37
VoidAuth Release v1.1.0 - Passkey-only Users πŸ”‘ (github.com)
submitted 1 year ago by to c/selfhosted@lemmy.world
2 comments fedilink hide all child comments
 

VoidAuth is a self-hosted Single Sign-On solution that aims to be easy to setup and use while feeling seamless to your users. Release v1.1.0 brings a few new features I have been working on and am excited about:

  • Passkey-only Users, the option on sign-up to use a passkey instead of a password.
  • Admin Notification Emails, so admins know when they have new tasks such as user registrations to approve.
  • Approval Emails for New Users, so new users awaiting approval know when they have been.
  • DEFAULT_REDIRECT back to your main page for invitations, logouts, etc.
  • and more!

all 2 comments

sorted by: hot top controversial new old
[–] 12 points 1 year ago

It’s good to see an auth library with built-in OIDC server. Thanks for the post I’ll check.

  • permalink
  • fedilink
  • source
    •
    [–] 2 points 1 year ago

    I have been meaning to spin this up but life keeps getting in the way. I'll have to try this weekend.

  • permalink
  • fedilink
  • source
    •
    9 comments in c/opensource@lemmy.ml view that post
    [–] 9 points 1 year ago (8 children)

    Sorry for being silly here, I've been kind of out of the loop with recent technology, what exactly is "passkeys"? I remember reading something when it was announcement, but all I saw was lots of buzzwords and vague "it's new and it's very good" claims.

    Is it like, an alternative authorization method? Is it a second factor after I type my login/password, or does it replace passwords? What does it look like, from users perspective?

  • permalink
  • fedilink
  • source
  • hideshow 8 child comments
    •
  • [–] 7 points 1 year ago (6 children)

    I replaces passwords with a cryptographic key. When you register at a website, you do not put in a password, instead it generates a key-pair, kinda like you would have with ssh auth. Usually to login you use biometrics, which will unlock the keys on your device. Advantage is that they are phishing resistant (the keys are bound to a specific domain), convenient and if the database of the website is leaked, it doesnt matter since they can only store your public key, which is worthless for authentication.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 8 points 1 year ago (1 child)

    So pretty much same as ssh/gpg private/public keys? Do many websites support this? I don't remember seeing any that would give me an option to register using passkeys. Also, where are the private keys stored? How do I move them from device to device (for example, I signed up on android and now want to log in on desktop)? Do I back them up and restore when I'm buying a new phone?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 8 points 1 year ago*

    A lot of the bigger players like Microsoft, Google and Apple support it. For small sites its a lot rarer. The keys are stored on device, but can be synced in a variety of ways, often using the cloud. There is problems with vendor lock in vecause of that, even though passkeys are an open standard by themselves. Generally nothing is stopping you from copying/synching them yourself.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 1 year ago (3 children)

    But passkeys so often call for your Windows login (for those on Windows); doesn't that only give more power to Microsoft?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 6 points 1 year ago (1 child)

    Absolutely. But passkeys themselves are an open standard, so the implementation is different depending on device, browser etc. I dont use Windows, I dont know how it works there. I dont even use passkeys a lot in general, mostly due to it not being used on that many sites. I still think the technology pretty interesting and will be more relevant in a few years.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 year ago

    I think "identities" used on Gemini (at least the way they are implemented in Lagrange browser) are the best implementation of a similar idea, but, you know, it's only supported in Gemini.

  • permalink
  • fedilink
  • source
  • parent
  • [–] [S] 3 points 1 year ago

    Pretty much as answered already, passkeys (sometimes branded like FaceID or Windows Hello but it is an open spec) are an alternative to passwords. Your public key that identifies your user is stored in VoidAuth and your private key is stored on your device. Some password managers support syncing passkeys, so you don’t have to set up a new passkey on every device.

    The advantage over passwords is that they are domain and device specific, so are much harder to be leaked from the client side. VoidAuth (or other services) should only be storing your public key so a leak on the server side would not allow someone to log in as you.

  • permalink
  • fedilink
  • source
  • parent