21 ms·

Apple, Google, and Microsoft commit to expanded support for FIDO standard

214 points by feross 5y ago

hawkeyedan 5y ago
Of course if you’re one of the platforms, owning some or all of other people’s login processes does happen to be a win for you.
- Ajedi32 5y ago
  WebAuthn is way better than (for example) OAuth in this regard, since the identity provider doesn't actually hold your private key; but I agree there are still potential concerns about vendor lock-in. Ideally there will be third-party credential databases (just like with password managers), and a way to export your keystore and import it into another provider. That would solve this problem.
  - Zamicol 5y ago
    Why is there a need for a third party at all?
    - Ajedi32 5y ago
      If you don't want your identity to be tied to one specific device, then you need somewhere to store your keystore that isn't on that device. Technically you don't need a third or even a first party for that; you could self-host. In practice though, the overwhelming majority of users will be using some sort of cloud storage service. A third party service in this case is likely better than first party since I don't want to lose my credentials if I decide to use a different OS or browser, and browser/OS vendors haven't been great on cross-platform compatibility for credential storage thus far.
PikachuEXE 5y ago
Probably related: https://news.ycombinator.com/item?id=31272867 https://news.ycombinator.com/item?id=31272867 This one is from fidoalliance.org
soci 5y ago
As far as I understood, FIDO pretends to change the login/password security model to one based in biometrical data like fingerprint or faceid. But, didn’t we all agree that “biometrical data is a login and not a password”? How can FIDO be more secure than different passwords per website or service?
- fuzzy2 5y ago
  That's not quite correct. FIDO is using public key cryptography. To not transmit secrets. On an authenticator, the private key could be (locally) secured using Face ID or whatever, even just using a PIN.
- jillesvangurp 5y ago
  Because there is no way to enforce those passwords are actually different or not endless variations of the same easy to guess password. Users have been doing all the wrong things with passwords ever since they were invented. I actually caught my father with an actual notebook of all the key passwords a few years ago and introduced him to Bitwarden. A burglar could have gotten access to pretty much everything with that notebook.
  - alaricus 5y ago
    Most of my accounts are unimportant and nothing would happen if they stolen or hijacked. I totally write down those passwords somewhere. The important ones are not in writing anywhere (like bank logins). There is no reason to pretent all accounts are similarly important or that the same security policies should apply.
- warkdarrior 5y ago
  Not quite right. FIDO2 uses a public/private key pair to authenticate you to a website. The private key is stored on a device you control. The device could be something like a Yubikey, which does not authenticate you, or like a mobile phone, which typically authenticates you using a biometric. In any case, the website sees a FIDO2 authentication request from you based on the private key, not on your biometric.
- 5y ago
tempfs 5y ago
* We require you to have an account with us which we will use to track you everywhere. ** We will fingerprint your phone in order to abuse it as a pseudo hardware token. *** Two of us also completely control your phone too, with the third one trying to worm our way into CPU-resident code. This ought to be fun!
- olliej 5y ago
  * I thought only one of these companies was notorious for spyware and surveillance? One has made not tracking/privacy a primary marketing angle, the other is kind of an also-ran on mobile? That said I think I'm 100% on your side of the "hooray, lets require an account with some finite set of identity providers, wcgw?" debate ** This doesn't even make sense. The entire point of the modern secure elements is that they are a "real" hardware token. I get that a bunch of android devices are penny-pinching to the extent they may be dropping actual secure elements but the seems like something google could mandate real secure elements. *** Agreed with you on <*> + A&G controlling the platforms, but curious about who is trying to get CPU-resident? I think I may have missed this latests insanity :D
armchairhacker 5y ago
The HN crowd hates passwordless sign ins but most of us actually know how to keep our passwords secure, at least relative to the average user. Non-techies have their passwords leaked and identities stolen time and time again. And get frustrated when they keep forgetting their password. Biometric passwords are incredibly useful for these people. Of course Apple, Google, Microsoft have to keep non-biometric password authentication. Otherwise a lot of people (including me) will have to simply stop using their products, not even because of privacy, just because I doubt a Linux computer without a camera or old iPhone model will work for them. Some argue that users without biometric authentication will be flagged suspicious and pressured to hand over biometric data. But honestly, I think so many people will stick to regular passwords, and more will be physically unable to use biometric passwords, so it won’t work. Overall I think having the option to use biometric authentication is a net positive. Companies want them to get user data, but non-technical people want them because (when done right) they’re a lot easier and more secure than passwords.
