4 ms·

I think this is great, but its time has come and mostly passed in my opinion. The future belongs to FIDO UAF and U2F. They are building a hole ecosystem with a

by nickik 9y ago

I think this is great, but its time has come and mostly passed in my opinion. The future belongs to FIDO UAF and U2F. They are building a hole ecosystem with all kinds of capability and additional security that SQRL simply can not provide. Most important being anti-phishing protection. They are working on mechanism that would allow you to use the phone as a authenticator even when working on your desktop, this is part of the upcoming version of the standard. They are already very popular and in a lot of hardware, they are working with w3c to standardize, part of the Web Authentication group. Some people wrongly assume that UAF is only about but it could also be somebody entering a password or pin. The main attraction is that it allows for independent evolution of authenticaters without the server having to know or care (he can care if he likes). This will be a game changer.

vim_wannabe 9y ago
Is FIDO something that I can use instead of implementing email+password register/validate_email/change_password/reset_password/change_email over and over again? Is it finally here, what Persona promised us?
- nickik 9y ago
  No. FIDO 1.0 and FIDO 1.1 are more narrow in scope. This is not a federated login system. These are point-to-point authentication protocols that don't involve any third party. It is a replacement specifically to replace password login and multiple second factor solutions. It will make it far easier to implement registration and authentication but not radically, you still have to do it. It will also not replace your recovery flow. How to handle recovery is still up to you. FIDO 2.0 will add some notion of tying together different authentications but still not solve the problem of federation (as far as I know). For Federation OpenId Connect is still the best, if not optimal solution.
homakov 9y ago
I don't know what kind of future you're talking about. U2F gained 0 adoption and are doomed. What did they expect with $19 sticks that require USB?
- nickik 9y ago
  First of all, Fido is not just U2F. UAF the more important in the long term. Second, U2F is not about USB sticks only. It is a protocol that works over NFC or Bluetooth. Soon it will also be possible to use your phone as a U2F authenticator for your laptop. Third, how is it not adoption when Facebook, Github, Dropbox, Google and many others have added it. Forth, a lot of hardware already has support built in. Lenovo laptops, Samsung phones and so on. Android has added an API. The new Snapdragon chips have it implemented on a very low level that will allow key storage in a secure enclave with dedicated transport to the finger print reader for example. Five, where are you getting this 19$? You can get sticks for as low as 5$. When is the last time authentication technology has been adopted like that? I would think never. Google has published a paper about their experience, https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys-focus-of-2-year-google-study/ https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys...
  - homakov 9y ago
    >Third, how is it not adoption when Facebook, Github, Dropbox, Google and many others have added it. adding != users are using it (they don't) 19 is price for yubikey, maybe some do for 5, it doesn't matter because it should be 0 and no hardware costs that. Making auth layer for general public as hardware is a mistake #1. >When is the last time authentication technology has been adopted like that? I would think never. Facebook Connect. Hell of a success. It's centralized, though (and we made decentralized securelogin.pw) Google says some of their 50k employers are happy with experience. That's it, has nothing to do with users of Google.
    - nickik 9y ago
      > adding != users are using it (they don't) I use it. My company uses it for Google GSuite (mandatory). I know many people who use it. Also, this is pretty new stuff, of course its not used by everybody yet. The Spec has not been finalized for very long. U2F has actually shown very good growth. It has been adopted in some mainstream browsers and Firefox will have it soon as well. Adding a completely new authentication layer to the hole web is a monster task. No solution will solve all problems in a couple years only. > 19 is price for yubikey, maybe some do for 5, it doesn't matter because it should be 0 and no hardware costs that. Making auth layer for general public as hardware is a mistake #1. Again, much future hardware will just have it built in. You have a smartphone anyway, why not use it as a second factor? Your wearable could be your U2F device. That's also U2F. U2F is a protocol, not a hardware stick. Also, you don't need hardware. You can use software implementations if the server allows that. > Facebook Connect. That's federation layer and you can use U2F to make it saver for you.
