Where communities thrive

Join over 1.5M+ people
Join over 100K+ communities
Free without limits
Create your own community

Explore more communities

cedarcode/webauthn-ruby

People

Repo info

Activity

Gonzalo

@grzuy

Great! Seeya.

Bart de Water

@bdewater

here's our payment request experiment blog: https://engineering.shopify.com/blogs/engineering/shaping-the-future-of-payments-in-the-browser

Braulio Martinez

@brauliomartinezlm

Thank for sharing :+1:

Gonzalo

@grzuy

Heads up: Planning to release 2.0.0.beta1

Finally: https://rubygems.org/gems/webauthn/versions/2.0.0.beta1 :-) :-)

Bart de Water

@bdewater

nice!

you guys are lucky... you almost became a Microsoft font 😂https://devblogs.microsoft.com/commandline/wp-content/uploads/sites/33/2019/09/cascadia-code-twitter-poll.png

https://devblogs.microsoft.com/commandline/cascadia-code/

Bart de Water

@bdewater

managed to get some docs written on the flight to/from SF. some is not implemented yet (the fallbacks as discussed during our call), letme know what you think :) https://github.com/cedarcode/webauthn-ruby/pull/208/commits/7defc20bd7a7896e9755f800ccdd86b9447435f5

Braulio Martinez

@brauliomartinezlm

@bdewater dear lord, that would have destroyed our SEO scores :joy:

Braulio Martinez

@brauliomartinezlm

thank you for the work on the docs, will take a look shortly :thumbsup:

Gonzalo

@grzuy

you guys are lucky... you almost became a Microsoft font 😂https://devblogs.microsoft.com/commandline/wp-content/uploads/sites/33/2019/09/cascadia-code-twitter-poll.png
https://devblogs.microsoft.com/commandline/cascadia-code/

Wow! That was close :-)

Bart de Water

@bdewater

are you guys subscribed to the W3C Webauthn repo on github? interesting stuff posted the other day: https://github.com/w3c/webauthn/issues/931#issuecomment-533493246

Gonzalo

@grzuy

Very interesting!

Thanks for sharing, I am only subscribed to specific issues in the W3C WebAuthn repo, no to the whole repo.

Braulio Martinez

@brauliomartinezlm

Good stuff Bart, thanks for sharing :+1:

I’ll stay tuned on the issue as well

Bart de Water

@bdewater

Going on vacation soon, will pick up the MDS stuff once I'm back :)

Braulio Martinez

@brauliomartinezlm

Hey @bdewater ! I’m heading to SF today for TechCrunch Disrupt and visiting clients for 2 weeks, so I’ll be a bit laggy on reviews. I have planned to review the docs commit you pushed during planes/airport waits. Enjoy vacations!

Bart de Water

@bdewater

Have a good trip!

Braulio Martinez

@brauliomartinezlm

Thanks!

Gonzalo

@grzuy

Going on vacation soon, will pick up the MDS stuff once I'm back :)

Enjoy!!

Bart de Water

@bdewater

hm, trying to create a PR in the Rails demo app but the memory or filesystem cache store do not like certain types of objects (getting TypeError (no _dump_data is defined for class OpenSSL::X509::Certificate)) :/

thinking I need to cache the JSON instead

Bart de Water

@bdewater

if I use the TestCacheStore it works though :)

Bart de Water

@bdewater

ruby/openssl#281 :)

Gonzalo

@grzuy

Hi Bart,

What is that you were trying to do in the Demo app?

Bart de Water

@bdewater

Showing how to implement my metadata PR

Gonzalo

@grzuy

Showing how to implement my metadata PR

Great!

