3 ms·

> If you use a finger print sensor as a convenient first factor then you might as well still want a second factor. You keep talking about factors, which is jus

> If you use a finger print sensor as a convenient first factor then you might as well still want a second factor. You keep talking about factors, which is just a word, not a technical term. I repeat: you do not need u2f with fixed first layer. No plausible threat model. Malware attack gets delayed, not prevented. If you decide to reply please define word "factor".

nickik 9y ago
The use of the term 'factor' is pretty established in any security discussion and I have heard the word mentioned in lots and lots of presentations on security conferences. So it seems to be you that has some sort of strange hang up about this. U2F is designed to add additional security by you having to prove that you physically own something. > you do not need u2f with fixed first layer Again, that why there is UAF, it has nothing directly to do with U2F. In UAF you have to somehow (bio or knowledge) prove that you are who you are. In high security application you might want to both have local authentication (UAF) and additionally prove of possession (U2F). > Malware attack gets delayed, not prevented. Of course it helps. If you use your laptops fingerprint reader as a first factor, somebody steals your laptop, gets the fingerprints from it, he will still not be able to access your online accounts because they need U2F. If its a website that uses password and you get phished this will be completely useless if they don't have access to your U2F authenticater.
- homakov 9y ago
  There's no established meaning of factor. I have trouble understanding UAF goals. We already have full disk encryption + pincodes on laptops and phones. Consider it "first factor" then? If laptop is stolen you cannot get in (see San Bernardino attacks). Yes, everyone must have it "on". So we are left with attacks that control your computer once you unlock it. Malware. And with malware we can exploit your computer right now (no "second factor") or few days later (wait for you pressing that USB button). My point being these both cases are giving same security, but second one is much worse usability. >If its a website that uses password and you get phished this will be completely useless if they don't have access to your U2F authenticater. Pre-condition to this discussion is that "first factor" is not a password but some kind of client certificate, i.e. phishing and reuse is not in question. Then we are looking at what U2F offers us: horrible user experience with most browsers+devices not supporting it for the sake of just delayed exploitation? Thanks, no.

nickik 9y ago

The use of the term 'factor' is pretty established in any security discussion and I have heard the word mentioned in lots and lots of presentations on security conferences. So it seems to be you that has some sort of strange hang up about this. U2F is designed to add additional security by you having to prove that you physically own something. > you do not need u2f with fixed first layer Again, that why there is UAF, it has nothing directly to do with U2F. In UAF you have to somehow (bio or knowledge) prove that you are who you are. In high security application you might want to both have local authentication (UAF) and additionally prove of possession (U2F). > Malware attack gets delayed, not prevented. Of course it helps. If you use your laptops fingerprint reader as a first factor, somebody steals your laptop, gets the fingerprints from it, he will still not be able to access your online accounts because they need U2F. If its a website that uses password and you get phished this will be completely useless if they don't have access to your U2F authenticater.

homakov 9y ago
There's no established meaning of factor. I have trouble understanding UAF goals. We already have full disk encryption + pincodes on laptops and phones. Consider it "first factor" then? If laptop is stolen you cannot get in (see San Bernardino attacks). Yes, everyone must have it "on". So we are left with attacks that control your computer once you unlock it. Malware. And with malware we can exploit your computer right now (no "second factor") or few days later (wait for you pressing that USB button). My point being these both cases are giving same security, but second one is much worse usability. >If its a website that uses password and you get phished this will be completely useless if they don't have access to your U2F authenticater. Pre-condition to this discussion is that "first factor" is not a password but some kind of client certificate, i.e. phishing and reuse is not in question. Then we are looking at what U2F offers us: horrible user experience with most browsers+devices not supporting it for the sake of just delayed exploitation? Thanks, no.