3 ms·
TOTP and U2F both perform a single authentication from a captive secret, rather than revealing a reusable secret. U2F does even better, and ensures you are aut
by closeparen 7y ago
TOTP and U2F both perform a single authentication from a captive secret, rather than revealing a reusable secret.
U2F does even better, and ensures you are authenticating to the right website, not an intermediary.
If we eliminated passwords in favor of onboard U2F chips, we'd be much better off than today, though not as amazing as U2F + passwords.
- tialaramex 7y agoArguably what's inside a U2F/ FIDO token isn't a secret but a private value. The TOTP secret is known to the authenticator, they calculate the same TOTP value as you to verify that yours is correct. In U2F / WebAuthn the device just proves it still knows a private asymmetric key that it can use to sign messages, the authenticator learns the _public_ key, but not the private one, it can authenticate these signatures but not produce its own. To deliver pseudonymity the device doesn't use a single public/private pair for everything but instead generates them randomly from a seed or key it knows and _this_ private value is what makes your FIDO Security Key different from my FIDO Security Key so that you can be authenticated, whilst not making it possible to fingerprint you and see where else you use these credentials. Single Factor FIDO is a thing, Microsoft offers it. The device takes a PIN (something you know) and incorporates that into the results, so that anyone who doesn't know the PIN now can't authenticate even if they've stolen your Security Key. You need a suitable device, the Yubikey Security Keys with a "2" emblazened are suitable.