3 ms·

We do not use usernames or passwords at all. A session key is passed in the QR code. An asymmetric key pair is generated on the phone when you create an account

We do not use usernames or passwords at all. A session key is passed in the QR code. An asymmetric key pair is generated on the phone when you create an account, and the private key never leaves the phone. When you scan in the session key, the phone creates a signature using the private key which can be tested using the public key stored on the server. As to the question of two-factor authentication. The first factor is ownership of the device, the second is knowledge of the PIN, which are two different and very real factors. We really are replacing passwords and using two factor authentication, it's not just marketing.

cheald 14y ago
First off, I want to commend you guys for taking on the problem. It's an extremely hard one, and I don't intend to be disparaging. Passwords are an incredibly difficult problem to solve, and trying to solve it takes gumption. I love getting individual websites out of the authentication game; delegated auth is a much better solution when it works right, IMO. That said, what makes this quantitatively different from just using challenge-response authentication directly in the browser via a browser extension? Private keys may be password ("PIN") protected, and must be possessed by the authenticating user. In both cases, any compromise of the private key means you're owned. Exploits like the Defcon "charging station" proof-of-concept and the recently-discussed Galaxy S3 DMA hole should make people extremely wary of putting all their authentication eggs in their mobile phone's basket. People will plug anything into their charging-port-that-also-transmits-data if it gives them enough juice to get throughout the day; this is a MASSIVE social engineering problem waiting to happen if something like Clef were to become commonplace. This solves at least some of the problems of passwords (too short, often re-used), but comes with new ones (4-digit PINs are hilariously easy to crack, and can often be guessed manually if a touchscreen is involved; private key theft via malware leaves you in big trouble and you may never know it happened), and I worry that marketing it as a solution to all your password woes is a bit ambitious.
- brennenHN 14y ago
  Keeping it on the phone means that we don't need to re-generate a new one or transmit your old one when you change computers. You're absolutely right that keeping the data safe on the phone is an important challenge and it's something we're working hard on. PIN-based encryption is the solution for now, but an invisible attack could be dangerous (though the attack's you mention through the USB key require a rooted phone with permissions allowed, which is not common- privilege escalation attacks are one vector which we still have to work against) We think what we have right now is a big improvement over the status quo, and that we still have a lot of room to keep getting better. Thanks for the feedback.

cheald 14y ago

First off, I want to commend you guys for taking on the problem. It's an extremely hard one, and I don't intend to be disparaging. Passwords are an incredibly difficult problem to solve, and trying to solve it takes gumption. I love getting individual websites out of the authentication game; delegated auth is a much better solution when it works right, IMO. That said, what makes this quantitatively different from just using challenge-response authentication directly in the browser via a browser extension? Private keys may be password ("PIN") protected, and must be possessed by the authenticating user. In both cases, any compromise of the private key means you're owned. Exploits like the Defcon "charging station" proof-of-concept and the recently-discussed Galaxy S3 DMA hole should make people extremely wary of putting all their authentication eggs in their mobile phone's basket. People will plug anything into their charging-port-that-also-transmits-data if it gives them enough juice to get throughout the day; this is a MASSIVE social engineering problem waiting to happen if something like Clef were to become commonplace. This solves at least some of the problems of passwords (too short, often re-used), but comes with new ones (4-digit PINs are hilariously easy to crack, and can often be guessed manually if a touchscreen is involved; private key theft via malware leaves you in big trouble and you may never know it happened), and I worry that marketing it as a solution to all your password woes is a bit ambitious.

brennenHN 14y ago
Keeping it on the phone means that we don't need to re-generate a new one or transmit your old one when you change computers. You're absolutely right that keeping the data safe on the phone is an important challenge and it's something we're working hard on. PIN-based encryption is the solution for now, but an invisible attack could be dangerous (though the attack's you mention through the USB key require a rooted phone with permissions allowed, which is not common- privilege escalation attacks are one vector which we still have to work against) We think what we have right now is a big improvement over the status quo, and that we still have a lot of room to keep getting better. Thanks for the feedback.