9 ms·
Acceptance of FIDO 2.0 accelerates the movement to end passwords
- lhaussknecht 11y agoI was suprised that when signing in to my Goole account on my Android device with Chrome Beta, the Google Authenticator App pops up to do U2F with my YubiKey NEO via NFC. That was really seamless! Does anybody know, if it would be possible to use this within a WebView in a native app?
- mcpherrinm 11y agoI'm not sure -- I don't have an easy way to test. But if you do, https://u2fdemo.appspot.com/ https://u2fdemo.appspot.com/ is a great little demo app for finding out if u2f works.
- lhaussknecht 11y agoI just tested exactly this with this sample app https://play.google.com/store/apps/details?id=com.webviewbrowser https://play.google.com/store/apps/details?id=com.webviewbro.... But it isn't working. I think the FIDO API is not implemented in the WebView right now.
- nickik 11y agoI don't get it. The Google Authenticator pops up and you do U2F with that? Google Authenticator is a app for TOTP. What am I not understanding?
- deckar01 11y agoApparently Google Authenticator supports OATH-TOTP which allows the yubikey to respond to challenges [0]. The yubikey page is light on details, but confirms that you can use a yubikey with Google Authenticator for U2F [1]. [0] http://binaryelysium.com/blog/2011/12/13/a-reluctant-relationship-yubikey-google-authentication.html http://binaryelysium.com/blog/2011/12/13/a-reluctant-relatio... [1] https://www.yubico.com/applications/fido/ https://www.yubico.com/applications/fido/
- nickik 11y agoThat is strange. I use the 'Yubico Authenticator' (like Google Authenticator but you have to connect to the Yubikey via NFC for it to reveal your login codes) if I need OATH-TOTP, this has nothing to do with U2F. However the docs in your second link does indicate that their is some new interoperation between Google Authenticator and U2F. It seams that they use Google Authenticator as a stopgap until browser support the system directly. Pretty strange. This in turn has nothing to do with U2F. I can not test this stuff very well because I use a Yubikey NEO that is to old for the U2F NFC and a Yubikey 4 that has no NFC. I really hope release a Yubikey 4 with NFC soon.
- hermanradtke 11y agoNow if we can only get Firefox to support it: https://bugzilla.mozilla.org/show_bug.cgi?id=1065729 https://bugzilla.mozilla.org/show_bug.cgi?id=1065729
- rmac 11y ago... and safari
- mcpherrinm 11y agoUntil it's included in the browser, you can use https://addons.mozilla.org/en-US/firefox/addon/u2f-support-add-on/ https://addons.mozilla.org/en-US/firefox/addon/u2f-support-a...
- kevingadd 11y agoThe real problem isn't even Firefox's lack of support. There's an addon you can install that implements it but literally every website seems to do a useragent check, so it doesn't work anyway :-(
- nickik 11y agoAh, thats why that damned thing wont work! Thanks.
- Freak_NL 11y agoFido U2F support is currently in development by Mozilla for Firefox. See the last post of that bug, or look for the U2F discussions on the Firefox mailing lists if you want to find out more about the current status.
- edoloughlin 11y agoWhat happens to the x% of users who lose/break/eat the device containing their private keys? How do they recover their accounts?
- johnm1019 11y agoIn Germany every service that you can sign up for online but requires proof of who you are uses something called "PostIdent" -- and its a service offered by the post office where you take the form in with your passport (or ID card) and they punch all the details in the computer and 'verify' it's you. In a (more) secure future, I see this being the real password recovery mechanism. The other technique used by online banks etc... is to send your password reset to you by mail. This assumes that physical mail to your registered address is more secure than online quizzes. I think both of these options will become the standard for anything where security matters.
- kogepathic 11y agoThis is a good idea,and I too can see it happening in the future. A few problems though: 1) PostIdent isn't free. You might not be paying for it, but someone is. Also that random forum you signed up for in Singapore? Doubt they're going to support password recovery via PostIdent. 2) What happens if you need to reset your login while you're travelling. I have had it happen before that a password is forgotten or not available and I really need to login (e.g. to retrieve the ticket) and a password reset to my email address is the most expedient method.
- germanier 11y agoSince about half a year video ident is gaining traktion, which is basically the same but via video chat. Still not free but probably cheaper, less effort on your side and usable while travelling (as long as you don't loose your passport). I think Revolut and some other services even use the NFC chip in passports (yes, it can be read by regular smartphones) to identify you almost automatically.
