5 ms·

What happens if you lose your hardware token (or it gets stolen, ec.)? Is there a way for then to access your accounts?

gruez 8y ago
backup/recovery codes and/or "forgot your password (authenticator)" recovery
StavrosK 8y ago
Ideally (and hopefully this will be doable, as I don't see any impediments), you can have Bitcoin-wallet-style seed generation that you can back up onto a piece of paper and store it somewhere safe. I really hope my Ledger Nano S becomes WebAuthN-compatible, as it can already be used as a U2F key.
- tialaramex 8y ago
  Yes, for a device as complicated as the (~ $100) Ledger Nano S I don't see any reason they couldn't support that functionality. Most people will be using much cheaper, dumb authenticators which aren't going to have the capability to read and update the keys, they would be expected to replace their authenticator altogether, not try to clone it if there's a problem.
ethagnawl 8y ago
This could introduce latency and centralization to the authentication process, but perhaps there could be a public key server/service that would allow the user to issue a revocation certificate. This scenario could also be a legitimate use case for blockchain technology.
- nfoz 8y ago
  If there isn't a solution in place for revocation, then it's not really an authentication solution, IMO. I would have thought this would be part of the proposed API. Do you think it belongs there?
  - tialaramex 8y ago
    This functionality is orthogonal to the API. If say my Gmail is configured to trust my awesome Darth Vader bobble head authenticator, the tiny one I keep on my keychain and one that's in my locked desk drawer with my cyanide pills and then I lose my keys somehow, I go home, use the Darth Vader to sign in, click for the account credentials page, pick the keychain one and pick remove. I can add another one when I buy it, using the ordinary enrollment step. No new API needed or desired. The trick to U2F and this whole family of technologies is that the devices are really dumb, your authenticator doesn't remember "I'm allowed to authenticate to Google, I picked this key" it just turns google.com into a number and uses that with some crypto arithmetic. If you never actually enrolled with Google, the results are worthless but it has no idea. If I try to sign into Mike's account with Sarah's authenticator, it doesn't work but there's no clue why. The authenticator doesn't even know it's Sarah's.

backup/recovery codes and/or "forgot your password (authenticator)" recovery

Ideally (and hopefully this will be doable, as I don't see any impediments), you can have Bitcoin-wallet-style seed generation that you can back up onto a piece of paper and store it somewhere safe. I really hope my Ledger Nano S becomes WebAuthN-compatible, as it can already be used as a U2F key.

tialaramex 8y ago
Yes, for a device as complicated as the (~ $100) Ledger Nano S I don't see any reason they couldn't support that functionality. Most people will be using much cheaper, dumb authenticators which aren't going to have the capability to read and update the keys, they would be expected to replace their authenticator altogether, not try to clone it if there's a problem.

ethagnawl 8y ago

This could introduce latency and centralization to the authentication process, but perhaps there could be a public key server/service that would allow the user to issue a revocation certificate. This scenario could also be a legitimate use case for blockchain technology.

nfoz 8y ago
If there isn't a solution in place for revocation, then it's not really an authentication solution, IMO. I would have thought this would be part of the proposed API. Do you think it belongs there?
- tialaramex 8y ago
  This functionality is orthogonal to the API. If say my Gmail is configured to trust my awesome Darth Vader bobble head authenticator, the tiny one I keep on my keychain and one that's in my locked desk drawer with my cyanide pills and then I lose my keys somehow, I go home, use the Darth Vader to sign in, click for the account credentials page, pick the keychain one and pick remove. I can add another one when I buy it, using the ordinary enrollment step. No new API needed or desired. The trick to U2F and this whole family of technologies is that the devices are really dumb, your authenticator doesn't remember "I'm allowed to authenticate to Google, I picked this key" it just turns google.com into a number and uses that with some crypto arithmetic. If you never actually enrolled with Google, the results are worthless but it has no idea. If I try to sign into Mike's account with Sarah's authenticator, it doesn't work but there's no clue why. The authenticator doesn't even know it's Sarah's.