XF 2.3 Passwordless logins with passkeys

First thing's first, don't panic, don't rush to your customer area, there is no Beta 3 release today! We are likely to be moving the remaining HYS posts to Thursday/Friday, coinciding with those features rolling out to this very forum so we get some extended testing and feedback before they appear in a subsequent Beta.

Next order of business, before we get into what's coming in Beta 3, is a big thank you to Shawn, AKA @digitalpoint. We're big fans of Shawn's work and he's genuinely a stand up guy, always very willing to help out. Shawn was kindly willing to give us his Security & Passkeys add-on and this gave us the leg up we needed to introduce this feature at rather short notice. It has morphed slightly, and does not entirely replace the add-on so I suspect it will live on in some form and I'm sure Shawn will communicate that in due course.

So, with all that being said, let's take a look at passkeys support in XenForo 2.3!

What is a passkey?​

Passkeys are a secure replacement for passwords and/or second factor authentication. They take many forms ranging from physical devices (e.g. Yubikeys) to biometric authentication built in to your phone or computer. Some types of passkeys can even be synced across all of your devices, for example I can setup a passkey using my fingerprint on my MacBook Pro which is then synchronised with my iPhone and authenticated using FaceID. Or you may have a password manager such as Bitwarden or Proton Pass which synchronise your passkeys across different browsers and devices.

They are extremely secure, extremely easy to set up and extremely easy to use.

Adding a passkey in XF 2.3​

Passkeys can be managed for your account under Account > Password and security. To kick the process off you simply click "Add passkey" which, in supported browsers, will invoke some sort of interface, usually served by your browser, device, or password manager.

Let's look at the process in more detail via an iPhone:



It's that easy! From that point forward, not only will you be able to use your passkey for logging in, it also enables any of your current or future passkeys to be used as two-factor authentication.

Passwordless login​


It's just as easy using a passkey as it is to add one. Let's take a look at the login flow with the passkey I just created:




No need to enter your password. No need to even enter your username! Just tap "Log in using: Passkey" and follow your device's prompts and you'll be logged in!

We've just rolled this out here so have a play around and let us know your thoughts!
 
Click to expand...
This is awesome news :)

But it does need some tweaking:
From looking at the JavaScript source it seems like the current implementation only enables ES256 (ECDSA / SHA 256) - for maximum compatibility with various authenticators also RS256 (RSA / SHA 256) and EdDSA (Ed25519) should be supported.

Furthermore it seems like options requireResidentKey / residentKey are not enabled.
Depending on the authenticator this means that the credentials are not discoverable from the client and thus login via the Passkey button won't work.
So for example if a Yubikey 5 is used this will not work for "Passwordless login" - fingerprint on Android might work.

For true Passkey support (Passkeys are discoverable FIDO2 credentials) this must be enabled.
But enabling this also means that only FIDO2 devices can be used - but not U2F devices (like Yubikey 4).

A compromise could be a change in the GUI, eg. let the use decide wether to create a discoverable credential (that can be used for username & passwordless login) or a non discoverable credential (that can still be used for 2FA or for login if the username / email is provided as well - but in this case without userverification which degrades to "single factor" again, see next section).

Last but not least option userVerification is set to discouraged.
If a discoverable credential is created without user verification this could mean that the authenticator device / credential could be used by anyone.
If for example such a credential is created on a Yubikey 5 that has no PIN set anyone who has access to that device could use it to perform a "passwordless login".

At least for somewhat privileged accounts (Admin / Mod) I probably would not want to have such "single factor" credentials.
 
Last edited:
Really a great feature, forums scripts need like these features to survive!

I suggest to highlight this feature with more priority, the users may not notice a button added to several exist buttons:
1711754885918.webp


Moreover, I think most of the users will not check (security and password) page to notice this feature. Therefore we need to make it easy for the exist users to notice it and activate it.

And for the new users, can we add it as an option in registration form @Chris D?
 
Sadiq6210 said:
Moreover, I think most of the users will not check (security and password) page to notice this feature. Therefore we need to make it easy for the exist users to notice it and activate it.
Click to expand...
No different from 2FA. I just put a sticky post in our Tips & Techniques forum calling attention to it and giving directions.

That said, I like your idea.(y)
 
Sadiq6210 said:
And for the new users, can we add it as an option in registration form @Chris D?
Click to expand...

The workflow to add 2FA is quite separate to the signup workflow - and I don't think that's an issue, you want people to complete registration before they add 2FA.

You should just make an announcement about the feature being available and leave it up to your users to sort out what they're doing.

The vast majority of users won't know or care about passkeys (not yet anyway), and those that are technically savvy enough to know what they are will know where to go looking for them - especially if they've seen your announcement.

I don't think there's anything wrong with the positioning of the Passkey login option - it's consistent with using Google or another service to log in.
 
Sim said:
I don't think there's anything wrong with the positioning of the Passkey login option - it's consistent with using Google or another service to log in.
Click to expand...
I agree, although I wouldn't be surprised if someone makes an add-on to add it to its own line with a larger button to try to promote it more. I would use that addon, certainly.
 
Xon said:
Can you allow multiple passkey's on the same account?

The recommended recovery process is to add a passkey per device (and have multiple devices) so you don't get locked out.
Click to expand...

There doesn't seem to be a limit (that I've found so far) on how many passkeys you can add to an account in XF
 
When I try to login with a created passkey, my Android says that access keys not found. It is probably because of the reasons Kirby described above.
 
andybond said:
HUGE, HUGE reason to upgrade to XF2.3 here alone.

I am using authenticator at the mo and it will be fantastic when that integration on mobile happens
Click to expand...

I just wish it was easier for developers to get their add-ons updated to work with 2.3... that's what always screws me with an upgrade, having to wait (and hope) that developers are still around and/or interested in updating. The main ones always are and do, quickly -- but some of the smaller ones you're just crossing your fingers hoping for.
 
KensonPlays said:
I'd say 10 would be enough for 99.9% of people
Click to expand...
10? 5 is probably enough for a lot. I could have, at most, 3 that I can think of (Win11 laptop if I implement Hello and an Android phone and tab). Not sure what else I would set up as a key. Anything else I use belongs to work or is shared with my spouse.
 
Top Bottom