Clarification on Webauthn Two-factor authentication and HTTPs certificate

[pfoo]

hi,

Both official documentation and PBS webui state that webauthn TFA requires a trusted HTTPS certificate

I was however able to configure my Yubikey Neo as webauthn device in my PBS using default self-signed HTTPS certificate, and it seems to be working flawlessly with both firefox and chrome. The certificate is of course added as an exception (at least for firefox), but this is mandatory to access PBS anyway so ..

Am I missing something ? Might it stop working at some point ?

 

[t.lamprecht]

Hi!

To be honest, this warning comes originally from Proxmox VE when we added U2F support in 2019.
U2F is a predecessor of WebAuthn, and while quite some things are similar, details often aren't.

It seems that with WebAuthn the browser only warns, so yeah, if it works now chances are that it stays working, having a backup second factor (e.g., recovery keys) is always a good idea, though.

 

[pfoo]

That's a great news !
I was wondering why yubico-OTP was not implemented in PBS, but webauthn is by far a better alternative