3 ms·

Can anyone point to background reading on hanging all this stuff together (in a corporate context, so avoiding a lot of inclusion issues) things like FIDO/ubi

Can anyone point to background reading on hanging all this stuff together (in a corporate context, so avoiding a lot of inclusion issues) things like FIDO/ubi key as the basis for all authentication / identification Once we do that how do we manage SSO - I dislike the idea of having a nice hardware module and then saying "great for the next x hours / days use this static string. All attempts to make that better (timers, usage countdown timers) just seem less good than client certificatest and certificates in HSMs (simply, I am trying to design a ... company I guess )

jfrunyon 5y ago
> just seem less good than client certificatest and certificates in HSMs That's effectively what FIDO/U2F are.
- tialaramex 5y ago
  Most importantly FIDO isn't identity. It's deliberately only authentication. Facebook and GitHub both have records that allow them to authenticate that I'm still me, using FIDO Security Keys, but if they compare records they intentionally do not learn that they're authenticating the same person, even though that is in fact what they're doing. The place you'd logically put an "identifier" (and in fact it's even called ID) in protocols like WebAuthn is chosen effectively at random for each enrolment. On your phone the ID is actually just a bunch of random bits, on a cheap Security Key it's much more complicated but the effect for relying parties is that it's random.
  - jfrunyon 5y ago
    While that's true, I would argue that makes it more good than certs on an HSM, not less good as the person I replied to posited.
toomuchtodo 5y ago
Two great places to start are "Beyond Corp"/zero trust and "WebAuthN". BeyondCorp is the name brand of a zero trust model, where the perimeter security model is broken down for authorization ("authz") and authentication ("authn") everywhere. WebAuthN is using PKI infrastructure with a purposeful UX to migrate away from passwords for authentication. The implementation and management of SSO is a complex topic with a lot of nuance beyond a single HN comment, so I'd recommend you speak to someone with some IAM (identity and access management) subject matter expertise to scope your use case and provide recommendations for possible solutions. https://www.beyondcorp.com/ https://www.beyondcorp.com/ https://github.com/pomerium/awesome-zero-trust/ https://github.com/pomerium/awesome-zero-trust/ https://webauthn.guide/ https://webauthn.guide/ https://fidoalliance.org/fido2/fido2-web-authentication-webauthn/ https://fidoalliance.org/fido2/fido2-web-authentication-weba... (digital identity and IAM is a component of my work)

jfrunyon 5y ago

> just seem less good than client certificatest and certificates in HSMs That's effectively what FIDO/U2F are.

tialaramex 5y ago
Most importantly FIDO isn't identity. It's deliberately only authentication. Facebook and GitHub both have records that allow them to authenticate that I'm still me, using FIDO Security Keys, but if they compare records they intentionally do not learn that they're authenticating the same person, even though that is in fact what they're doing. The place you'd logically put an "identifier" (and in fact it's even called ID) in protocols like WebAuthn is chosen effectively at random for each enrolment. On your phone the ID is actually just a bunch of random bits, on a cheap Security Key it's much more complicated but the effect for relying parties is that it's random.
- jfrunyon 5y ago
  While that's true, I would argue that makes it more good than certs on an HSM, not less good as the person I replied to posited.

toomuchtodo 5y ago

Two great places to start are "Beyond Corp"/zero trust and "WebAuthN". BeyondCorp is the name brand of a zero trust model, where the perimeter security model is broken down for authorization ("authz") and authentication ("authn") everywhere. WebAuthN is using PKI infrastructure with a purposeful UX to migrate away from passwords for authentication. The implementation and management of SSO is a complex topic with a lot of nuance beyond a single HN comment, so I'd recommend you speak to someone with some IAM (identity and access management) subject matter expertise to scope your use case and provide recommendations for possible solutions. https://www.beyondcorp.com/ https://www.beyondcorp.com/ https://github.com/pomerium/awesome-zero-trust/ https://github.com/pomerium/awesome-zero-trust/ https://webauthn.guide/ https://webauthn.guide/ https://fidoalliance.org/fido2/fido2-web-authentication-webauthn/ https://fidoalliance.org/fido2/fido2-web-authentication-weba... (digital identity and IAM is a component of my work)