Did you know TWiT Community (i.e. Discourse) supports PassKeys

[PHolder]

EDIT: It appears that this stopped working for me in Firefox and Chrome after I rebooted to install the latest Patch Tuesday update. So far, it’s unclear to me why it broke or why it was working yesterday and not today, so I can no longer recommend this if you do not have an ACTUAL hardware key

EDIT EDIT: As I noted below, I used the feature successfully with Github, and then it started working right again here. The only thing I can guess is maybe the BitWarden extension has a bug. “Buyer Beware” I guess.

Did you know that, with a little effort, you can setup a PassKey to log in to these forums? I just did it, and it seems likely that you could too. Be warned however, that this flow is not exactly the same as a passwordless login flow that is possible on other sites (for example GitHub.) With this setup, your PassKey will act as a second factor, exactly like a physical key (Yubikey) would have before the release of PassKeys. This is probably still beneficial to you as the userID/password and PassKey are all managed by the password manager (BitWarden.)

I used the latest Firefox, with the BitWarden extension. It’s this extension that interfaces with Firefox to make it think you have the necessary hardware key, but PassKeys are really just software (data and algorithms really) and thus it’s possible to simulate a hardware key. This is possibly less secure than a real hardware key, but really your security relies on your good password and security habits. (i.e. having a strong password for your password manager, BitWarden, and never sharing it with anyone no matter the circumstances.)

If you have the necessary configuration, click your icon/avatar on the top right, then click the “person icon” on the bottom, which will say “Profile” if you hover over it. Then select “Preferences”. On the preferences page, there is a sub toolbar, select “Security” and then on that page you should see options for “Two Factor”. It will possibly prompt you for your password to access them, but once supplied, you should see the option to add a hardware key. If you press the button with the plus sign, it will bring up a dialog where you can enter your name/reminder about the key (I chose “TWiTCommunityPassKey” for example) and then when you press the “Register” key, your browser/extension should take over to finish the job (so make sure you’re logged into your password manager/BitWarden.)

I will include pictures to help demonstrate the flow, but please note that your theme choice may be different than mine (the “default” Vincent theme) and so don’t expect everything to look exactly the same, but it should help make the flow clear.

[big_D]

Very nice, did it with 1Password. Also tried to register a Yubikey as a backup, but 1Password always intercepts the request. Will have to try it with 1Password disabled.

It worked with Safari and Apple Keychain for Passkeys as well.

But the Yubikey doesn’t seem to be supported, or at least on my Mac, Discourse wouldn’t recognise it in Safari or Firefox.

[knewman]

Very cool, appreciate the heads-up! Was able to enroll my Yubikey, Vivaldi browser on Linux.

[PHolder]

Of course, yesterday was Patch Tuesday, and so I rebooted my PC, and now my Firefox is no longer intercepting the requests from Discourse, but Windows is instead, and is demanding I insert my actual hardware key (which obviously isn’t going to work for me.) So I guess I need to issue a WARNING on this procedure, until I can figure why it changed. It broke in Firefox and Chrome both.

EDIT: Okay weird. It still works with Github, and using it there made it start working again here… I’m guessing this technology is still not 100% reliable… or else I’m slowly losing my marbles… or both!

[big_D]

Hmm, just tried to log in again on a different browser. I just get “invalid response” from Discourse, when I select the Passkey. I had to delete it from the browser that was logged in, in order to log in on the new browser…

Looks like there are some teething problems.