3 ms·
I wasted so much time and energy on implementing U2F for a web application, writing server side lib and making the javascript framework compatible with the horr
by polack 8y ago
I wasted so much time and energy on implementing U2F for a web application, writing server side lib and making the javascript framework compatible with the horrible js-hack that's available for U2F support.
It was all in vein; the browser support is still horrible, no one want to use it and it's not possible to use on mobile. How can you make a security solution that doesn't work on mobile?
Making a new "Web Auth" standard is a huge mistake, and I will not fall into that trap again.
- danudey 8y agoI ran into this with GitHub. I ordered a YubiKey, got it all set up with GitHub, and… never use it. Because it's not supported on mobile or in Safari. If anything, the web needs technology that allows browsers to present secure third-party auth to web services (e.g. through TouchID, the way that Apple Pay works on Safari and Mobile Safari).