- alaricus 5y ago
  Your solution to insecure passwords is to hand the keys of the internet to a small number of companies? This is beyond ridiculous. Not only this creates single points of failure, it also entrenches the already existing monopolies out there. (not to mention forcing everyone to dox themselves by providing biometrics)
  - H8crilA 5y ago
    Uhm, it's the public key, and yes pretty much anyone can have my public key. That's why it's called the "public" key. The private key never leaves the dongle, much like in a hardware cryptocurrency wallet. I really fail to understand the whole confusion about FIDO, the amount of misinformation in the threads here (like in the parent comment) is staggering. It is a fantastic invention for expanding privacy& security. Maybe a lot of people confuse it with "log-in with X"?
    - microtonal 5y ago
      Uhm, it's the public key, and yes pretty much anyone can have my public key. That's why it's called the "public" key. The private key never leaves the dongle, much like in a hardware cryptocurrency wallet. This is not true for passkey, which the linked article is about. If you set up passkey on a site on e.g. your Mac, the credentials will be synced through iCloud and you can also use your iPhone or iPad as an authenticator. This raises the questions of the grandparent comment: 1. What if a FAANG company nukes the account that you use for credential syncing? 2. What if a FAANG company has access to your private keys? In the case of Apple, I think (2) is covered. They use iCloud Keychain, which is already end-to-end encrypted. But I am not sure about other companies (Microsoft, Google), does the standard require end-to-end encryption of key material?
jillesvangurp 5y ago
Historically, it's bad news when big corporations get involved with standardizing anything security related. It generally means it's going to be complicated, convoluted, and hopelessly tied to proprietary stuff you can only get from these big corporations. Interoperability is almost guaranteed to not be a thing. Just look at how the big FANG companies managed to adopt OpenID and yet made it so that it can't be used to authenticate users between them. They never liked identity federation because it would mean not controlling the user's identity completely. Google loves identity standards as long as Google is the one and only party doing the authenticating. Same with Microsoft. Apple for sure is not going to let anyone do anything that matters on their platforms. That's why people still use simple email/password as a way to authenticate. It's just too much of a pain to implement anything else for independent web developers. Take fido/webauthn for example, which FIDO standardized and which then got restandardized/reimagined by the W3C as webauthn. That stuff was delivered years ago in a half-assed way. Pretty much the only widely used thing in this space is yubikey. The only people I know that actually use that or know about it are developers. Nobody ever did the obvious thing of hooking this stuff up to biometric readers deployed by the billions in the form of phones using either photo recognition or finger print readers, laptop finger print readers, etc. Such an obvious thing to do. Never happened. What are Google and Apple waiting for? What's the holdup? Do they lack the imagination or is there another reason that perfectly sane proposals from engineers they employ to do something like that consistently get shot down by management? Which is probably exactly what happened. Over and over again. They fundamentally don't like security standards that reduce their grip on user identity and "owning" that.
- microtonal 5y ago
  Nobody ever did the obvious thing of hooking this stuff up to biometric readers deployed by the billions in the form of phones using either photo recognition or finger print readers, laptop finger print readers, etc. Such an obvious thing to do. Never happened. What are Google and Apple waiting for? On Apple platforms, you can use webauthn with Touch ID and Face ID in Safari. For some reason it doesn't work on all sites (probably because they implement the older FIDO standard, not webauthn?). These passkey FIDO credentials mentioned on the linked post are also activated with Touch ID on macOS. I have passkey configured on one or two websites and I authanticate with Touch ID. (And still a password, but it's the first step.)
octoberfranklin 5y ago
Friendly reminder that device attestation is part of FIDO and webauthn. It isn't enough that both your device and the website speak the protocol. The website gets to cryptographically verify that your device is not under owner control. If you want a FIDO/webauthn device that lets you have the key material (like HOTP does), you're out of luck. No owner-controlled devices allowed.
- dane-pgp 5y ago
  That's an important observation. We're going to go from "Log in with your Apple, Google, or Microsoft account" to "Log in with your Apple, Google, or Microsoft hardware".
- nonrandomstring 5y ago
