5 ms·
Technically, nothing needs to be additionally configured for FIDO U2F to be implemented for an application. You just need to connect the key to your account and
by pg_bot 8y ago
Technically, nothing needs to be additionally configured for FIDO U2F to be implemented for an application. You just need to connect the key to your account and it should just prompt you to click the button when you need to sign in. If a company requires a phone number or some other byzantine process for registering a key that is their own design choice.
I get that simple U2F key registration is not what's seen in a lot of time in the real world, but most implementations are needlessly complex IMO.
- eropple 8y ago"You just need to connect the key to your account" is the onerous part, though. Google doesn't require a phone number or whatever, but you have to click through like four pages to get to it.
- joshuamcginnis 8y agoGoogle Account -> Sign-in & Security -> 2-Step Verification Or just click: https://myaccount.google.com/signinoptions/two-step-verification https://myaccount.google.com/signinoptions/two-step-verifica...
- eropple 8y agoYes. Then click U2F. Then start messing around with that. It takes time. And I have a ton of accounts. I like my U2F key but it is still a pain in the ass.
- joshuamcginnis 8y agoSeems pretty easy to me, in my opinion.
- eximius 8y agoAll barriers are insurmountable UX burdens to a significant portion of users, no matter how trivial the barrier.
- eropple 8y agoDo it for 20 apps. On two keys. When every app has a different place they hide the feature, when every app has a different workflow to get it done, and most of them don't tell you they support it in the first place. It really sucks. At minimum, WebAuthN should enable detecting when the key has been slotted and ask if you want to enable U2F, then take you through it...but nobody does, and nobody probably will anytime soon. At work, Okta at least will handle it for us, but personally? It really sucks.
- joshuamcginnis 8y agoYea, that is cumbersome and not at all user-friendly. I was operating under the assumption of a single app + device use-case at solely Google in my original comment.
- eropple 8y agoSure - and like I said, Okta does a good job of that for us. But to get people to really embrace it, I tend to think it's gotta work for them personally too. Otherwise it's just this "thing" on a keychain, you know? It's not important.
- pg_bot 8y agoIdeally, there would be an event emitted by the browser that could detect that a U2F key was inserted, but do to the design limitations of the key this is unlikely to happen. The U2F key is essentially a keyboard that has been plugged into your USB port. Some people keep "nano"[0] ones plugged in at all times for convenience. To address the common use cases of real users, you would need the browser to be able to check if an external keyboard is plugged in to a USB port on DOM ready, and when inserted into the computer. I will let your imagination run wild with what a nefarious person could do if every browser has the ability to detect if you are using a specific type of USB keyboard. I could point you in direction of device fingerprinting to start, but that's the bare minimum of what you expose. [0]: https://www.yubico.com/product/yubikey-4-series/#yubikey-4-nano https://www.yubico.com/product/yubikey-4-series/#yubikey-4-n...
- 8y ago
- bsder 8y ago> You just need to connect the key to your account Which account? Where is the account? Who runs that account? In a 10-person office, I want to be able to hand 3 keys to each person (1 for use, 1 for loss, and 1 just in case the other two somehow foul up), and then have them use those keys for computer login, email login, AWS login, GCP login, NXP/ST/SiLabs support forum login, etc. And when one of them goes to another company (it happens), I need to be able to shut those keys down without their cooperation. Until I can do this, 2FA is going to remain the province of big companies and not be very useful.
- ckocagil 8y agoSo basically you need SSO with an identity provider that supports key-only logins. Perhaps SimpleSamlPHP with privacyIdea would fit the bill.