6 ms·

I don't know what kind of future you're talking about. U2F gained 0 adoption and are doomed. What did they expect with $19 sticks that require USB?

nickik 9y ago
First of all, Fido is not just U2F. UAF the more important in the long term. Second, U2F is not about USB sticks only. It is a protocol that works over NFC or Bluetooth. Soon it will also be possible to use your phone as a U2F authenticator for your laptop. Third, how is it not adoption when Facebook, Github, Dropbox, Google and many others have added it. Forth, a lot of hardware already has support built in. Lenovo laptops, Samsung phones and so on. Android has added an API. The new Snapdragon chips have it implemented on a very low level that will allow key storage in a secure enclave with dedicated transport to the finger print reader for example. Five, where are you getting this 19$? You can get sticks for as low as 5$. When is the last time authentication technology has been adopted like that? I would think never. Google has published a paper about their experience, https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys-focus-of-2-year-google-study/ https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys...
- homakov 9y ago
  >Third, how is it not adoption when Facebook, Github, Dropbox, Google and many others have added it. adding != users are using it (they don't) 19 is price for yubikey, maybe some do for 5, it doesn't matter because it should be 0 and no hardware costs that. Making auth layer for general public as hardware is a mistake #1. >When is the last time authentication technology has been adopted like that? I would think never. Facebook Connect. Hell of a success. It's centralized, though (and we made decentralized securelogin.pw) Google says some of their 50k employers are happy with experience. That's it, has nothing to do with users of Google.
  - nickik 9y ago
    > adding != users are using it (they don't) I use it. My company uses it for Google GSuite (mandatory). I know many people who use it. Also, this is pretty new stuff, of course its not used by everybody yet. The Spec has not been finalized for very long. U2F has actually shown very good growth. It has been adopted in some mainstream browsers and Firefox will have it soon as well. Adding a completely new authentication layer to the hole web is a monster task. No solution will solve all problems in a couple years only. > 19 is price for yubikey, maybe some do for 5, it doesn't matter because it should be 0 and no hardware costs that. Making auth layer for general public as hardware is a mistake #1. Again, much future hardware will just have it built in. You have a smartphone anyway, why not use it as a second factor? Your wearable could be your U2F device. That's also U2F. U2F is a protocol, not a hardware stick. Also, you don't need hardware. You can use software implementations if the server allows that. > Facebook Connect. That's federation layer and you can use U2F to make it saver for you.
    - homakov 9y ago
      I'd rather recommend people use google auth/facebook connect than go through u2f hassle. It's way too inconvenient and will never go mainstream. Did they figure out usable backups yet? Or they still recommend to just buy another stick?
      - striking 9y ago
        Your backups are the generated Authenticator backup codes. Most services give you anywhere between 5 and 10 of these, giving you 5 to 10 chances to log in without your stick. That's plenty of leeway. No reason not to just revoke the old factor and buy a new one.
        scott00 9y ago
        The problem with this is the backup codes are different for each service. With one service, I can keep a backup card in my wallet, another in my house, and another at somebody else's house in a different city, giving me very high assurance of availability in the event of token loss or destruction. I can't maintain that level of backup for every service I sign up for. Even multiple tokens isn't a good solution for lots of services, since you need possession of the token to enroll.
zxcvbn4038 9y ago
I'm surprised they haven't gained wider adoption, their competitors charge yearly fees for their tokens, and in many cases you become dependent on their infrastructure to use them. U2F is a one time investment as long as the token isn't damaged, and your not beholden to Yubico in the slightest. I've got a box of RSA tokens from former jobs. E*Trade still gives out some token with a LCD display for $20 a year as their sole 2nd factor option.
- homakov 9y ago
  because selling overpriced plastic sticks is a lucrative business which has nothing to do with security or threat models at all. It's just marketing

nickik 9y ago

First of all, Fido is not just U2F. UAF the more important in the long term. Second, U2F is not about USB sticks only. It is a protocol that works over NFC or Bluetooth. Soon it will also be possible to use your phone as a U2F authenticator for your laptop. Third, how is it not adoption when Facebook, Github, Dropbox, Google and many others have added it. Forth, a lot of hardware already has support built in. Lenovo laptops, Samsung phones and so on. Android has added an API. The new Snapdragon chips have it implemented on a very low level that will allow key storage in a secure enclave with dedicated transport to the finger print reader for example. Five, where are you getting this 19$? You can get sticks for as low as 5$. When is the last time authentication technology has been adopted like that? I would think never. Google has published a paper about their experience, https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys-focus-of-2-year-google-study/ https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys...

homakov 9y ago
>Third, how is it not adoption when Facebook, Github, Dropbox, Google and many others have added it. adding != users are using it (they don't) 19 is price for yubikey, maybe some do for 5, it doesn't matter because it should be 0 and no hardware costs that. Making auth layer for general public as hardware is a mistake #1. >When is the last time authentication technology has been adopted like that? I would think never. Facebook Connect. Hell of a success. It's centralized, though (and we made decentralized securelogin.pw) Google says some of their 50k employers are happy with experience. That's it, has nothing to do with users of Google.
- nickik 9y ago
  > adding != users are using it (they don't) I use it. My company uses it for Google GSuite (mandatory). I know many people who use it. Also, this is pretty new stuff, of course its not used by everybody yet. The Spec has not been finalized for very long. U2F has actually shown very good growth. It has been adopted in some mainstream browsers and Firefox will have it soon as well. Adding a completely new authentication layer to the hole web is a monster task. No solution will solve all problems in a couple years only. > 19 is price for yubikey, maybe some do for 5, it doesn't matter because it should be 0 and no hardware costs that. Making auth layer for general public as hardware is a mistake #1. Again, much future hardware will just have it built in. You have a smartphone anyway, why not use it as a second factor? Your wearable could be your U2F device. That's also U2F. U2F is a protocol, not a hardware stick. Also, you don't need hardware. You can use software implementations if the server allows that. > Facebook Connect. That's federation layer and you can use U2F to make it saver for you.
  - homakov 9y ago
    I'd rather recommend people use google auth/facebook connect than go through u2f hassle. It's way too inconvenient and will never go mainstream. Did they figure out usable backups yet? Or they still recommend to just buy another stick?
    - striking 9y ago
      Your backups are the generated Authenticator backup codes. Most services give you anywhere between 5 and 10 of these, giving you 5 to 10 chances to log in without your stick. That's plenty of leeway. No reason not to just revoke the old factor and buy a new one.
      - scott00 9y ago
        The problem with this is the backup codes are different for each service. With one service, I can keep a backup card in my wallet, another in my house, and another at somebody else's house in a different city, giving me very high assurance of availability in the event of token loss or destruction. I can't maintain that level of backup for every service I sign up for. Even multiple tokens isn't a good solution for lots of services, since you need possession of the token to enroll.

zxcvbn4038 9y ago

I'm surprised they haven't gained wider adoption, their competitors charge yearly fees for their tokens, and in many cases you become dependent on their infrastructure to use them. U2F is a one time investment as long as the token isn't damaged, and your not beholden to Yubico in the slightest. I've got a box of RSA tokens from former jobs. E*Trade still gives out some token with a LCD display for $20 a year as their sole 2nd factor option.

homakov 9y ago
because selling overpriced plastic sticks is a lucrative business which has nothing to do with security or threat models at all. It's just marketing