Usernames exposed by login attempt?

user_1976731 0
Viewed 122

I'm trying to expand my application to support WebAuthn login. So far, I have successfully set up a test application (using this https://github.com/lbuchs/WebAuthn PHP implementation) on my local server.

I think I mostly understood the process now, but I have a security question: When you use WebAuthn as the only authentication factor (which is supposed to be possible), the user only enters his desired username and gives his credentials by a fingerprint or his YubiKey or something. In this diagram (https://developers.yubico.com/WebAuthn/Libraries/Using_a_library.html), it is said that the server returns a list of credentialIds associated with the username. The authenticator then answers the challenge to which it has a private key.

My problem is: If an attacker wants to find out which usernames exist, he could try to provide different usernames and test if the server returns any credentialIds. Isn't this a security issue? Usually an attacker should never gain any information from a failed login attempt.

fido webauthn
1 Answers

It will be made possible by the "Resident Credentials" as soon as the browsers and FIDO2-hardware widely support it, as described in this blog post.

Meanwhile, you could store the user ID in a long-live cookie or in the browser (localStorage API). Preferably you should store opaque identifier because of the risks of leaking. Unfortunately, the data can be flushed out of the browser (user action, browser update...) and are less persistent than Resident Credentials.

user_4058470
Related