2 ms·

Couple comments already on "websites shouldn't accept biometrics as a password". They're totally correct, and that's not what is being shown here. This is "webs

by hirsin 9y ago

Couple comments already on "websites shouldn't accept biometrics as a password". They're totally correct, and that's not what is being shown here. This is "websites accept hardware or software generated FIDO logins that have access to them intermediated by a combination of several factors including device presence, session login, and biometrics". The hard part is making that look and feel like "login with a fingerprint".

magicalist 9y ago
Yeah, this is a bad article leading to a really bad discussion. FIDO2 is basically proposing to replace passwords with U2F. How the keys are generated, exchanged, and challenged has nothing to do with biometrics[1]. That part of this appears to be MS and Google demonstrations of using biometrics to unlock what is essentially just an OS password manager for U2F keys, which wouldn't even raise an eyebrow if found in today's Android or iOS. [1] The relevant part of the spec: "In order to provide evidence of user interaction, an external authenticator implementing this protocol is expected to have a mechanism to obtain a user gesture. Possible examples of user gestures include: as a consent button, password, a PIN, a biometric or a combination of these." https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-client-to-authenticator-protocol-v2.0-rd-20170927.html https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-cl...
JumpCrisscross 9y ago
What happens when I lose or break all my devices?
- magicalist 9y ago
  > What happens when I lose or break all my devices? What happens when you use iOS's password generator and manager and you lose or break your phone? Or the same but with LastPass? You've either synced it or you lose all your passwords.
  - JumpCrisscross 9y ago
    My LastPass vault is protected with a master password. If I lose all my devices, I can restore from online using that. I’m just wondering how that would work in a password less schéma.
    - hirsin 9y ago
      We (IDPs in general, I can't quite speak to FIDO work) still have other account recovery methods, like email (eg Facebook lets you do fast IDV for password reset if you have a Gmail account associated). Part of this is a turtle tower - there's always going to be some more definitive IDP that we ask you to associate and fall back to, and hopefully that IDP will do the same. Our work (MSFT Identity) on decentralized ID in particular needs to take this into account - who's the last turtle there?

by hirsin 9y ago

magicalist 9y ago

Yeah, this is a bad article leading to a really bad discussion. FIDO2 is basically proposing to replace passwords with U2F. How the keys are generated, exchanged, and challenged has nothing to do with biometrics[1]. That part of this appears to be MS and Google demonstrations of using biometrics to unlock what is essentially just an OS password manager for U2F keys, which wouldn't even raise an eyebrow if found in today's Android or iOS. [1] The relevant part of the spec: "In order to provide evidence of user interaction, an external authenticator implementing this protocol is expected to have a mechanism to obtain a user gesture. Possible examples of user gestures include: as a consent button, password, a PIN, a biometric or a combination of these." https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-client-to-authenticator-protocol-v2.0-rd-20170927.html https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-cl...

JumpCrisscross 9y ago

What happens when I lose or break all my devices?

magicalist 9y ago
> What happens when I lose or break all my devices? What happens when you use iOS's password generator and manager and you lose or break your phone? Or the same but with LastPass? You've either synced it or you lose all your passwords.
- JumpCrisscross 9y ago
  My LastPass vault is protected with a master password. If I lose all my devices, I can restore from online using that. I’m just wondering how that would work in a password less schéma.
  - hirsin 9y ago
    We (IDPs in general, I can't quite speak to FIDO work) still have other account recovery methods, like email (eg Facebook lets you do fast IDV for password reset if you have a Gmail account associated). Part of this is a turtle tower - there's always going to be some more definitive IDP that we ask you to associate and fall back to, and hopefully that IDP will do the same. Our work (MSFT Identity) on decentralized ID in particular needs to take this into account - who's the last turtle there?