3 ms·

U2F/FIDO2 supports user verification (UV) in addition to user presence (UP). So you should be able to do the same, but I haven't tested if the current implement

U2F/FIDO2 supports user verification (UV) in addition to user presence (UP). So you should be able to do the same, but I haven't tested if the current implementation supports it.

tialaramex 7y ago
Their own documentation suggests these are the same thing and both refer to the need to press a button or close a contact or whatever: Generically, the term “User Verification” may also refer to this “Test for User Presence” from e.g. https://fidoalliance.org/specs/fido-security-requirements-v1.0-fd-20170524/fido-authenticator-security-requirements_20170524.html https://fidoalliance.org/specs/fido-security-requirements-v1...
- ecesena 7y ago
  Weird, this spec has a little bit of a different terminology. I think it's better to refer to CTAP2 or WebAuthn directly. UV refers to PIN or biometric, it's in addition to UP. https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-cl...
  - Boulth 7y ago
    Note that CTAP and WebAuthn are newer and although they contain U2F for backwards compatibility reasons U2F doesn't contain CTAP2 and WebAuthn. U2F is also surprisingly simple protocol (two specs on FIDO site).
    - ecesena 7y ago
      Yes, and exactly because FIDO2 is backward compatible with U2F the definition of UV can't be ambiguous, otherwise you could have older U2F keys that pretend to do FIDO2-UV when in fact they aren't.
- justincormack 7y ago
  Yubikey just announced a key with a fingerprint reader today.
  - jolmg 7y ago
    Besides the point that it wouldn't be a secure replacement for a password/PIN, I wonder if it would have support for multiple valid fingerprints. Some time ago, I got cut on my finger and was having some trouble getting my fingerprint recognized. It would suck to get locked out of stuff because of a cut.

U2F/FIDO2 supports user verification (UV) in addition to user presence (UP). So you should be able to do the same, but I haven't tested if the current implementation supports it.

tialaramex 7y ago

Their own documentation suggests these are the same thing and both refer to the need to press a button or close a contact or whatever: Generically, the term “User Verification” may also refer to this “Test for User Presence” from e.g. https://fidoalliance.org/specs/fido-security-requirements-v1.0-fd-20170524/fido-authenticator-security-requirements_20170524.html https://fidoalliance.org/specs/fido-security-requirements-v1...

ecesena 7y ago
Weird, this spec has a little bit of a different terminology. I think it's better to refer to CTAP2 or WebAuthn directly. UV refers to PIN or biometric, it's in addition to UP. https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-cl...
- Boulth 7y ago
  Note that CTAP and WebAuthn are newer and although they contain U2F for backwards compatibility reasons U2F doesn't contain CTAP2 and WebAuthn. U2F is also surprisingly simple protocol (two specs on FIDO site).
  - ecesena 7y ago
    Yes, and exactly because FIDO2 is backward compatible with U2F the definition of UV can't be ambiguous, otherwise you could have older U2F keys that pretend to do FIDO2-UV when in fact they aren't.
justincormack 7y ago
Yubikey just announced a key with a fingerprint reader today.
- jolmg 7y ago
  Besides the point that it wouldn't be a secure replacement for a password/PIN, I wonder if it would have support for multiple valid fingerprints. Some time ago, I got cut on my finger and was having some trouble getting my fingerprint recognized. It would suck to get locked out of stuff because of a cut.