<story><title>FIDO2 security key company publishes results of internal security audit</title><url>https://blog.doyensec.com/2020/02/19/solokeys-audit.html</url></story><parent_chain></parent_chain><comment><author>StavrosK</author><text>I see a lot of confusion in this thread (warranted, because it&amp;#x27;s a confusing subject), and I want to clarify a few things:&lt;p&gt;U2F is the old standard, it is  only meant be used as a second factor.&lt;p&gt;WebAuthn is the new standard, it has different modes for usage as a second factor, first factor and single factor (usernameless). Only the usernameless mode requires state on the client side.&lt;p&gt;Usernameless strikes me as the holy grail of authentication, where we don&amp;#x27;t need to remember any usernames or passwords (or even have them), but I haven&amp;#x27;t seen any websites that support usernameless authentication, other than demo ones and my own.&lt;p&gt;If you want to see what a usernameless flow looks like, you can visit &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.deadmansswitch.net&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.deadmansswitch.net&amp;#x2F;&lt;/a&gt;. You have to log in with an email link first, and then associate your FIDO2 credential with it. You don&amp;#x27;t need a hardware key, for example on phones you can use your fingerprint reader and it will work fine.&lt;p&gt;The problem with hardware keys, and which is not mentioned anywhere, is that because usernameless requires storage on the key, Yubikeys only support a maximum of 25 sites you can authenticate with.&lt;p&gt;In order to further my goal of some day ditching password managers, I also made a Django library for usernameless logins which you can use today on your Django sites:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;pypi.org&amp;#x2F;project&amp;#x2F;django-webauthin&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;pypi.org&amp;#x2F;project&amp;#x2F;django-webauthin&amp;#x2F;&lt;/a&gt;</text></comment>
<story><title>FIDO2 security key company publishes results of internal security audit</title><url>https://blog.doyensec.com/2020/02/19/solokeys-audit.html</url></story><parent_chain></parent_chain><comment><author>talkingtab</author><text>I am probably wrong, but I think Fido2 keys should be ubiquitous. They provide a hardened solution for some security situations, certainly they could be a good 2nd factor or 3rd, and hopefully they could reduce the password madness we have. Yubico appears focused on the enterprise and high end users resulting in higher prices. Solokeys seems more focused on individual users with lower prices.&lt;p&gt;Disclaimer I have two Yubico keys, and two Solokeys and they all work for me, but I don&amp;#x27;t need the extra functionality of the more expensive Yubico keys.</text></comment>