4 ms·
When they mention device - do the mean phone? Will there be other devices that aren't so expensive?
by monk_e_boy 11y ago
When they mention device - do the mean phone? Will there be other devices that aren't so expensive?
- nickik 11y agoWell the idea is that you use the fingerprint sensor on your phone to login while browsing with your phone. You can have a fingerprint sensor on your laptop. Alternativly these could also be cheap external devices that you connect over USB, NFC or Bluetooth LE (their are already standards for this). They would really like if all devices had some kind of UAF sensor built in. You can get U2F devices for about 15$.
- monk_e_boy 11y agoCool, bit of googling and found 'FIDO U2F Security Key' (USB) for £5 I expect those will turn up in our local supermarkets pretty soon. Someone should give these hardware keys a better name. E.g. your "Privacy Lock" or something similar. Much easier to explain than a "FIDO U2F" ... whatever those letters all jumbled together mean.
- nickik 11y agoWell I use the Yubikey, thats a fun name, but not descriptive. Basic U2F sticks will probably be between 7$ and 50$ depending on feature set.
- Freak_NL 11y agoNo phone required, at all. It would not be a very useful standard if a smartphone was a requirement. Have a look at this short overview: https://fidoalliance.org/specifications/overview/ https://fidoalliance.org/specifications/overview/ UAF is authentication by means of a local device with some biometric authentication factor. U2F uses a separate hardware token that can be used via USB, NFC, or Bluetooth LE — so basically, any modern computing device.
- nickik 11y agoPlease be sure to avoid saying UAF needs a "biometric" authenticator. Thats not really the case, you can use any device or potentially even software, for example an external devices where you have to enter your pin or password. I think this is importend because way to often people say "UAF isch shity because biometric authentification is bad" and thus completly mis the point of the hole concept.
- Freak_NL 11y agoDuly noted; thanks for clarifying. I do get the impression UAF is targeted mostly as a biometric authentication system — which I indeed dislike, so I do see your point. Perhaps the confusion stems from the UAF/U2F split and the examples shown.
- nickik 11y agoIt is true that Fido itself always uses biometric as an example. The casual finger print sensors on all phones and laptops will probebly be the most widly deployed authenticator. Biometric authentication companies are part of the support base for the Fido Alliance and they always push Biometric into the front as well. There seems to be no company that is about to release a pin or password hardware authenticator that could advocate for the alternative. Also the press loves the hole 'remove passwords' storyline.
- Freak_NL 11y agoOnly for Fido UAF though. Fido U2F also attains the goal of reducing the knowledge factor to a PIN or something similar, but does this by employing discrete hardware tokens as the possession factor.