  > No owner-controlled devices allowed [1]. This is actually a key point with respect to digital rights. When you analyse the debacle that put Jordan Peterson in the spotlight it was not really about gender pronouns as such, but about compelled speech. Compelled anything is a problem. Compulsion removes responsibility. For example, I am currently not compelled to own a car, so I can make the choice to help the climate by walking. I am not compelled to own a television, as in Orwell's 1984, so I can select my own entertainment and news. What does this have to do with cybersecurity? Ownership and control are central to the psychological motivations that allow security to work at all. Let's ask the question, would you allow a stranger to dump their possessions in your lounge for a few weeks? No. You'd at least charge them rent for storage. Stuff that takes up your space, that you cannot use, and are responsible for is an encumbrance. Now let's say that a government or some cabal of tech-monopolists, begin forcing you to shoulder encumbrances that you must install in your home, or walk around carrying - physical devices that you do not own in any real sense. This is an imposition. An analogy that springs to mind is the US constitutional third amendment on the quartering of soldiers in private homes without the owner's consent [2]. With secure enclaves we are seeing a drift toward devices as both an encumbrance and imposition. Hardware one is compelled to use and take responsibility for, such as repair or charging batteries, which serves the interests of others (to track and identify you) is a cost without benefit, and has no future. Unless you physically attach it, like a prison tag, you can no more compel a person to carry an object than you can compel their speech. Unless the owner acts by volition, and chooses to take responsibility for an object in their own self-interest, various forms of sabotage are inevitable. I've seen this where workplaces have tried to push workers into carrying a "company smartphone". It gets "lost". It gets "broken". People lock them and then "forget" the password. Security solutions need the consent and cooperation of both subjects. Otherwise they are not "security", but simply means of control. At the very least we should stop dignifying them with the word "security". [1] "Owner-controlled" is already a tautology. Ownership implies control (and freedom to dispose of) and vice versa. Anything else is simply "in my possession" or "upon my person" as legal-people would say. [2] I never understood this seemingly ridiculous language about garrison of soldiers etc, but it increasingly makes sense to me as a catch all for any agent placed on my property. Hence I think that secure enclaves touch on 3rd amendment rights.
james_smith_007 5y ago
Sorry folks, I need to test hyperlinks, so here is a link to the [Apple website](https://apple.com/ https://apple.com/)
alaricus 5y ago
It is a terrible idea to let Microsoft, Google and Apple to redesign a passwordless future. They don't have a spotless record.
- willis936 5y ago
  Is there anyone else that can?
  - anjel 5y ago
    The EFF
    - sircastor 5y ago
      While there are a lot of smart people at the EFF, it's an organization primarily focused at defending legal rights. While we definitely want to consider the legal rights of an individual while coming up with a passwordless protocol, I put this work to technologists, not lawyers, first.
  - alaricus 5y ago
    literally anyone else.
forgotmypw17 5y ago
If you think this all sounds terrible, it's time to start building your alternative.
- sph 5y ago
  There already is, at least for the techies: YubiKey + OTP with your password manager. Non techies are SOL as usual. Proper password education apparently is too hard, so big tech is frothing at the mouth to get total control over your password management so you can't ever leave.
  - JustFinishedBSG 5y ago
    OTPs are terrible and can be MITMed. Meanwhile the non-OTP part of Yubikeys is exactly what the article is talking about.
    - sph 5y ago
      How do you MITM an OTP code? I haven't been talking about SMS 2FA.
      - tzs 5y ago
        The same way you MITM a user name or a password. You come to my phishing site thinking you are going to your bank site. You enter account and password. I enter that on the bank site. The bank site asks for your OTP code. My site then asks for your OTP code, which you enter because you think you are talking to the bank site. My site enters the OTP code on the bank site.
        sph 5y ago
        How is that an OTP flaw? You've just described phishing, which 1FA, 2FA, OTP or even FIDO/Yubikey can't directly protect you from.
        5y ago
dandanua 5y ago
FIDO standard by itself is a great technology, very secure and very well-thought. You can login to a service only if you possess a hardware token, which can't be cloned. Also, it automatically saves you from phishing sites. But I share the fear of others that integration of this standard, curated by the top management of mega corporations, will lead to diminishing of its advantages. FIDO keys give power to users, which is a threat to power hungry monster corporations.
- alaricus 5y ago
  I don't see what problem FIDO is solving. As a consumer it's not solving any of my problems. However, it is a great mechanism for vendor lock-in and for requiring Google/Apple/Microsoft approval for accessing large sections of the internet.
Hilbert1114 5y ago
Hilbert1114 5y ago
- lloydatkinson 5y ago
  What's this, bots posting to HN? Three identical comments, from two different accounts.
  - cgio 5y ago
    Maybe an artistic statement on the futility of an online identity.
  - ghlarp 5y ago
  - jacquesm 5y ago
    Sometimes people steal comments that have good content and repost them to harvest karma.
  - dang 5y ago
    Spammer tricks.
cute_boi 5y ago
Good news for US government!!!. They can now track everyone easily :)
