WebAuthn: Difference between revisions
m renamed references |
|||
| Line 19: | Line 19: | ||
==Criticism== | ==Criticism== | ||
In August 2018, a team of researchers from Paragon Initiative Enterprises did a security audit of the upcoming WebAuthn standard. While they could not find | In August 2018, a team of researchers from Paragon Initiative Enterprises did a security audit of the upcoming WebAuthn standard. While they could not find any specific exploits, they revealed some serious weaknesses in the way the underlying cryptography is used and mandated by the standard.<ref name="paragon-blog">{{cite web|url=https://paragonie.com/blog/2018/08/security-concerns-surrounding-webauthn-don-t-implement-ecdaa-yet|title=Security Concerns Surrounding WebAuthn: Don't Implement ECDAA (Yet)|publisher=Paragon Initiative Enterprises Blog|date=2018-08-23|accessdate=2018-10-09}}</ref> | ||
The main points of criticism evolve around two potential issues that were problematic in other cryptographic systems in the past and therefore should be avoided in order to not fall victim to the same class of attacks: | The main points of criticism evolve around two potential issues that were problematic in other cryptographic systems in the past and therefore should be avoided in order to not fall victim to the same class of attacks: | ||