5 ms·

I'd rather recommend people use google auth/facebook connect than go through u2f hassle. It's way too inconvenient and will never go mainstream. Did they figure

I'd rather recommend people use google auth/facebook connect than go through u2f hassle. It's way too inconvenient and will never go mainstream. Did they figure out usable backups yet? Or they still recommend to just buy another stick?

striking 9y ago
Your backups are the generated Authenticator backup codes. Most services give you anywhere between 5 and 10 of these, giving you 5 to 10 chances to log in without your stick. That's plenty of leeway. No reason not to just revoke the old factor and buy a new one.
- scott00 9y ago
  The problem with this is the backup codes are different for each service. With one service, I can keep a backup card in my wallet, another in my house, and another at somebody else's house in a different city, giving me very high assurance of availability in the event of token loss or destruction. I can't maintain that level of backup for every service I sign up for. Even multiple tokens isn't a good solution for lots of services, since you need possession of the token to enroll.
nickik 9y ago
Its a point-to-point protocol. Its not a login and recovery flow. Its designed to be integrated in what people are already using as a direct replacement for other 2 factors, so it can be widely adopted instead of forcing everybody to something completely new. Once this is established the hope to push the envelope further with future versions. That's the reason this stuff gets adopted. Everybody understand that these issues still exist. Nobody believes that FIDO 1.0 is the solution for all problems that exist in auth. I for one much rather buy two U2F sticks, then entering that stupid TOTP token one more time.
- homakov 9y ago
  "Factor" is a marketing word. There is security threat model, and there are no "factors". u2f introduces another layer instead of fixing first one. That's why they failed - all we needed is a password replacement, not code generator on top of that.
  - nickik 9y ago
    Ok. So lets explain this ELI5-style. Currently people use passwords then add TOTP to increase security. FIDO wants to improve the situation so they introduce UAF to replace passwords, and they replace U2F to replace TOPT. What exactly is your problem? They did exactly what you wanted, they invented UAF to improve on the first factor. For high security application you can add a second factor. Are you arguing there is never a case for a second factor? I really don't understand your issues.
    - homakov 9y ago
      > so they introduce UAF to replace passwords Oh, how is it going? Is there any UAF supporting app, ie no passwords? All I see is slides and presentations. > Are you arguing there is never a case for a second factor Correct, once first layer is fixed and password-related attacks are mitigated, there's no need for u2f as it doesn't stop malware. Even something as basic as hmac(masterpw, domain)-app would do better job than FIDO stuff altogether.
      - nickik 9y ago
        Replacing passwords is incredibly difficult. Nobody has done it, many have tried. UAF is already supported in a wide number of hardware and applications. You can verify PayPal transaction right now with UAF. Not exactly a small fish. UAF does not jet have much browser support yet, everybody is waiting for Web Authentication API that is in standardization right now. > Correct, once first layer is fixed and password-related attacks are mitigated, there's no need for u2f as it doesn't stop malware. That's just stupid. If you use a finger print sensor as a convenient first factor then you might as well still want a second factor. The idea that there is never a use for a second factor is just total nonsense. > Even something as basic as hmac(masterpw, domain)-app would do better job than FIDO stuff altogether. The security of that would be far, far worse. Not to mention tons of other practical problem with that idea.
zxcvbn4038 9y ago
Just the other day I wrote an Oauth login feature in Go for fun. Facebook banned my account three days later for "suspicious" activity. Twitter banned my account in 48 seconds - I didn't even have a chance to setup an Oauth token. That right there shows the problem with being reliant on a 3rd party for access to your site, what if the 3rd party refuses to work with you? Suddenly your cut off from a percentage of your users. (It wasn't all bad, setting up Amazon login was quick and painless and they didn't ban my account!) I do wish more sites allowed TOTP (Google Auth) because it works well and avoids the third party dependency, but I'd be happiest if sites would just stopped disabling paste so I can use strong passwords with my password manager. (Synchrony Bank, I'm looking at you and all your dozens of co-branded web sites)
- homakov 9y ago
  currently, gauth connect is best option for general public. It's a fact, they are popular and have no passwords

striking 9y ago

Your backups are the generated Authenticator backup codes. Most services give you anywhere between 5 and 10 of these, giving you 5 to 10 chances to log in without your stick. That's plenty of leeway. No reason not to just revoke the old factor and buy a new one.