- russelg 5y ago
  And before?
hexo 5y ago
Thanks, I already hate it.
867-5309 5y ago
(Fast IDentity Online)
nuker 5y ago
What about multiple accounts on same device?
dancemethis 5y ago
Why use such a good Frank Zappa reference for such a prone-to-be-bad thing...
jpm_sd 5y ago
Let's do a mini Ask HN here in the comments. Is it a good idea for me to buy Yubikeys or Titan keys for my personal Google account? My wife's? My childrens'? Will that make it less likely, or more likely, that I eventually get arbitrarily locked out? These are accounts that we use on Windows PCs, Chromebooks, and Android phones. The keys would never leave the house. I think. I know the phones sorta fulfill this function already, but lost phone = big trouble, right?
- alaricus 5y ago
  I lost my phone on a business trip. It was a nightmare. Don't use your phone as a 2FA for everything. It creates a devastating single point of failure.
  - stevemk14ebr 5y ago
    how is a physical yubikey any different from a loss POV?
    - alaricus 5y ago
      It's easier to keep multiple yubikeys than multiple phones. Also Google relying on Google for anything important/critical is a bad idea. The internet is full of people complaining that Google deactivated their account for no apparent reason.
    - philistine 5y ago
      There’s no difference, insofar as you might lose the Yubikey and not your phone. I guess I’d recommend enrolling both your phone and a Yubikey as a 2FA.
    - jagger27 5y ago
      It's not, and it's worse since there isn't a PIN or biometrics keeping it locked. Keep one in a safe for emergencies (like losing a phone) that can also unlock your accounts.
- jagger27 5y ago
PedroBatista 5y ago
".. will be available to consumers across leading devices and platforms" Did someone said "Best of Breed™"? Also good to know everything that isn't FIDO is already considered "legacy" by these techno Gods.
eulers_secret 5y ago
Is anyone working on a FOSS software solution for a FIDO2 authenticator? I know of Authy (which isn’t FIDO2, iirc) and some other projects, but none implement the passwordless login. I have some time and the interest. I know attestation is an (optional?) part of FIDO2, and an OSS app will probably never be “verified”. Still, having a pure-software option/reference would be a boon. Since this is extremely important for the future of the free web, I’m absolutely willing to help any project with these goals.
- Zamicol 4y ago
  Now that there's less eyeballs on this. Here's our open source JWT alternative: https://github.com/Cyphrme/Coze https://github.com/Cyphrme/Coze. We've got a roadmap in using that to build alternatives to FIDO. Please feel free to message me with questions or anything else and I will detail our plans. Before competing against FIDO, the libraries need to be far more ergonomic. Coze is a good start. > I’m absolutely willing to help any project with these goals. We would love your help.
- Zamicol 4y ago
  Hello, it's me again. We just made public the java script implementation of Coze. https://github.com/Cyphrme/cozejs https://github.com/Cyphrme/cozejs.
- Zamicol 5y ago
  Is there any place that I can PM you?
  - eulers_secret 5y ago
    Not necessarily PM (yet), but I have added my e-mail and github to my profile here on HN. To make it easy, my e-mail is eulers.secret at google's very popular email service, for now.
    - Zamicol 5y ago
      I didn't hear back from you. Any thoughts on the project?
egberts1 5y ago
As long as those three are devising standards, there will be no privacy, pure and simple.
andyjohnson0 5y ago
Meanwhile here in 2022 I still can't use my classic blue Yubikey to secure my Microsoft account, even though it works fine with Github/Google/Fastmail/etc. I don't want passwordless, I just want 2FA that isn't linked to my phone. (If anyone knows why I get a "this security key can't be used" error when I try to add my Yubikeys to my msft account then I'd be interested to know. My theory is that the browser is trying to store a secret on the key but the key is immutable, but its very hard to tell.)
- judge2020 5y ago
  > My theory is that the browser is trying to store a secret on the key but the key is immutable, but its very hard to tell.) Pretty much. Microsoft requires Webauthn resident key[0], which allows the authenticator to authenticate passwordlessly, including without a username or email[1]. This means the authenticator has to store the relying party ID (domain/hostname) and associate it with a new key, so that it won't sign login requests to a different website. 0: https://www.w3.org/TR/webauthn-2/#enumdef-residentkeyrequirement https://www.w3.org/TR/webauthn-2/#enumdef-residentkeyrequire... 1: https://support.microsoft.com/en-us/windows/sign-in-to-your-microsoft-account-with-windows-hello-or-a-security-key-800a8c01-6b61-49f5-0660-c2159bea4d84#:~:text=How%20to%20sign%20in%20with%20a%20security%20key https://support.microsoft.com/en-us/windows/sign-in-to-your-...
  - andyjohnson0 5y ago
    Thank you for taking time to explain the problem.
sharno 5y ago
Why don't we have 2FA apps as browser extensions first to help have multiple devices with the same 2FA code as a fallback option?
iampivot 5y ago
One way to view this is that they are formalising how password managers should work; integrated in the browser / device, and use public key certificates for logins instead of username / password. There are of course side issues such as big vs small players, privacy, security etc, but that's not the major thing about this.

