35
VoidAuth Release v1.1.0 - Passkey-only Users ๐Ÿ”‘ (github.com)
submitted 1 year ago by to c/opensource@lemmy.ml
9 comments fedilink hide all child comments
 

VoidAuth is a self-hosted Single Sign-On solution that aims to be easy to setup and use while feeling seamless to your users. Release v1.1.0 brings a few new features I have been working on and am excited about:

  • Passkey-only Users, the option on sign-up to use a passkey instead of a password.
  • Admin Notification Emails, so admins know when they have new tasks such as user registrations to approve.
  • Approval Emails for New Users, so new users awaiting approval know when they have been.
  • DEFAULT_REDIRECT back to your main page for invitations, logouts, etc.
  • and more!
you are viewing a single comment's thread
view the rest of the comments
[โ€“] 7 points 1 year ago (6 children)

I replaces passwords with a cryptographic key. When you register at a website, you do not put in a password, instead it generates a key-pair, kinda like you would have with ssh auth. Usually to login you use biometrics, which will unlock the keys on your device. Advantage is that they are phishing resistant (the keys are bound to a specific domain), convenient and if the database of the website is leaked, it doesnt matter since they can only store your public key, which is worthless for authentication.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [โ€“] 8 points 1 year ago (1 child)

    So pretty much same as ssh/gpg private/public keys? Do many websites support this? I don't remember seeing any that would give me an option to register using passkeys. Also, where are the private keys stored? How do I move them from device to device (for example, I signed up on android and now want to log in on desktop)? Do I back them up and restore when I'm buying a new phone?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [โ€“] 8 points 1 year ago*

    A lot of the bigger players like Microsoft, Google and Apple support it. For small sites its a lot rarer. The keys are stored on device, but can be synced in a variety of ways, often using the cloud. There is problems with vendor lock in vecause of that, even though passkeys are an open standard by themselves. Generally nothing is stopping you from copying/synching them yourself.

  • permalink
  • fedilink
  • source
  • parent
  • [โ€“] 2 points 1 year ago (3 children)

    But passkeys so often call for your Windows login (for those on Windows); doesn't that only give more power to Microsoft?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [โ€“] 6 points 1 year ago (1 child)

    Absolutely. But passkeys themselves are an open standard, so the implementation is different depending on device, browser etc. I dont use Windows, I dont know how it works there. I dont even use passkeys a lot in general, mostly due to it not being used on that many sites. I still think the technology pretty interesting and will be more relevant in a few years.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [โ€“] 1 point 1 year ago

    I think "identities" used on Gemini (at least the way they are implemented in Lagrange browser) are the best implementation of a similar idea, but, you know, it's only supported in Gemini.

  • permalink
  • fedilink
  • source
  • parent