3 ms·

I really like the Fido U2F concept, because it ticks all the right boxes; simple to use, reusable for multiple services without being traceable, multiple hardwa

I really like the Fido U2F concept, because it ticks all the right boxes; simple to use, reusable for multiple services without being traceable, multiple hardware vendors, open standard, soon implement in Chrome, Firefox, and Edge (although I am not sure about the status in Edge right now), and cheap. But this solves logging in with a browser. I have been wondering about things like IMAP for e-mail access. To secure my mail a second factor sounds great, but right now all solutions mean I get 2FA when I log in with a browser, but as soon as I use an e-mail client I am back to username and password (application-specific or otherwise). Ideally, Fido U2F would be an option to use with IMAP and SMTP as well, so that Thunderbird, Outlook, or Apple Mail can prompt me to touch the U2F key when I get my mail. I have not been able to find much information on this approach yet though. Is it possible? Desirable? Any insights?

nickik 11y ago
Nothing probits using UAF/U2F for other stuff outside web browsers. The problem is that the concept of "AppId" is not clearly defined in non Web Application but that should not stop people form doing it. Yubico has Open Source code that makes it relativly easy.
- aeroevan 11y ago
  Yubico's pam_u2f allows u2f to be used for anything pam authenticates, which is nice for a Linux system.
  - nickik 11y ago
    Its a very cool feature, I agree, sadly making pam_u2f work for SSH is quite a hack. Their is a patch for OpenSSH but it never went upstream. I really hope this will be work soon.
lhaussknecht 11y ago
There is an native U2F implementation for Android by yubico: https://github.com/Yubico/android-u2f-demo https://github.com/Yubico/android-u2f-demo. Also take a look at this webinar https://www.yubico.com/2015/10/u2f-webinar-from-concept-to-implementation-2/ https://www.yubico.com/2015/10/u2f-webinar-from-concept-to-i.... The client data part is what you have to send to the authenticator.
- Freak_NL 11y ago
  The client-side code and the standard are fairly trivial to implement — thanks to Yubico as well — but the problem lies in designing and standardising an extension to the existing mail protocols, and getting that accepted as a common feature for e-mail providers (such as Google and Microsoft) and a common feature in MTAs and MDAs.
IceyEC 11y ago
Mac Mail already will use client certs to authenticate with GMail: https://i.imgur.com/gTE6tkt.png https://i.imgur.com/gTE6tkt.png

nickik 11y ago

Nothing probits using UAF/U2F for other stuff outside web browsers. The problem is that the concept of "AppId" is not clearly defined in non Web Application but that should not stop people form doing it. Yubico has Open Source code that makes it relativly easy.

aeroevan 11y ago
Yubico's pam_u2f allows u2f to be used for anything pam authenticates, which is nice for a Linux system.
- nickik 11y ago
  Its a very cool feature, I agree, sadly making pam_u2f work for SSH is quite a hack. Their is a patch for OpenSSH but it never went upstream. I really hope this will be work soon.

lhaussknecht 11y ago

There is an native U2F implementation for Android by yubico: https://github.com/Yubico/android-u2f-demo https://github.com/Yubico/android-u2f-demo. Also take a look at this webinar https://www.yubico.com/2015/10/u2f-webinar-from-concept-to-implementation-2/ https://www.yubico.com/2015/10/u2f-webinar-from-concept-to-i.... The client data part is what you have to send to the authenticator.

Freak_NL 11y ago
The client-side code and the standard are fairly trivial to implement — thanks to Yubico as well — but the problem lies in designing and standardising an extension to the existing mail protocols, and getting that accepted as a common feature for e-mail providers (such as Google and Microsoft) and a common feature in MTAs and MDAs.

IceyEC 11y ago

Mac Mail already will use client certs to authenticate with GMail: https://i.imgur.com/gTE6tkt.png https://i.imgur.com/gTE6tkt.png