214 points by feross 5y ago

Of course if you’re one of the platforms, owning some or all of other people’s login processes does happen to be a win for you.

Ajedi32 5y ago
WebAuthn is way better than (for example) OAuth in this regard, since the identity provider doesn't actually hold your private key; but I agree there are still potential concerns about vendor lock-in. Ideally there will be third-party credential databases (just like with password managers), and a way to export your keystore and import it into another provider. That would solve this problem.
- Zamicol 5y ago
  Why is there a need for a third party at all?
  - Ajedi32 5y ago
    If you don't want your identity to be tied to one specific device, then you need somewhere to store your keystore that isn't on that device. Technically you don't need a third or even a first party for that; you could self-host. In practice though, the overwhelming majority of users will be using some sort of cloud storage service. A third party service in this case is likely better than first party since I don't want to lose my credentials if I decide to use a different OS or browser, and browser/OS vendors haven't been great on cross-platform compatibility for credential storage thus far.

PikachuEXE 5y ago

Probably related: https://news.ycombinator.com/item?id=31272867 https://news.ycombinator.com/item?id=31272867 This one is from fidoalliance.org

soci 5y ago

As far as I understood, FIDO pretends to change the login/password security model to one based in biometrical data like fingerprint or faceid. But, didn’t we all agree that “biometrical data is a login and not a password”? How can FIDO be more secure than different passwords per website or service?

fuzzy2 5y ago
That's not quite correct. FIDO is using public key cryptography. To not transmit secrets. On an authenticator, the private key could be (locally) secured using Face ID or whatever, even just using a PIN.
jillesvangurp 5y ago
Because there is no way to enforce those passwords are actually different or not endless variations of the same easy to guess password. Users have been doing all the wrong things with passwords ever since they were invented. I actually caught my father with an actual notebook of all the key passwords a few years ago and introduced him to Bitwarden. A burglar could have gotten access to pretty much everything with that notebook.
- alaricus 5y ago
  Most of my accounts are unimportant and nothing would happen if they stolen or hijacked. I totally write down those passwords somewhere. The important ones are not in writing anywhere (like bank logins). There is no reason to pretent all accounts are similarly important or that the same security policies should apply.
warkdarrior 5y ago
Not quite right. FIDO2 uses a public/private key pair to authenticate you to a website. The private key is stored on a device you control. The device could be something like a Yubikey, which does not authenticate you, or like a mobile phone, which typically authenticates you using a biometric. In any case, the website sees a FIDO2 authentication request from you based on the private key, not on your biometric.
5y ago

tempfs 5y ago

* We require you to have an account with us which we will use to track you everywhere. ** We will fingerprint your phone in order to abuse it as a pseudo hardware token. *** Two of us also completely control your phone too, with the third one trying to worm our way into CPU-resident code. This ought to be fun!

olliej 5y ago
* I thought only one of these companies was notorious for spyware and surveillance? One has made not tracking/privacy a primary marketing angle, the other is kind of an also-ran on mobile? That said I think I'm 100% on your side of the "hooray, lets require an account with some finite set of identity providers, wcgw?" debate ** This doesn't even make sense. The entire point of the modern secure elements is that they are a "real" hardware token. I get that a bunch of android devices are penny-pinching to the extent they may be dropping actual secure elements but the seems like something google could mandate real secure elements. *** Agreed with you on <*> + A&G controlling the platforms, but curious about who is trying to get CPU-resident? I think I may have missed this latests insanity :D

armchairhacker 5y ago

The HN crowd hates passwordless sign ins but most of us actually know how to keep our passwords secure, at least relative to the average user. Non-techies have their passwords leaked and identities stolen time and time again. And get frustrated when they keep forgetting their password. Biometric passwords are incredibly useful for these people. Of course Apple, Google, Microsoft have to keep non-biometric password authentication. Otherwise a lot of people (including me) will have to simply stop using their products, not even because of privacy, just because I doubt a Linux computer without a camera or old iPhone model will work for them. Some argue that users without biometric authentication will be flagged suspicious and pressured to hand over biometric data. But honestly, I think so many people will stick to regular passwords, and more will be physically unable to use biometric passwords, so it won’t work. Overall I think having the option to use biometric authentication is a net positive. Companies want them to get user data, but non-technical people want them because (when done right) they’re a lot easier and more secure than passwords.

