3 ms·

> if you have spare cash and like cool toys FIDO2 is a more capable second generation of the technology. Why would you want passwordless authentication? Isn't

> if you have spare cash and like cool toys FIDO2 is a more capable second generation of the technology. Why would you want passwordless authentication? Isn't the whole point of 2FA that you have to have something and you have to know something?

josephcsible 5y ago
Some people care more about convenience than security. And for everyone else, it doesn't have to be passwordless. You can use a regular password and a FIDO authenticator.
stavros 5y ago
The FIDO2 key is usually protected by a PIN that wipes the key after a few wrong attempts, so it combines the two itself. Besides, there's nothing that dictates how secure the key should be. You could use your hardware cryptocurrency wallet for this, which is probably much more secure and convenient than the average Yubikey (you can duplicate it with the seed phrase).
- Thorrez 5y ago
  You can duplicate the Yubikey or the hardware cryptocurrency wallet? Wouldn't the ability to duplicate it make it weaker?
  - stavros 5y ago
    You can duplicate the wallet. It would make it weaker, but it's more secure in that they usually have hardware keypads for you to enter your PIN on.
tialaramex 5y ago
The cheapest available FIDO2 option is PIN-based so your PIN (actually any password, it doesn't need to be like a bank PIN) is the something you know, and the FIDO2 authenticator is something you have, two factors. You don't need to pick a PIN to have conventional "second factor" working but if you want a usernameless authentication you can have that by choosing a PIN. What's different compared to having a web site password? The web site knows the password, but they don't know your PIN. This means suddenly relatively weak human memorable passwords are good enough, because bad guys can't break in and steal 40 million of them in seconds or leverage them across multiple sites, the PIN is useless without the authenticator. But other FIDO2 authenticators can do fingerprints, making it something you are (a person with that fingerprint) and something you have (the authenticator) so two factors again. Usernameless (rather than passwordless) is the differentiator. You can literally have the sign-in flow be a "Sign In" button and the user does the thing (finger on reader, types in PIN, or maybe looks at camera) and they're authenticated. No step where you type in an email address or a username. This has a privacy cost because it means the authenticator knows in some sense who you are, but it is super convenient if that's what you're all about - while being much more secure than today's username + password dance.

josephcsible 5y ago

Some people care more about convenience than security. And for everyone else, it doesn't have to be passwordless. You can use a regular password and a FIDO authenticator.

stavros 5y ago

The FIDO2 key is usually protected by a PIN that wipes the key after a few wrong attempts, so it combines the two itself. Besides, there's nothing that dictates how secure the key should be. You could use your hardware cryptocurrency wallet for this, which is probably much more secure and convenient than the average Yubikey (you can duplicate it with the seed phrase).

Thorrez 5y ago
You can duplicate the Yubikey or the hardware cryptocurrency wallet? Wouldn't the ability to duplicate it make it weaker?
- stavros 5y ago
  You can duplicate the wallet. It would make it weaker, but it's more secure in that they usually have hardware keypads for you to enter your PIN on.

tialaramex 5y ago

The cheapest available FIDO2 option is PIN-based so your PIN (actually any password, it doesn't need to be like a bank PIN) is the something you know, and the FIDO2 authenticator is something you have, two factors. You don't need to pick a PIN to have conventional "second factor" working but if you want a usernameless authentication you can have that by choosing a PIN. What's different compared to having a web site password? The web site knows the password, but they don't know your PIN. This means suddenly relatively weak human memorable passwords are good enough, because bad guys can't break in and steal 40 million of them in seconds or leverage them across multiple sites, the PIN is useless without the authenticator. But other FIDO2 authenticators can do fingerprints, making it something you are (a person with that fingerprint) and something you have (the authenticator) so two factors again. Usernameless (rather than passwordless) is the differentiator. You can literally have the sign-in flow be a "Sign In" button and the user does the thing (finger on reader, types in PIN, or maybe looks at camera) and they're authenticated. No step where you type in an email address or a username. This has a privacy cost because it means the authenticator knows in some sense who you are, but it is super convenient if that's what you're all about - while being much more secure than today's username + password dance.