- Eridrus 11y ago
- FooBarWidget 11y agoI support the movement to end passwords. For the average user, passwords are as insecure as they can get. My (non-technical) family members keep using their birth dates, phone numbers etc as their passwords. I told them this is insecure, that they should use long random passwords, but their response is "I can't remember that". So I suggested writing it down, but they find that too much hassle. I managed to convince them to do it for some passwords, but they keep losing the paper (they just tuck away the paper somewhere and then forget where it is). Furthermore, they don't have computers, they ONLY use mobile devices, on which long passwords are awkward to type. So they revert to using phone numbers and passwords, with the attitude of "I'm not an important enough target, and if a hacker really targets me I am screwed anyway". Some of them have difficulty grasping the concept of multiple passwords. To them, it's just "the Internet needs a password". If I explain to them that each website is a different vendor, they get confused. Just remembering which login username to use for a specific website (or whether it is a username or an emailaddress-as-a-username) is already difficult enough for them. Mind you, we are talking about people older than 45. They have trouble using computers (even phones!) as-is, even before we get to the security part. I ended up becoming their password store for their most important accounts. I setup random passwords for them, then when they need to do something (a few times per year) they have me login and do it for them. The average user doesn't care enough about online security to really do something about it. They don't understand, or acknowledge, the risks. So we need to do everything we can to make security convenient.
- chei0aiV 11y agoTell them to use a diceware/xkcd password. Memorable and secure (currently with 7 words or more).
- mixmastamyk 11y ago> Mind you, we are talking about people older than 45 Most people are not cognizant of these issues young or old. I don't find young people any more careful.
- FooBarWidget 11y agoThat's true, many non-technical friends I have around my age are not at all careful. But at least I've never encountered someone who thinks in terms of "the Internet needs a password" and confuses different accounts with each other. But frankly, it doesn't matter: I only mentioned age to reinforce to the reader that it is a real problem that deserves recognition and that we should try harder to do away with passwords and to strive for convenient security.
- technojunkie 11y agoFIDO will soon have competition in the form of SQRL which is an interesting concept. http://sqrl.pl/ http://sqrl.pl/
- mixmastamyk 11y agoYep, it's a nice design. I'm looking at adding it to my next site. https://en.wikipedia.org/wiki/SQRL https://en.wikipedia.org/wiki/SQRL
- newman314 11y agoI went to read up more on SQRL and found this. http://security.stackexchange.com/questions/43374/could-sqrl-really-be-as-secure-as-they-say http://security.stackexchange.com/questions/43374/could-sqrl...
- mixmastamyk 11y agoShame the top answer is so jealous of Gibson, who isn't always right (who is?) but have never heard him boastful or say an unkind word as the links allege.
- danieldk 11y agoSQRL is vulnerable to phishing attacks: https://www.cl.cam.ac.uk/~fms27/papers/2014-JenkinsonSpeWarETAL-phish.pdf https://www.cl.cam.ac.uk/~fms27/papers/2014-JenkinsonSpeWarE...
- technojunkie 11y agoThis paper is nearly 2 years old from 2014. One can probably assume this has been addressed and fixed by now, although I have on proof of that.
- StavrosK 11y agoSQRL has been around for years with no traction, what changed now?
- smallduck 11y agoAnd PayPal wants to be in the middle every time you do a FIDO login. No thanks. #sqrl
- lhaussknecht 11y agoWhy do you think PayPal is involved when you do a U2F login?
- newman314 11y agoWill this be backward compatible with the existing FIDO Yubikeys?
- lhaussknecht 11y agoAFAIK yes. The spec defines the high-level API you use withing the browser.
- ascorbic 11y agoDoes this mean PayPal will support U2F? Right now they don't even support TOTP, just SMS or the proprietary Verisign keys.
- nickik 11y agoNo, I dont think so. PayPal is mostly interested in FIDO because of UAF. The have publicly stated that they would not move to U2F. This was a while ago and I dont have a source. The plans could have changed.
- Freak_NL 11y agoI really like the Fido U2F concept, because it ticks all the right boxes; simple to use, reusable for multiple services without being traceable, multiple hardware vendors, open standard, soon implement in Chrome, Firefox, and Edge (although I am not sure about the status in Edge right now), and cheap. But this solves logging in with a browser. I have been wondering about things like IMAP for e-mail access. To secure my mail a second factor sounds great, but right now all solutions mean I get 2FA when I log in with a browser, but as soon as I use an e-mail client I am back to username and password (application-specific or otherwise). Ideally, Fido U2F would be an option to use with IMAP and SMTP as well, so that Thunderbird, Outlook, or Apple Mail can prompt me to touch the U2F key when I get my mail. I have not been able to find much information on this approach yet though. Is it possible? Desirable? Any insights?