alaricus 5y ago
Your solution to insecure passwords is to hand the keys of the internet to a small number of companies? This is beyond ridiculous. Not only this creates single points of failure, it also entrenches the already existing monopolies out there. (not to mention forcing everyone to dox themselves by providing biometrics)
- H8crilA 5y ago
  Uhm, it's the public key, and yes pretty much anyone can have my public key. That's why it's called the "public" key. The private key never leaves the dongle, much like in a hardware cryptocurrency wallet. I really fail to understand the whole confusion about FIDO, the amount of misinformation in the threads here (like in the parent comment) is staggering. It is a fantastic invention for expanding privacy& security. Maybe a lot of people confuse it with "log-in with X"?
  - microtonal 5y ago
    Uhm, it's the public key, and yes pretty much anyone can have my public key. That's why it's called the "public" key. The private key never leaves the dongle, much like in a hardware cryptocurrency wallet. This is not true for passkey, which the linked article is about. If you set up passkey on a site on e.g. your Mac, the credentials will be synced through iCloud and you can also use your iPhone or iPad as an authenticator. This raises the questions of the grandparent comment: 1. What if a FAANG company nukes the account that you use for credential syncing? 2. What if a FAANG company has access to your private keys? In the case of Apple, I think (2) is covered. They use iCloud Keychain, which is already end-to-end encrypted. But I am not sure about other companies (Microsoft, Google), does the standard require end-to-end encryption of key material?

jillesvangurp 5y ago

Historically, it's bad news when big corporations get involved with standardizing anything security related. It generally means it's going to be complicated, convoluted, and hopelessly tied to proprietary stuff you can only get from these big corporations. Interoperability is almost guaranteed to not be a thing. Just look at how the big FANG companies managed to adopt OpenID and yet made it so that it can't be used to authenticate users between them. They never liked identity federation because it would mean not controlling the user's identity completely. Google loves identity standards as long as Google is the one and only party doing the authenticating. Same with Microsoft. Apple for sure is not going to let anyone do anything that matters on their platforms. That's why people still use simple email/password as a way to authenticate. It's just too much of a pain to implement anything else for independent web developers. Take fido/webauthn for example, which FIDO standardized and which then got restandardized/reimagined by the W3C as webauthn. That stuff was delivered years ago in a half-assed way. Pretty much the only widely used thing in this space is yubikey. The only people I know that actually use that or know about it are developers. Nobody ever did the obvious thing of hooking this stuff up to biometric readers deployed by the billions in the form of phones using either photo recognition or finger print readers, laptop finger print readers, etc. Such an obvious thing to do. Never happened. What are Google and Apple waiting for? What's the holdup? Do they lack the imagination or is there another reason that perfectly sane proposals from engineers they employ to do something like that consistently get shot down by management? Which is probably exactly what happened. Over and over again. They fundamentally don't like security standards that reduce their grip on user identity and "owning" that.

microtonal 5y ago
Nobody ever did the obvious thing of hooking this stuff up to biometric readers deployed by the billions in the form of phones using either photo recognition or finger print readers, laptop finger print readers, etc. Such an obvious thing to do. Never happened. What are Google and Apple waiting for? On Apple platforms, you can use webauthn with Touch ID and Face ID in Safari. For some reason it doesn't work on all sites (probably because they implement the older FIDO standard, not webauthn?). These passkey FIDO credentials mentioned on the linked post are also activated with Touch ID on macOS. I have passkey configured on one or two websites and I authanticate with Touch ID. (And still a password, but it's the first step.)

octoberfranklin 5y ago

Friendly reminder that device attestation is part of FIDO and webauthn. It isn't enough that both your device and the website speak the protocol. The website gets to cryptographically verify that your device is not under owner control. If you want a FIDO/webauthn device that lets you have the key material (like HOTP does), you're out of luck. No owner-controlled devices allowed.

