Re: [webauthn] Add support for SRP (or some other PAKE) in WebAuthn (#1960)

The security issues around passwords are not resolved by things like PAKE. You are assuming the threat is MITM or theft of the stored pw hashes.

The real threat is phishing, social engineering, and bruteforce. This suggestion does nothing to address any of the real threats against passwords.

I think there is no interest to add or support PAKE in Webauthn since this would be a huge departure from the current definition of the specification. 

-- 
GitHub Notification of comment by Firstyear
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1960#issuecomment-1712275785 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Friday, 8 September 2023 22:06:35 UTC