XF 2.3 Passwordless logins with passkeys

First thing's first, don't panic, don't rush to your customer area, there is no Beta 3 release today! We are likely to be moving the remaining HYS posts to Thursday/Friday, coinciding with those features rolling out to this very forum so we get some extended testing and feedback before they appear in a subsequent Beta.

Next order of business, before we get into what's coming in Beta 3, is a big thank you to Shawn, AKA @digitalpoint. We're big fans of Shawn's work and he's genuinely a stand up guy, always very willing to help out. Shawn was kindly willing to give us his Security & Passkeys add-on and this gave us the leg up we needed to introduce this feature at rather short notice. It has morphed slightly, and does not entirely replace the add-on so I suspect it will live on in some form and I'm sure Shawn will communicate that in due course.

So, with all that being said, let's take a look at passkeys support in XenForo 2.3!

What is a passkey?​

Passkeys are a secure replacement for passwords and/or second factor authentication. They take many forms ranging from physical devices (e.g. Yubikeys) to biometric authentication built in to your phone or computer. Some types of passkeys can even be synced across all of your devices, for example I can setup a passkey using my fingerprint on my MacBook Pro which is then synchronised with my iPhone and authenticated using FaceID. Or you may have a password manager such as Bitwarden or Proton Pass which synchronise your passkeys across different browsers and devices.

They are extremely secure, extremely easy to set up and extremely easy to use.

Adding a passkey in XF 2.3​

Passkeys can be managed for your account under Account > Password and security. To kick the process off you simply click "Add passkey" which, in supported browsers, will invoke some sort of interface, usually served by your browser, device, or password manager.

Let's look at the process in more detail via an iPhone:



It's that easy! From that point forward, not only will you be able to use your passkey for logging in, it also enables any of your current or future passkeys to be used as two-factor authentication.

Passwordless login​


It's just as easy using a passkey as it is to add one. Let's take a look at the login flow with the passkey I just created:




No need to enter your password. No need to even enter your username! Just tap "Log in using: Passkey" and follow your device's prompts and you'll be logged in!

We've just rolled this out here so have a play around and let us know your thoughts!
 
OMG I love it!

Yes Yes Yes GIF
 
HUGE, HUGE reason to upgrade to XF2.3 here alone.

I am using authenticator at the mo and it will be fantastic when that integration on mobile happens
 
Doesn't seem to work with Android 14 (Pixel 8) fully. I use Proton Pass and it didn't give me an option to add to Proton Pass, but other sites like Google allow it.

Is that a bug that can be fixed?
 
Definitely glad to have it be native. There were a couple internally kludgey things I needed to do with the addon to make it work for two-step auth (specifically allowing multiple authentication options [multiple passkeys] for a single two-step method).

And I didn’t want to tackle what would have been a substantial change in XenForo’s registration/authentication flow to allow true passwordless authentication.

So yay!

Dance Dancing GIF by Sesame Street
 
Doesn't seem to work with Android 14 (Pixel 8) fully. I use Proton Pass and it didn't give me an option to add to Proton Pass, but other sites like Google allow it.

Is that a bug that can be fixed?
@Slavik is using Proton Pass and Android and while he ran into an issue initially, after refreshing the page it works fine. He is just testing another device.

Are you able to try again and document the steps or even screen record them?
 
@Slavik is using Proton Pass and Android and while he ran into an issue initially, after refreshing the page it works fine. He is just testing another device.

Are you able to try again and document the steps or even screen record them?
Tried both Chrome and Edge, both only give these options here in this site:

Screenshot_20240329-141637.webp


I usually create them with Proton on PC, but it's not showing Proton as an option for any of those 4 choices.
 
Doesn't seem to work with Android 14 (Pixel 8) fully. I use Proton Pass and it didn't give me an option to add to Proton Pass, but other sites like Google allow it.

Is that a bug that can be fixed?

I have confirmed this, I have reported it to proton as I think its a chrome integration issue.
 
I have confirmed this, I have reported it to proton as I think its a chrome integration issue.
Alrighty, hopefully proton can fix it before 2.3 releases.

Another addon I can remove from my site once 2.3 is out!

No more passkey addon, image optimizer add-on, and another I can't remember off top of head ATM.
 
Top Bottom