cm2187 9y ago
I am not familiar with Fido but I am looking at their website. It looks like a complex protocol for enterprises. Not some simple library available for many programming language and platforms, which any website can easily implement and add as an alternative or a substitute for login/password. It might help the google, microsoft and bank of america of this world. But these are not the ones leaking our credentials (most often). It is the smaller websites who will not have the resources to go through some certifications or implement these protocols from scratch. What is really missing is a common, free standard protocol, that can be easily adopted by a small website. Is Fido trying to answer this use case?
- nickik 9y ago
  The protocol is open, so you can create open source lib and server. You do not need to certify the open source libraries. There is already a lot of code out-there. The browser have to implement it as well, chrome does, others should follow soon. See this example Java library: https://github.com/Yubico/java-u2flib-server https://github.com/Yubico/java-u2flib-server But in general they seem to be doing a very good job of forcing hardware to be standards complaint. They are putting quite a bit of effort into standards testing suites that you can use to validate your code as well. A good thing about it is that on the server it only saves site-specific public keys, so small websites that get hacked leak important information.
floatboth 9y ago
Uh excuse me?? SQRL provides excellent anti-phishing protection. There are no reusable credentials across domains, and the domain can be displayed on your authenticator. https://www.grc.com/sqrl/phishing.htm https://www.grc.com/sqrl/phishing.htm
- nickik 9y ago
  Cool, I did not see that. However, the limitation are there, FIDO goes further.
- hdhzy 9y ago
  Domain displayed is no real protection, actually its weakness is what drives phishing. But the link you provided contains some interesting info: > How SQRL changes things > When using SQRL, users do not identify and authenticate themselves with a username and password. Instead, their unique user identity is derived from their secret master key and the website's full domain name. So that's similar to what U2F does - domain name (origin) is part of the protocol.
drdaeman 9y ago
The bad side of U2F is that it looks like yet another push of treacherous computing acceptance. It has attestation certificates that end-user (both legal and physical token owner) isn't supposed to have any control over. SQRL is much simpler and doesn't have that.
- nickik 9y ago
  Seems to me the attestation certificates allow people who want to restrict the type of token to do that in a reliable way. Let's say you are a bank, you want to use U2F or UAF. Some cheap 5$ U2F stick is not acceptable, you want to require some high quality stick from trustworthy people. Or maybe you even want to give your costumers costume sticks. In UAF its even more important. You want to be able to reliable exclude Finger Print sensors or something like that. It adds security and options. As long as the certification is not highly restricted I don't see it as a problem.
  - drdaeman 9y ago
    > You want to be able to reliable exclude As a vendor - oh, yes, of course, I would absolutely enjoy as much control as possible. As an end-user - nope, I want to decide on my trust vectors on my own. Even if I'm utterly delusional about my abilities to do so. I just believe that a freedom to make a decision - even a terribly wrong one - is better than a secure lack of any. I don't want "trusted" authentication tokens to access sites from a "trusted" browser on a "trusted" OS to be displayed on a "trusted" monitor and so on[1]. Even if that makes world much more secure place. ________ [1] Yes, that sounds far-fetched and alarmist, but it's really all the same - end user is out of control and "their" hardware is attested for the sake of security. We're already knee-deep in there, please don't let it spread on more things, gradually gaining acceptance.
    - nickik 9y ago
      I just don't think banks and so on would adopt the technology otherwise. This system makes it possible to use the same protocol for super high security application where you require a UAF authenticater with its own keyboard and screen. A bank just be hacked because somebody used a sup-par authenticater. The good thing is that while a bank can force you to use some specific device, they can not stop you from using that same device in other places.