Bart de Water

@bdewater

pushed some stuff up. needs some more testing and polishing but the complete idea should be pretty clear at this point. LMK what you think :D

Braulio Martinez

@brauliomartinezlm

@bdewater wanted to share with you that we're going to be giving a talk about WebAuthn in NYC.rb on Nov 13th and a shorter version of it in Boston Ruby meetup on Nov 12th :rocket:

I know you're not close from there but wanted to let you know just in case you happen to be around at that time of the year or if you anyone you know might be interested in the topic and would like to hear about it :smile:

We're right now against the clock with Gonzalo trying to get our slides done haha

Bart de Water

@bdewater

that's awesome! :raised_hands:

Bart de Water

@bdewater

I'm not around unfortunately, and 5-6 hours is a bit far to drive for a regular weekday haha. Best of luck with the slides! I'll make sure to tell our NY-based folks.

I'm planning a WebAuthn talk for Ottawa.rb in January myself :grin:

Braulio Martinez

@brauliomartinezlm

Yeah, it’s a long ride. Thank you and thank you for spreading the word.
Oh great to hear you plan to speak there! :rocket:

Gonzalo

@grzuy

I'm not around unfortunately, and 5-6 hours is a bit far to drive for a regular weekday haha. Best of luck with the slides! I'll make sure to tell our NY-based folks.
I'm planning a WebAuthn talk for Ottawa.rb in January myself :grin:

Awesome! :clap:

Gonzalo

@grzuy

Hi @bdewater , we've been working lately with @padulafacundo on Attestation support and he wasn't able to find any of the Yubico keys listed as authenticators on the FIDO metadata service? Did you experienced the same when you were playing with that?

Bart de Water

@bdewater

Hi @grzuy that's correct - we've been in touch Yubico about a couple of things and among others they recommended we require attestation during our registration flow. I've asked them why since they don't publish to the FIDO MDS, to my knowledge to don't even self-publish metadata. Best I could find was https://developers.yubico.com/U2F/Attestation_and_Metadata/ for U2F. Long story short, as long as we employ WebAuthn for 2FA only we don't see the added value at Shopify, but for a potential usernameless & passwordless flow we see the potential for metadata to safeguard users from compromised authenticators similar to HaveIBeenPwned for passwords. I haven't heard back from them yet, but at the moment the MDS does not feels not very useful.

SoloKeys self publishes over at https://github.com/solokeys/solo/tree/master/metadata - according to solokeys/solo#89 publishing on the MDS was too expensive for them, but that can't be a problem for Yubico

for https://github.com/cedarcode/webauthn-ruby/pull/208#issuecomment-551920674 btw, might be best if you rebase that branch and amend the commit that introduced the zipfile to remove it, so it doesn't end up in master's git history. better safe than sorry and all that :)

Bart de Water

@bdewater

I just head WebAuthn works for us in the newest iOS beta if you toggle the feature flag on :)

Braulio Martinez

@brauliomartinezlm

:scream: great news!

I'll have to change my slides for tonight :P

Bart de Water

@bdewater

haha! good luck :D

also finished extracting the metadata client: https://github.com/bdewater/fido_metadata

Braulio Martinez

@brauliomartinezlm

also finished extracting the metadata client: https://github.com/bdewater/fido_metadata

This is awesome :rocket: !!!!

Bart de Water

@bdewater

https://developer.apple.com/documentation/ios_ipados_release_notes/ios_ipados_13_3_beta_2_release_notes is the changelog btw

how did the presentation go? :)

Braulio Martinez

@brauliomartinezlm

It was awesome, both in Boston yesterday and today in NY. People get really amazed and curious about it, ask good questions, come to us after the talk to know more. Truly a great experience for us. I'll send you our slides in an email for you to give us feedback if you want :). Feel free of course to take idea or use things if you got for it in Ottawa.rb

https://developer.apple.com/documentation/ios_ipados_release_notes/ios_ipados_13_3_beta_2_release_notes is the changelog btw

Nice, we were actually talking about that yesterday with Gonzalo :muscle: I think he saw it on Twitter yesterday

Gonzalo

@grzuy

https://developer.apple.com/documentation/ios_ipados_release_notes/ios_ipados_13_3_beta_2_release_notes is the changelog btw

This is awesome!

also finished extracting the metadata client: https://github.com/bdewater/fido_metadata

Thank you, nice work!

Chat via Matrix