API you
can tweak like hey this device needs to be capable of user verification that's what WebRFN calls
it there must be some the authenticated device that stores the passkeys needs to have some
mechanism to verify the identity of the user using it but yeah you're right we're trusting
the interesting this device with this responsibility to do so there's also a more enterprise
way of enforcing this that I don't think I would recommend but passkeys they also have
something called at a station where you can verify that the device that created this passkeys
of like a certain make so it's for example it's the Apple implementation of passkeys because
we know Apple implement this well I'm naming Apple as an example yeah you can enforce this
but I wouldn't do so because it's quite a lot of work and the landscape changes all the
times so you need to keep up or rush your risk cutting people out and that's nothing
inclusive so I get that when you register an account you also create the first passkeys and
the Apple slogan is a whole time to let device but how do you see the next device you want to
change it's about into that well yeah technically you could you could implement it in a way
without passkeys at all I currently the way I'm doing it and complimenting passkeys
passkeys are still a thing for my websites but yeah I can see we're going full pass with
in the future one way back off and dust this and there's not something I show you either because
I only have 20 minutes but when you're logging in or you're seeing this prompt to log in you can
also choose to use a passkeys from a different device what happens is your computer you're
logging into will display a QR code and if I have a passkeys stored on my phone for example
I can scan that QR code and then this device and my phone will connect and
like your request to sign a challenge is pass on to my phone and my phone sends the sign
challenge spec to the computer so that's one way you could log in with that authentication
like on a public computer for example and it's pretty cool because that public computer never gets
to see your private key yeah exactly well
when I take a look at large vendors they usually forcing us into their app ecosystem right
and you still have lock-ins and services is there any app like implementation for
for passkeys so I can sign in with my passkeys by earlier well like I said pass with managers
pass pass managers they can do a passkeys authentication because they intercept the
the API calls to the browser to inject their own implementation yeah I think they are like
then 20 implementation out there already to either through pass managers or other
systems yeah you're not you're not locked into like the Apple way if doing it or the Google way
of doing it you can store your passkeys in a pass manager as well yeah I was I was rather thinking
instead of using a browser to lock it into Apple.com I want to do it with my settings app on my
iPhone then how do I do the login right because usually anything that you've said is like browser
well I assume the settings app would have to implement something similar to the browser
to make this work but that's not my area of expertise sorry
yeah as when I see applications that I don't have a one-of-reindance
the way because I'm not an expert I just want to reuse something that's not there
and you show that's three different channel recommendations on your list so should we wait
to have a bomb or stay home and there's one go to wait and do it for your system or is it like
okay it's security now for you know risks are low enough that's good right now
well my version is still like in alpha so I wouldn't recommend you go to production
maybe maybe later like the while long ago to foster in twenty twenty six
okay one more question and I think we're done
I'd like to ask you a question before about this another device what happens if I have
only one device I lose control of it I get stolen and that's the only way I add
or three three my private properties yeah that's like one of the drawbacks I mentioned
I assume there would be some recovery mechanism like we have like forget your path now
it would be forgot or lost your passkeys so I think it would involve like sending some sort of
recovery link to your mailbox maybe there is still another contact information for the user
well yeah it's it's up to the implemented to like have a recovery mechanism
thanks for a few more questions if you have a three more minutes on the top
no you mentioned you would recommend that the station is that you mentioned what I mean
the problem was the implementation time basically I'm keeping up with the
case of things that are open so it's not a technical comment like we should go without
the station just make sure you have enough time to keep up with everything that happens to be
well I I say because for example right now there's one at the station met at the
developed by Google but they've already deprecated it and it's going away so that's that's
what I what I mean don't use at the station unless you want to keep on top of what the
implement of at the station are doing I like five different at the station formats that you would
want to support because if you're asking for at the station it can only go in the way it can only
and I've dedicated to can only do it in the way it's implemented to so if only supports the
Apple way of stepping out at the stations then you need to do it Apple way or yeah
that's not something I would like a minute
and the best of you just think you wouldn't you wouldn't recommend doing it yourself but what about
that using a service like private people for authentication? Well if that means that you do all the
responsibilities of keeping up to date with at-stage from you you leave that up to another party
then yeah sure but if you're all doing it yourself you have your own implementation of Apple
and no don't please so one more hand is raised running more are there any public sector
websites like go UK or things like that using baskets? Well I can't speak for coffee UK I know the
Dutch government do not use a ball ski shed but I know that's for example on your WhatsApp
now supports logging in with ball skis with data you can log in with ball skis Amazon
Amazon even like offers you like if you're checking out at a product and you don't have a
ball ski yet it says like hey do you want to create a ball ski for easy checkout next time
so public sectors maybe maybe not so much yet but a lot of other organizations they do already