- nickik 11y agoNothing probits using UAF/U2F for other stuff outside web browsers. The problem is that the concept of "AppId" is not clearly defined in non Web Application but that should not stop people form doing it. Yubico has Open Source code that makes it relativly easy.
- aeroevan 11y agoYubico's pam_u2f allows u2f to be used for anything pam authenticates, which is nice for a Linux system.
- nickik 11y agoIts a very cool feature, I agree, sadly making pam_u2f work for SSH is quite a hack. Their is a patch for OpenSSH but it never went upstream. I really hope this will be work soon.
- lhaussknecht 11y agoThere is an native U2F implementation for Android by yubico: https://github.com/Yubico/android-u2f-demo https://github.com/Yubico/android-u2f-demo. Also take a look at this webinar https://www.yubico.com/2015/10/u2f-webinar-from-concept-to-implementation-2/ https://www.yubico.com/2015/10/u2f-webinar-from-concept-to-i.... The client data part is what you have to send to the authenticator.
- davb 11y agoCould someone explain how FIDO 2.0 fits in with U2F and UAF? I'm having a bit of trouble understanding how the pieces go together. Does FIDO 2.0 make the existing U2F and UAF specs obsolete? Is there any documentation explaining this (maybe I've missed it?). Thanks.
- nickik 11y agoI have been following this for a while and I don't get it completly. UAF/U2F are FIDO1.0 standards. As I understand the idea is that FIDO2.0 standards build on these basic blocks and add additional features. I think the problem of revoking a device accross all services is something they want to work on in 2.0. Im also confused, but I think the UAF/U2F standards should not get depreciated with FIDO2.0. If somebody knows more, Im all ears.
- monk_e_boy 11y agoWhen they mention device - do the mean phone? Will there be other devices that aren't so expensive?
- nickik 11y agoWell the idea is that you use the fingerprint sensor on your phone to login while browsing with your phone. You can have a fingerprint sensor on your laptop. Alternativly these could also be cheap external devices that you connect over USB, NFC or Bluetooth LE (their are already standards for this). They would really like if all devices had some kind of UAF sensor built in. You can get U2F devices for about 15$.
- monk_e_boy 11y agoCool, bit of googling and found 'FIDO U2F Security Key' (USB) for £5 I expect those will turn up in our local supermarkets pretty soon. Someone should give these hardware keys a better name. E.g. your "Privacy Lock" or something similar. Much easier to explain than a "FIDO U2F" ... whatever those letters all jumbled together mean.
- nickik 11y agoWell I use the Yubikey, thats a fun name, but not descriptive. Basic U2F sticks will probably be between 7$ and 50$ depending on feature set.
- Freak_NL 11y agoNo phone required, at all. It would not be a very useful standard if a smartphone was a requirement. Have a look at this short overview: https://fidoalliance.org/specifications/overview/ https://fidoalliance.org/specifications/overview/ UAF is authentication by means of a local device with some biometric authentication factor. U2F uses a separate hardware token that can be used via USB, NFC, or Bluetooth LE — so basically, any modern computing device.
- 11y ago
- warcode 11y agoSo instead of a KeePass with a long random password for each site, I'll have a KeePass with key pairs for each site. The added security being that if the site gets compromised, they can't log into the site using my account. But then again the site is already compromised at that point.
- nickik 11y agoIf you already use random passwords you get less security benefits, but you still get a lot of them. The additional security happens if you consider MITM attacks. Assume that you want to login to https://mybank.com https://mybank.com but somebody links you to http://mybank.com http://mybank.com (bad dns) or https://mybank.co https://mybank.co. With UAF or U2F the local authenticator will not sign anything (and thus the attacker can not login to your actual bank). Now admittedly you browser plugin might warn you in some cases. However you might copy in the password by hand because you think its some kind of problem with the plug in. The usability is of course improved as well. Their should be no need for a password manager at all. Go to the website, put your finger on the sensor and your done (or whatever other local authenticator you use).
- _Codemonkeyism 11y ago(I have no clue) What is the difference between the $5 key from Yubico to their $50 key? If I secure GMail, how does GMail on my tablet/phone work? Are there other keys than from Yubico recommended?
