5 ms·
You're right, my bad. But I still do wish phones even supported emulating the existing FIDO U2F standard.
by xori 9y ago
You're right, my bad. But I still do wish phones even supported emulating the existing FIDO U2F standard.
- StavrosK 9y agoMe too :/ It would be great against phishing.
- girvo 9y agoAgreed. I adore U2F, and even have it running under Safari because I love it that much; but without phone support for it, my cute Yubikey really only helps for desktop usage currently. As it stands, my pass phrase and fingerprint are the weak links, as phone logins rely on TOTP. One day I’ll be able to tap my phone against my Yubikey along with my pass phrase, and/or my fingerprint. That would be lovely.
- StavrosK 9y agoI was thinking about soft U2F tokens and came to the conclusion that they wouldn't be that much different from a cookie that just always bypassed the second factor for that specific browser. Of course, it could be stolen from the browser, but so could the U2F key.
- emilecantin 9y agoThe browser never sees the key with U2F; everything is computed on the USB device.
- StavrosK 9y agoI'm talking about soft U2F tokens, i.e. software-based.
- Nullabillity 9y ago> One day I’ll be able to tap my phone against my Yubikey along with my pass phrase, and/or my fingerprint. That would be lovely. That works fine for me on Android.