4 ms·

I've been implementing FIDO2 into my serverless application, finally there will be iOS support! It really is the golden authentication method, it's very though

I've been implementing FIDO2 into my serverless application, finally there will be iOS support! It really is the golden authentication method, it's very thought through and incredibly easy to use (unfortunately not to implement though)

noja 7y ago
Can you recommend something to tie FIDO2 to generic web applications that don't support it directly?
- tmikaeld 7y ago
  Do you mean like a plugin or API? FIDO2 is not something you can "paste on" it has to be built-in to the login feature, but I guess for things like Wordpress there are hooks you can use. I know of no plugins or APIs you can use to add it, I guess if they appear they will be listed on Yubicos list [0] or on Github [1] [0] https://developers.yubico.com/Software_Projects/FIDO_U2F/U2F_Integration_Plug-ins/ https://developers.yubico.com/Software_Projects/FIDO_U2F/U2F... [1] https://github.com/search?q=FIDO2 https://github.com/search?q=FIDO2 Important: U2F cannot be used as the only authentication method, unlike FIDO2 which fully replace password & 2-factor.
jlokier 7y ago
FIDO2 is working, but I wouldn't call it "golden" at all. Tying authentication to a single device you can lose, especially one controlled by the device vendor not by yourself, sounds highly risk prone to me. As far as I'm aware, this is not yet a solved problem with WebauthN or FIDO2 standards - they simply recommend that you provide another authentication method or backup device for recovery, and leave it to you to figure out. (If I've got this completely wrong, I'd love to know.) Although not the same thing, in a similar vein we're already hearing about people locked out of bank accounts that were created in a phone app, and Google doc accounts that they can't log into any more. I wouldn't make the decision to run a business on the back of serverless services I could only get into with FIDO2 keys that are hidden in a vendor device that might die any day. For now, I'll stick with backed up SSH keys and very secret passphrases :-)
- acdha 7y ago
  It’s been a solved problem from the time it launched: you should never have one FIDO device since that leaves no room for failure. Every service I use except Amazon implemented this correctly[1] and the significant security improvements over TOTP or SSH keys are worth it, especially since phishing operations commonly bypass the easier schemes now. 1. You’ll need to find a notary if you lose your AWS MFA device
  - jlokier 7y ago
    I wouldn't be comfortable with one backup device kept in secure storage somewhere. If it fails you won't know, and you'll be operating without redundancy without knowing. So that means keeping two or more devices in regular use. Somehow, without carrying them both around or keeping them in the same places. Tricky.
    - acdha 7y ago
      It means testing your backups and knowing what your unlock procedure is like — for example, can another administrator at your company perform that reset for you? This doesn't need to be something you do daily so you can schedule it but this is a classic security tradeoff: if you're not comfortable with the odds of multiple hardware devices simultaneously failing, you can simply decide to accept the greater security risk of using shared SSH keys or whatever you're using to manage passwords.

noja 7y ago

Can you recommend something to tie FIDO2 to generic web applications that don't support it directly?

tmikaeld 7y ago
Do you mean like a plugin or API? FIDO2 is not something you can "paste on" it has to be built-in to the login feature, but I guess for things like Wordpress there are hooks you can use. I know of no plugins or APIs you can use to add it, I guess if they appear they will be listed on Yubicos list [0] or on Github [1] [0] https://developers.yubico.com/Software_Projects/FIDO_U2F/U2F_Integration_Plug-ins/ https://developers.yubico.com/Software_Projects/FIDO_U2F/U2F... [1] https://github.com/search?q=FIDO2 https://github.com/search?q=FIDO2 Important: U2F cannot be used as the only authentication method, unlike FIDO2 which fully replace password & 2-factor.

jlokier 7y ago

FIDO2 is working, but I wouldn't call it "golden" at all. Tying authentication to a single device you can lose, especially one controlled by the device vendor not by yourself, sounds highly risk prone to me. As far as I'm aware, this is not yet a solved problem with WebauthN or FIDO2 standards - they simply recommend that you provide another authentication method or backup device for recovery, and leave it to you to figure out. (If I've got this completely wrong, I'd love to know.) Although not the same thing, in a similar vein we're already hearing about people locked out of bank accounts that were created in a phone app, and Google doc accounts that they can't log into any more. I wouldn't make the decision to run a business on the back of serverless services I could only get into with FIDO2 keys that are hidden in a vendor device that might die any day. For now, I'll stick with backed up SSH keys and very secret passphrases :-)

acdha 7y ago
It’s been a solved problem from the time it launched: you should never have one FIDO device since that leaves no room for failure. Every service I use except Amazon implemented this correctly[1] and the significant security improvements over TOTP or SSH keys are worth it, especially since phishing operations commonly bypass the easier schemes now. 1. You’ll need to find a notary if you lose your AWS MFA device
- jlokier 7y ago
  I wouldn't be comfortable with one backup device kept in secure storage somewhere. If it fails you won't know, and you'll be operating without redundancy without knowing. So that means keeping two or more devices in regular use. Somehow, without carrying them both around or keeping them in the same places. Tricky.
  - acdha 7y ago
    It means testing your backups and knowing what your unlock procedure is like — for example, can another administrator at your company perform that reset for you? This doesn't need to be something you do daily so you can schedule it but this is a classic security tradeoff: if you're not comfortable with the odds of multiple hardware devices simultaneously failing, you can simply decide to accept the greater security risk of using shared SSH keys or whatever you're using to manage passwords.