- nickik 11y agoThe cheap keys support way less features. The are simple U2F tokens and cant do anything else. The others support tons of other features. You can use them for classic 2FA with OTP (TOPT/HOTP/YubiCloud OTP). They support using your Yubikey as a Smartcard, you can put your 4k GPG key setup into your Yubikey. They also support the PIV interface and you can use it for lots of different operations, like code signing, certificate authority, windows authentication and more. Some of the sticks support NFC. This means you can use Smartcard, PIV and U2F over NFC. Sadly at the moment they have no key that supports 4k GPG Keys AND NFC. However they will update this soonish. See: https://www.yubico.com/products/yubikey-hardware/ https://www.yubico.com/products/yubikey-hardware/ There are also older models that you can still buy that don't support U2F at all. > Are there other keys than from Yubico recommended? Their are others, just search for U2F on amazon, seems their are at least 4 companies implementing them. Nitrokey is a pretty cool company with a interesting option that are somewhat different from Yubikey.
- StavrosK 11y agoWhat's a 4K GPG key? I just bought a Neo specifically to store my GPG keys, is there a problem with it?
- mangeletti 11y agoEvery time I read about this stuff, it makes my belly churn when the answers to questions like "how do you recover your account, if you lose your device?" are things like "they can have an extra secure password for recovery" or "they can call and provide their <insert something vulnerable to social engineering or government interference, like a 'PostIdent' - which the government actually controls>" or "bio-metric", so, basically this new standard doesn't solve any security problem whatsoever; it just makes logging in easier and account recovery more confusing. Why not instead work on a standard that enforces password strength beyond what is economically viable for brute forcing (which is something like 6-8 chars... not exactly a tough one)? I mean, the standard could literally just be this: A password MUST be 8+ characters in length. Security problem solved. Here's a comprehensive Python library for my new standard: def mangeletti_safe(raw_password): return len(raw_password) >= 8 In all seriousness, we will need to, at some point, come to the realization that the key to authentication has always been and will always be based on a secret that only you know, whether that secret is your resting pulse combined with the color of the rabbit's foot in your left pocket, or your fingerprint, or a password, or a private key (which IS A PASSWORD).
- StavrosK 11y agoBecause your proposal is defeated by a simple keylogger, or a phishing site, or with password reuse with a compromised site, or a myriad other ways that a U2F token won't. The answer to your original question is the same as the answer to "How do you recover your account if you lose your password?". Usually, email password resets.
- mangeletti 11y agoWhich brings you to your email account, which if protected by U2F also, means you're doubly locked out, unless you've left a backdoor to your email account, which will be vulnerable to intrusion (as well as the keylogger / phishing attacks). Not to mention, what about the challenge step? If somebody has a keystroke logger installed, that means they have control of at least part of your machine. They can probably read the bytes of your private key and then listen for your key's password to be entered. The solution is longer passwords and expensive hashing algorithms that render brute force attacks not economically viable. The other problems (keyloggers (read: malware) and phishing are orthogonal and need to be solved otherwise, rather than us putting bandages on the security issues caused thereby.
- AdmiralAsshat 11y agoI've been considering getting a Yubico for awhile now, but my concern is that it seems like every few months some new model comes out that supports new XYZ Standard. I'd really want the following before I bite: 1) The security community on the whole needs to come to a consensus on what is going to be used. If FIDO 2.0 is it, cool, but I'd like to be sure that they won't say "FIDO 2.0 in 2016, now and forever." then come back in 2017 and say "Actually FIDO sucks, we're all switching to ARGUS now." 2) The device should be future-proof, insofar as it would be able to support the agreed upon standard in Step 1 and/or any minor changes that might come along the way without having to dump the device. IF the device must be swapped for a newer version, there should be some way to migrate. 3) Compatibility with all of my devices--major browsers, major OS's, smartphone, etc. Might be a tall order, but until it can be filled, LastPass + 2FA on my Android phone is good enough for me.
- AndyMcConachie 11y agoIs there anyone here who is familiar with HOBA(RFC 7486) and FIDO that can comment on their differences and similarities?
- SimeVidas 11y agoSo I bought one of those FIDO USB sticks, but when I tested it on GitHub or Google, I still had to enter my account password. So, how is this better than 2FA via smartphone SMS? Is the plan to integrate a fingerprint sensor into the FIDO stick so it can become sufficient without passwords?
- mchahn 11y agoI started using algorithmic passwords a year or two ago and it has been great. I have a different password for every domain, there is nothing to remember, and it is hard to crack. I just tested my password on this demo and got a four out of four score. I know others have done this but I don't know why it isn't discussed, or better yet, recommended more.