3 ms·
A phone provides a fingerprint scanner (something you are), and holds the keypair (something you have) and when combined with a password (something you know) yo
by xori 9y ago
A phone provides a fingerprint scanner (something you are), and holds the keypair (something you have) and when combined with a password (something you know) you have all three.
But we still need the phones to support U2F.
- StavrosK 9y agoU2F is actually the older standard, Webauthn can work with U2F, but it adds some things like user identifiers that make it more useful to authenticate with.
- xori 9y agoYou're right, my bad. But I still do wish phones even supported emulating the existing FIDO U2F standard.
- StavrosK 9y agoMe too :/ It would be great against phishing.
- girvo 9y agoAgreed. I adore U2F, and even have it running under Safari because I love it that much; but without phone support for it, my cute Yubikey really only helps for desktop usage currently. As it stands, my pass phrase and fingerprint are the weak links, as phone logins rely on TOTP. One day I’ll be able to tap my phone against my Yubikey along with my pass phrase, and/or my fingerprint. That would be lovely.
- StavrosK 9y agoI was thinking about soft U2F tokens and came to the conclusion that they wouldn't be that much different from a cookie that just always bypassed the second factor for that specific browser. Of course, it could be stolen from the browser, but so could the U2F key.
- emilecantin 9y agoThe browser never sees the key with U2F; everything is computed on the USB device.
- StavrosK 9y agoI'm talking about soft U2F tokens, i.e. software-based.
- Nullabillity 9y ago> One day I’ll be able to tap my phone against my Yubikey along with my pass phrase, and/or my fingerprint. That would be lovely. That works fine for me on Android.
- rhizome 9y agoa fingerprint scanner (something you are), and holds the keypair (something you have) What segregation between these is there within the phone? Doesn't it mean the fingerprint gets you the keypair for free?
- mattnewton 9y agoIf you also have the physical phone in your hands, yes.
- xori 9y agoYou now have a severed finger. Where's the phone? You'll still need both items.