I keep meaning to do a deep dive into it, but surely we now have enough hardware based modules (several billion smartphones with secure enclaves and the like, motherboards with secure enclaves and millions of Ubikeys) that we should push to go server and client certificate only?
I could imagine it's simple enough for a small company, even forcing customers to do it if the value proposition is high enough.
Not perfect, but has support from the major browser and OS vendors. I've heard some great numbers from vendors about how this increases account security and user satisfaction (no first hand experience).
I wish. Hardware backed credentials are more secure and easier to use.
The lowest common denominator is passwords. The second lowest common denominator is SMS. Even this low bar excludes some older people, customers on foreign travel, and privacy activists. Another notch up is TOTP. Requiring a TEE capable smartphone would mean losing customers or absorbing the cost of buying Yubikeys (and replacements). So this is typically only done for internal enterprise users.
Certificates are awesome on paper (I’m a big fan of WebAuth for example) but we need some sort of custodianship for less technical users who don’t realize that formatting their laptop means they might not be able to log into their services again
Apple has a tech preview of something they call PassKeys - WebAuthn credentials which are in the same keychain as the system password manager, synchronized between all your devices.
This requires other changes to meet the needs of those who expect and require the behavior of credentials bound to a single device, hence being released in an early access form behind a developer toggle.
Yep. Microsoft lets users upload their drive encryption keys to their Microsoft account. Then the account is pegged to SMS, Microsoft Authenticator, or (best) a FIDO key. The problem is what happens when they lose the key. Falling back to SMS lowers security to social engineering your phone company.
I could imagine it's simple enough for a small company, even forcing customers to do it if the value proposition is high enough.