by nickik 9y ago

vim_wannabe 9y ago

Is FIDO something that I can use instead of implementing email+password register/validate_email/change_password/reset_password/change_email over and over again? Is it finally here, what Persona promised us?

nickik 9y ago
No. FIDO 1.0 and FIDO 1.1 are more narrow in scope. This is not a federated login system. These are point-to-point authentication protocols that don't involve any third party. It is a replacement specifically to replace password login and multiple second factor solutions. It will make it far easier to implement registration and authentication but not radically, you still have to do it. It will also not replace your recovery flow. How to handle recovery is still up to you. FIDO 2.0 will add some notion of tying together different authentications but still not solve the problem of federation (as far as I know). For Federation OpenId Connect is still the best, if not optimal solution.

homakov 9y ago

I don't know what kind of future you're talking about. U2F gained 0 adoption and are doomed. What did they expect with $19 sticks that require USB?

nickik 9y ago
First of all, Fido is not just U2F. UAF the more important in the long term. Second, U2F is not about USB sticks only. It is a protocol that works over NFC or Bluetooth. Soon it will also be possible to use your phone as a U2F authenticator for your laptop. Third, how is it not adoption when Facebook, Github, Dropbox, Google and many others have added it. Forth, a lot of hardware already has support built in. Lenovo laptops, Samsung phones and so on. Android has added an API. The new Snapdragon chips have it implemented on a very low level that will allow key storage in a secure enclave with dedicated transport to the finger print reader for example. Five, where are you getting this 19$? You can get sticks for as low as 5$. When is the last time authentication technology has been adopted like that? I would think never. Google has published a paper about their experience, https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys-focus-of-2-year-google-study/ https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys...
- homakov 9y ago
  >Third, how is it not adoption when Facebook, Github, Dropbox, Google and many others have added it. adding != users are using it (they don't) 19 is price for yubikey, maybe some do for 5, it doesn't matter because it should be 0 and no hardware costs that. Making auth layer for general public as hardware is a mistake #1. >When is the last time authentication technology has been adopted like that? I would think never. Facebook Connect. Hell of a success. It's centralized, though (and we made decentralized securelogin.pw) Google says some of their 50k employers are happy with experience. That's it, has nothing to do with users of Google.
  - nickik 9y ago
    > adding != users are using it (they don't) I use it. My company uses it for Google GSuite (mandatory). I know many people who use it. Also, this is pretty new stuff, of course its not used by everybody yet. The Spec has not been finalized for very long. U2F has actually shown very good growth. It has been adopted in some mainstream browsers and Firefox will have it soon as well. Adding a completely new authentication layer to the hole web is a monster task. No solution will solve all problems in a couple years only. > 19 is price for yubikey, maybe some do for 5, it doesn't matter because it should be 0 and no hardware costs that. Making auth layer for general public as hardware is a mistake #1. Again, much future hardware will just have it built in. You have a smartphone anyway, why not use it as a second factor? Your wearable could be your U2F device. That's also U2F. U2F is a protocol, not a hardware stick. Also, you don't need hardware. You can use software implementations if the server allows that. > Facebook Connect. That's federation layer and you can use U2F to make it saver for you.

cm2187 9y ago

I am not familiar with Fido but I am looking at their website. It looks like a complex protocol for enterprises. Not some simple library available for many programming language and platforms, which any website can easily implement and add as an alternative or a substitute for login/password. It might help the google, microsoft and bank of america of this world. But these are not the ones leaking our credentials (most often). It is the smaller websites who will not have the resources to go through some certifications or implement these protocols from scratch. What is really missing is a common, free standard protocol, that can be easily adopted by a small website. Is Fido trying to answer this use case?

nickik 9y ago
The protocol is open, so you can create open source lib and server. You do not need to certify the open source libraries. There is already a lot of code out-there. The browser have to implement it as well, chrome does, others should follow soon. See this example Java library: https://github.com/Yubico/java-u2flib-server https://github.com/Yubico/java-u2flib-server But in general they seem to be doing a very good job of forcing hardware to be standards complaint. They are putting quite a bit of effort into standards testing suites that you can use to validate your code as well. A good thing about it is that on the server it only saves site-specific public keys, so small websites that get hacked leak important information.

floatboth 9y ago

Uh excuse me?? SQRL provides excellent anti-phishing protection. There are no reusable credentials across domains, and the domain can be displayed on your authenticator. https://www.grc.com/sqrl/phishing.htm https://www.grc.com/sqrl/phishing.htm

nickik 9y ago
Cool, I did not see that. However, the limitation are there, FIDO goes further.
hdhzy 9y ago
Domain displayed is no real protection, actually its weakness is what drives phishing. But the link you provided contains some interesting info: > How SQRL changes things > When using SQRL, users do not identify and authenticate themselves with a username and password. Instead, their unique user identity is derived from their secret master key and the website's full domain name. So that's similar to what U2F does - domain name (origin) is part of the protocol.

drdaeman 9y ago

The bad side of U2F is that it looks like yet another push of treacherous computing acceptance. It has attestation certificates that end-user (both legal and physical token owner) isn't supposed to have any control over. SQRL is much simpler and doesn't have that.

nickik 9y ago
Seems to me the attestation certificates allow people who want to restrict the type of token to do that in a reliable way. Let's say you are a bank, you want to use U2F or UAF. Some cheap 5$ U2F stick is not acceptable, you want to require some high quality stick from trustworthy people. Or maybe you even want to give your costumers costume sticks. In UAF its even more important. You want to be able to reliable exclude Finger Print sensors or something like that. It adds security and options. As long as the certification is not highly restricted I don't see it as a problem.
- drdaeman 9y ago
  > You want to be able to reliable exclude As a vendor - oh, yes, of course, I would absolutely enjoy as much control as possible. As an end-user - nope, I want to decide on my trust vectors on my own. Even if I'm utterly delusional about my abilities to do so. I just believe that a freedom to make a decision - even a terribly wrong one - is better than a secure lack of any. I don't want "trusted" authentication tokens to access sites from a "trusted" browser on a "trusted" OS to be displayed on a "trusted" monitor and so on[1]. Even if that makes world much more secure place. ________ [1] Yes, that sounds far-fetched and alarmist, but it's really all the same - end user is out of control and "their" hardware is attested for the sake of security. We're already knee-deep in there, please don't let it spread on more things, gradually gaining acceptance.
  - nickik 9y ago
    I just don't think banks and so on would adopt the technology otherwise. This system makes it possible to use the same protocol for super high security application where you require a UAF authenticater with its own keyboard and screen. A bank just be hacked because somebody used a sup-par authenticater. The good thing is that while a bank can force you to use some specific device, they can not stop you from using that same device in other places.