dane-pgp 5y ago
That's an important observation. We're going to go from "Log in with your Apple, Google, or Microsoft account" to "Log in with your Apple, Google, or Microsoft hardware".
nonrandomstring 5y ago
> No owner-controlled devices allowed [1]. This is actually a key point with respect to digital rights. When you analyse the debacle that put Jordan Peterson in the spotlight it was not really about gender pronouns as such, but about compelled speech. Compelled anything is a problem. Compulsion removes responsibility. For example, I am currently not compelled to own a car, so I can make the choice to help the climate by walking. I am not compelled to own a television, as in Orwell's 1984, so I can select my own entertainment and news. What does this have to do with cybersecurity? Ownership and control are central to the psychological motivations that allow security to work at all. Let's ask the question, would you allow a stranger to dump their possessions in your lounge for a few weeks? No. You'd at least charge them rent for storage. Stuff that takes up your space, that you cannot use, and are responsible for is an encumbrance. Now let's say that a government or some cabal of tech-monopolists, begin forcing you to shoulder encumbrances that you must install in your home, or walk around carrying - physical devices that you do not own in any real sense. This is an imposition. An analogy that springs to mind is the US constitutional third amendment on the quartering of soldiers in private homes without the owner's consent [2]. With secure enclaves we are seeing a drift toward devices as both an encumbrance and imposition. Hardware one is compelled to use and take responsibility for, such as repair or charging batteries, which serves the interests of others (to track and identify you) is a cost without benefit, and has no future. Unless you physically attach it, like a prison tag, you can no more compel a person to carry an object than you can compel their speech. Unless the owner acts by volition, and chooses to take responsibility for an object in their own self-interest, various forms of sabotage are inevitable. I've seen this where workplaces have tried to push workers into carrying a "company smartphone". It gets "lost". It gets "broken". People lock them and then "forget" the password. Security solutions need the consent and cooperation of both subjects. Otherwise they are not "security", but simply means of control. At the very least we should stop dignifying them with the word "security". [1] "Owner-controlled" is already a tautology. Ownership implies control (and freedom to dispose of) and vice versa. Anything else is simply "in my possession" or "upon my person" as legal-people would say. [2] I never understood this seemingly ridiculous language about garrison of soldiers etc, but it increasingly makes sense to me as a catch all for any agent placed on my property. Hence I think that secure enclaves touch on 3rd amendment rights.

james_smith_007 5y ago

Sorry folks, I need to test hyperlinks, so here is a link to the [Apple website](https://apple.com/ https://apple.com/)

alaricus 5y ago

It is a terrible idea to let Microsoft, Google and Apple to redesign a passwordless future. They don't have a spotless record.

willis936 5y ago
Is there anyone else that can?
- anjel 5y ago
  The EFF
  - sircastor 5y ago
    While there are a lot of smart people at the EFF, it's an organization primarily focused at defending legal rights. While we definitely want to consider the legal rights of an individual while coming up with a passwordless protocol, I put this work to technologists, not lawyers, first.
- alaricus 5y ago
  literally anyone else.

forgotmypw17 5y ago

If you think this all sounds terrible, it's time to start building your alternative.

sph 5y ago
There already is, at least for the techies: YubiKey + OTP with your password manager. Non techies are SOL as usual. Proper password education apparently is too hard, so big tech is frothing at the mouth to get total control over your password management so you can't ever leave.
- JustFinishedBSG 5y ago
  OTPs are terrible and can be MITMed. Meanwhile the non-OTP part of Yubikeys is exactly what the article is talking about.
  - sph 5y ago
    How do you MITM an OTP code? I haven't been talking about SMS 2FA.
    - tzs 5y ago
      The same way you MITM a user name or a password. You come to my phishing site thinking you are going to your bank site. You enter account and password. I enter that on the bank site. The bank site asks for your OTP code. My site then asks for your OTP code, which you enter because you think you are talking to the bank site. My site enters the OTP code on the bank site.
      - sph 5y ago
        How is that an OTP flaw? You've just described phishing, which 1FA, 2FA, OTP or even FIDO/Yubikey can't directly protect you from.
        5y ago

dandanua 5y ago

FIDO standard by itself is a great technology, very secure and very well-thought. You can login to a service only if you possess a hardware token, which can't be cloned. Also, it automatically saves you from phishing sites. But I share the fear of others that integration of this standard, curated by the top management of mega corporations, will lead to diminishing of its advantages. FIDO keys give power to users, which is a threat to power hungry monster corporations.

alaricus 5y ago
I don't see what problem FIDO is solving. As a consumer it's not solving any of my problems. However, it is a great mechanism for vendor lock-in and for requiring Google/Apple/Microsoft approval for accessing large sections of the internet.

Hilbert1114 5y ago

lloydatkinson 5y ago
What's this, bots posting to HN? Three identical comments, from two different accounts.
- cgio 5y ago
  Maybe an artistic statement on the futility of an online identity.
- ghlarp 5y ago
- jacquesm 5y ago
  Sometimes people steal comments that have good content and repost them to harvest karma.
- dang 5y ago
  Spammer tricks.

cute_boi 5y ago

Good news for US government!!!. They can now track everyone easily :)

russelg 5y ago
And before?

hexo 5y ago

Thanks, I already hate it.

