blog

webauthn-vs-interoperability.xml (2331B)

<!--
Copyright © 2014 Haelwenn (lanodan) Monnier
SPDX-License-Identifier: LAL-1.3
-->
<entry>
<title>WebAuthn vs. Interoperability</title>
<link rel="alternate" type="text/html" href="https://hacktivis.me/articles/webauthn-vs-interoperability"/>
<id>https://hacktivis.me/articles/webauthn-vs-interoperability</id>
<published>2025-10-29T16:43:16Z</published>
<updated>2025-10-29T16:43:16Z</updated>
<link rel="external replies" type="application/activity+json" href="https://queer.hacktivis.me/objects/ad12e048-a5a2-435f-85fa-100e7481b547" />
<link rel="external replies" type="text/html" href="https://queer.hacktivis.me/objects/ad12e048-a5a2-435f-85fa-100e7481b547" />
<content type="xhtml">
<div xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" class="h-entry">
<p>
	WebAuthn, also marketed as passkeys for a subset of it, is something
	that seems rather scary to me from an interoperability perspective.
</p>
<p>
	Not only it's a lock-in in terms of authenticators, it's also a lock-in to Chrome/Firefox/Safari.<br />
	Wanted to use an alternative browser?  Nope.<br />
	And you can probably forget using it on embedded devices outside of Android/iOS.<br />
	Wanted to authenticate to a service on your e-reader?  Nope.
</p>
<p>
	But there's also the issue of authenticating from non-browsers
	such as native applications, granted a lot of them use OAuth tokens
	or similar but there's a sort of bootstrapping problem in systems
	where you don't have a full-blown mainstream browser.<br />
	(And good luck copying the OAuth token from one device to another)
</p>
<p>
	And the design of WebAuthn means you can't copy
	the generated token into a text field, unlike
	<a href="https://en.wikipedia.org/wiki/Time-based_one-time_password">TOTP</a>
	(sometimes branded as things like Google Authenticator)
	which has none of those issues while still allowing to use hardware tokens.
</p>
<p>
	You could argue on usability, WebAuthn is likely friendlier
	to most when you follow the intended path thanks to browser-integration.
	But not due to the underlying WebAuthn properties which instead
	causes problems, and ones that you're likely to discover the hard way:
	Getting the authenticators you use revoked;
	Not being able to authenticate on some devices;
	Backups being harder;
	…
</p>
</div>
</content>
</entry>