[DigitalPoint] Security & Passkeys 1.1.7

• Entropy for challenge changed from 192-bits to 768-bits
• All JavaScript has been rewritten to be "native" (does not use jQuery) in preparation for removal of jQuery in XenForo 2.3.

If you aren't using XenForo 2.3, you don't need to upgrade (might be some unmeasurable speed increase [think nanoseconds] when running its JavaScript since it doesn't dip into jQuery any longer).

I think this may have been the cause for a couple cases where an invalid Passkey record was saved to a user account. Previously, if an exception happened, it blindly accepted the null Passkey record as the new Passkey. If things went as expected (most cases) it wouldn't matter, but not everything always goes as expected.

• Added dataList-row--noHover class so background color doesn't change when the mouse moves over the table of two-step options a user has
• If an exception happens when Passkey is added to user account, present the user with an error that the Passkey could not be registered and log the underlying exception message to the XenForo error log (and most importantly, don't save an invalid Passkey registration as a new Passkey)

Added additional sanity check to ensure the device trust record is valid and exists before trying to extend it.

• Check for incomplete records when deleting a key
• New advanced option: Days to auto-extend two-step device trust (especially useful for forthcoming iOS PWA, see this thread)
• Reformat list of two-step options to use icons for enable/disable/manage actions instead of XenForo's default buttons with text (see screenshot below)

This:

...becomes this:

Fixes an issue where certain (most) security keys couldn't properly authenticate as a two-step verification option.

• Added ability to view and delete remembered sessions in admin area (new Sessions tab when editing a user)
• Fix for PHP warning when on PHP 8 and accessing site through localhost (a test setup)

Give the user a better error message if they try to create a Passkey entry without actually registering a Passkey.

• Checking for PHP version 7.1.0 or higher
• Removed dependency on third-party library to get list of countries for sessions and trusted devices

This doesn't change anything for users that already have it installed. The net change is now you can use it with PHP 7.1+ (the previous requirements were PHP 7.3+).

• If user has no Passkeys setup yet, the button to manage them is labeled 'Enable' rather than 'Manage'
• Use a more specific selector when enabling/disabling the Submit button on the WebAuthn form
• New option: Options -> User options -> Recommended strong two-step options (defaults to 2)
• The user's two-step page will show a notice about not having enough strong two-step options if they have less than the number set under options (a reminder to users that they should have more than one good two-step options in case they lose access to one)

If a user doesn't have the minimum recommended strong two-step options setup on their account, their two-step page will have a notice at the top like so:

You can set what you want that minimum to be under user options:

This is purely a semantic update that renames security key to Passkey for user-facing verbiage.

Passkey is the new term that's going to be used by Apple, Google and Microsoft going forward for what used to be known as security keys or WebAuthn/FIDO2.

The term is also being adopted by Yubikey for their hardware keys.

Yubikey said:

But passkeys aren’t a new thing. It’s just a new name starting to be used for WebAuthn/FIDO2 credentials that enable fully passwordless experiences. These types of credentials are also called discoverable credentials, or sometimes resident credentials.

We like the new term and will use it, because it helps people understand they’re a password replacement with a simple term. “Passkey” is much more understandable by most people than “discoverable WebAuthn/FIDO credential.”

...

Passkey is a term that the industry is rallying around for FIDO credentials that can fully replace, rather than only augment, passwords. These are called resident or discoverable credentials in the specs. We think “passkey” is a better term than “discoverable webauthn/fido credential,” because it evokes its ability to replace passwords in an accessible way.

Passkeys in YubiKeys have been supported since discoverable credentials were added in the WebAuthn/FIDO standards around 2018. However, it’s important to note that passkeys in YubiKeys are not copyable, meaning the passkey is bound to the YubiKey.

Click to expand...

See: https://www.yubico.com/blog/a-yubico-faq-about-passkeys/