scott00 9y ago
The problem with this is the backup codes are different for each service. With one service, I can keep a backup card in my wallet, another in my house, and another at somebody else's house in a different city, giving me very high assurance of availability in the event of token loss or destruction. I can't maintain that level of backup for every service I sign up for. Even multiple tokens isn't a good solution for lots of services, since you need possession of the token to enroll.

nickik 9y ago

Its a point-to-point protocol. Its not a login and recovery flow. Its designed to be integrated in what people are already using as a direct replacement for other 2 factors, so it can be widely adopted instead of forcing everybody to something completely new. Once this is established the hope to push the envelope further with future versions. That's the reason this stuff gets adopted. Everybody understand that these issues still exist. Nobody believes that FIDO 1.0 is the solution for all problems that exist in auth. I for one much rather buy two U2F sticks, then entering that stupid TOTP token one more time.

homakov 9y ago
"Factor" is a marketing word. There is security threat model, and there are no "factors". u2f introduces another layer instead of fixing first one. That's why they failed - all we needed is a password replacement, not code generator on top of that.
- nickik 9y ago
  Ok. So lets explain this ELI5-style. Currently people use passwords then add TOTP to increase security. FIDO wants to improve the situation so they introduce UAF to replace passwords, and they replace U2F to replace TOPT. What exactly is your problem? They did exactly what you wanted, they invented UAF to improve on the first factor. For high security application you can add a second factor. Are you arguing there is never a case for a second factor? I really don't understand your issues.
  - homakov 9y ago
    > so they introduce UAF to replace passwords Oh, how is it going? Is there any UAF supporting app, ie no passwords? All I see is slides and presentations. > Are you arguing there is never a case for a second factor Correct, once first layer is fixed and password-related attacks are mitigated, there's no need for u2f as it doesn't stop malware. Even something as basic as hmac(masterpw, domain)-app would do better job than FIDO stuff altogether.
    - nickik 9y ago
      Replacing passwords is incredibly difficult. Nobody has done it, many have tried. UAF is already supported in a wide number of hardware and applications. You can verify PayPal transaction right now with UAF. Not exactly a small fish. UAF does not jet have much browser support yet, everybody is waiting for Web Authentication API that is in standardization right now. > Correct, once first layer is fixed and password-related attacks are mitigated, there's no need for u2f as it doesn't stop malware. That's just stupid. If you use a finger print sensor as a convenient first factor then you might as well still want a second factor. The idea that there is never a use for a second factor is just total nonsense. > Even something as basic as hmac(masterpw, domain)-app would do better job than FIDO stuff altogether. The security of that would be far, far worse. Not to mention tons of other practical problem with that idea.

zxcvbn4038 9y ago

Just the other day I wrote an Oauth login feature in Go for fun. Facebook banned my account three days later for "suspicious" activity. Twitter banned my account in 48 seconds - I didn't even have a chance to setup an Oauth token. That right there shows the problem with being reliant on a 3rd party for access to your site, what if the 3rd party refuses to work with you? Suddenly your cut off from a percentage of your users. (It wasn't all bad, setting up Amazon login was quick and painless and they didn't ban my account!) I do wish more sites allowed TOTP (Google Auth) because it works well and avoids the third party dependency, but I'd be happiest if sites would just stopped disabling paste so I can use strong passwords with my password manager. (Synchrony Bank, I'm looking at you and all your dozens of co-branded web sites)

homakov 9y ago
currently, gauth connect is best option for general public. It's a fact, they are popular and have no passwords