867-5309 5y ago

(Fast IDentity Online)

nuker 5y ago

What about multiple accounts on same device?

dancemethis 5y ago

Why use such a good Frank Zappa reference for such a prone-to-be-bad thing...

jpm_sd 5y ago

Let's do a mini Ask HN here in the comments. Is it a good idea for me to buy Yubikeys or Titan keys for my personal Google account? My wife's? My childrens'? Will that make it less likely, or more likely, that I eventually get arbitrarily locked out? These are accounts that we use on Windows PCs, Chromebooks, and Android phones. The keys would never leave the house. I think. I know the phones sorta fulfill this function already, but lost phone = big trouble, right?

alaricus 5y ago
I lost my phone on a business trip. It was a nightmare. Don't use your phone as a 2FA for everything. It creates a devastating single point of failure.
- stevemk14ebr 5y ago
  how is a physical yubikey any different from a loss POV?
  - alaricus 5y ago
    It's easier to keep multiple yubikeys than multiple phones. Also Google relying on Google for anything important/critical is a bad idea. The internet is full of people complaining that Google deactivated their account for no apparent reason.
  - philistine 5y ago
    There’s no difference, insofar as you might lose the Yubikey and not your phone. I guess I’d recommend enrolling both your phone and a Yubikey as a 2FA.
  - jagger27 5y ago
    It's not, and it's worse since there isn't a PIN or biometrics keeping it locked. Keep one in a safe for emergencies (like losing a phone) that can also unlock your accounts.
jagger27 5y ago

PedroBatista 5y ago

".. will be available to consumers across leading devices and platforms" Did someone said "Best of Breed™"? Also good to know everything that isn't FIDO is already considered "legacy" by these techno Gods.

eulers_secret 5y ago

Is anyone working on a FOSS software solution for a FIDO2 authenticator? I know of Authy (which isn’t FIDO2, iirc) and some other projects, but none implement the passwordless login. I have some time and the interest. I know attestation is an (optional?) part of FIDO2, and an OSS app will probably never be “verified”. Still, having a pure-software option/reference would be a boon. Since this is extremely important for the future of the free web, I’m absolutely willing to help any project with these goals.

Zamicol 4y ago
Now that there's less eyeballs on this. Here's our open source JWT alternative: https://github.com/Cyphrme/Coze https://github.com/Cyphrme/Coze. We've got a roadmap in using that to build alternatives to FIDO. Please feel free to message me with questions or anything else and I will detail our plans. Before competing against FIDO, the libraries need to be far more ergonomic. Coze is a good start. > I’m absolutely willing to help any project with these goals. We would love your help.
Zamicol 4y ago
Hello, it's me again. We just made public the java script implementation of Coze. https://github.com/Cyphrme/cozejs https://github.com/Cyphrme/cozejs.
Zamicol 5y ago
Is there any place that I can PM you?
- eulers_secret 5y ago
  Not necessarily PM (yet), but I have added my e-mail and github to my profile here on HN. To make it easy, my e-mail is eulers.secret at google's very popular email service, for now.
  - Zamicol 5y ago
    I didn't hear back from you. Any thoughts on the project?

egberts1 5y ago

As long as those three are devising standards, there will be no privacy, pure and simple.

andyjohnson0 5y ago

Meanwhile here in 2022 I still can't use my classic blue Yubikey to secure my Microsoft account, even though it works fine with Github/Google/Fastmail/etc. I don't want passwordless, I just want 2FA that isn't linked to my phone. (If anyone knows why I get a "this security key can't be used" error when I try to add my Yubikeys to my msft account then I'd be interested to know. My theory is that the browser is trying to store a secret on the key but the key is immutable, but its very hard to tell.)

judge2020 5y ago
> My theory is that the browser is trying to store a secret on the key but the key is immutable, but its very hard to tell.) Pretty much. Microsoft requires Webauthn resident key[0], which allows the authenticator to authenticate passwordlessly, including without a username or email[1]. This means the authenticator has to store the relying party ID (domain/hostname) and associate it with a new key, so that it won't sign login requests to a different website. 0: https://www.w3.org/TR/webauthn-2/#enumdef-residentkeyrequirement https://www.w3.org/TR/webauthn-2/#enumdef-residentkeyrequire... 1: https://support.microsoft.com/en-us/windows/sign-in-to-your-microsoft-account-with-windows-hello-or-a-security-key-800a8c01-6b61-49f5-0660-c2159bea4d84#:~:text=How%20to%20sign%20in%20with%20a%20security%20key https://support.microsoft.com/en-us/windows/sign-in-to-your-...
- andyjohnson0 5y ago
  Thank you for taking time to explain the problem.

sharno 5y ago

Why don't we have 2FA apps as browser extensions first to help have multiple devices with the same 2FA code as a fallback option?

iampivot 5y ago

One way to view this is that they are formalising how password managers should work; integrated in the browser / device, and use public key certificates for logins instead of username / password. There are of course side issues such as big vs small players, privacy, security etc, but that's not the major thing about this.