4 ms·

That's me, thanks! We're glad you think we have a little more polish, but to be honest, we're really excited about any replacement to passwords making waves in

That's me, thanks! We're glad you think we have a little more polish, but to be honest, we're really excited about any replacement to passwords making waves in the tech world. Ultimately, no single group is going to be able to tackle this problem alone, so the more critical thought we have, the better off we all are. If anyone has any questions about Clef, I'd be happy to answer them, but I also don't want to distract from the discussion going on around this proposal.

Mithaldu 13y ago
One question: What's keeping you from developing a desktop client, so i can login without needing my phone around? From what i can see on your website, Clef simply uses a key stored on the phone to generate a password† that is then sent to the website to be logged in behind the scene. There shouldn't be anything stopping a user from using a program for this on any os, as long as it has the ability to obtain the nonce‡ from the website and the user-unique key. † password used here in the loose sense of being a user identificator including both the identity of the user and a secret unique to the user ‡ which is even more simple than a QR, as it's simply a barcode, albeit an animated one (the animation doesn't factor into the value at all, right?)
- jessepollak 13y ago
  Nothing is stopping us from a technical standpoint. Multiple devices is something we plan on adding, but we're being really careful about it because it increases complexity and introduces more vectors of attack. We also think that a phone is tied to a user's identity more than a computer or a tablet, so that's what we're really focusing on. Give the flow a shot and let me know what you think.
  - Mithaldu 13y ago
    As a counterpoint: It's far more likely i might be mugged for the easy cash scored by a phone that has a 500€ market price, than to have my desktop stolen. ;) One more question: How about sites which don't have clef implemented? Can i enter a URL into the clef app (or use some kind of JS scriptlet to generate a QR code on the fly) and have it generate me the password for that, so i can type it in manually? Maybe even store usernames for such sites? Right now Clef has zero use for me, as i've never even seen a website that implemented it. But something like that would at least add some use. (Also i'm sad that you didn't confirm or deny the footnotes.)
    - jessepollak 13y ago
      Right now, sites need to explicitly integrate with us. We've thought a lot about creating something that manages passwords to bridge the gap. We've actually been working on this with some community members (Joe is here somewhere) and are hoping to roll something out in the next few weeks. Sorry for not addressing the footnotes! 1. exactly, we generate a digital signature similar to SQRL 2. right. from a technical perspective, the barcode is simpler than a QR code; however, it's actually proven really important from a usability standpoint. by animating the interaction, we have more control of the user's mental model of what's going on and can provide a much more intuitive user experience.
      - Mithaldu 13y ago
        Thanks for the answers. I'll be looking forward to see it hit hackernews.† :) I've mentioned it elsewhere here, but i'd suggest you also look into https://github.com/habnabit/passacre https://github.com/habnabit/passacre , since its creators put a LOT of value in getting the crypto parts right and its main creator is very responsive online. And thanks for answering the footnotes. It is an interesting thought that users can be helped by the wiggling animation of the barcode and its inherent suggestion. (That would be worth a trip report on how you got there.) † I'd prefer to follow an rss feed, but your blog seems to be 90% marketing and only 10% user-relevant posts with no categories.
        jessepollak 13y ago
        We're working on the blog :D I'll definitely make sure to look over passacre; it seems great. And no problem on the footnotes, if you ever have any more questions don't hesitate to email me at jesse at our domain name!
        josephwegner 13y ago
        Mithaldu, just as a reference, I'm the guy working with Clef on enabling Clef on more sites.. We've got a pretty cool system, and it's getting dang close to release. Hopefully I'll have it finished soon!
  - deleted 13y ago
    [deleted]
nly 13y ago
Technical crypto spec?
- jessepollak 13y ago
  shoot me an email at jesse@getclef.com and I'll send it your way
victorf 13y ago
That looks awesome. It works everywhere that OAuth does? Can it be used with a password as a 2FA?
- jessepollak 13y ago
  Yep, you can find our docs at http://developer.getclef.com http://developer.getclef.com. Clef is actually 2FA already because it relies on both possession (the device) and knowledge (the 4-digit PIN that protects the app). We're working right now to (optionally) replace the PIN with finger print scanning, when available. Either way, the knowledge (or biometric) portion is much more about asserting ownership of the device (if it gets lost or stolen, you can deactivate online) than as part of the actual authentication process.
  - eastern 13y ago
    Possession of the device and typing a PIN into the _same_ device does not qualify as 2FA. It's not 2FA unless information flows between the user and the authenticator through two independent routes. For example, in Twitter's (and others') 2FA, information must flow between Twitter's servers and the user through the Twitter UI as well as through a GSM text message. That's 2FA.
    - jakobe 13y ago
      I am pretty sure that possesion of device and typing PIN into the same device qualifies as 2FA. A spy that watches you type your PIN can't log in without your device. At the same time, a thief that steals your device, but doesn't know your PIN, also can't log in. You need both; hence TWO FACTOR AUTHENTICATION.
      - eastern 13y ago
        The casual thief case is trivial. Surely, clef's goal includes protection against a somewhat more sophisticated adversary who is targeting you, specifically. Someone gets some malware on to the phone and gets the run of it. Records the pin, later steals the phone, or is able to replicate the entire device. This could be guarded against if the pin changed every time and was delivered through an independent channel, which is what 2FA if all about. A complete, undetected compromise of a single device or a single information channel should not be able to defeat 2FA. That doesn't appear to be the case here.
abcd_f 13y ago
You should really make a "Show HN" post. Just make sure to mention it on Twitter ;)
frezik 13y ago
How does this work for mobile sites? This looks great for using your phone to login on the desktop, but how do you use your phone to login on the phone? I'd love to push this where I work, but I don't think it will fly if it doesn't work on the mobile site.
- jessepollak 13y ago
  When you click the button, you'll just be redirected to the app where you can confirm or deny the login. If you confirm, you'll be redirected back and logged in. We thought about building a mirror contraption that would allow you to scan the code on your own phone...sarcasm send me an email, I'd love to help convince your workplace to integrate.

Mithaldu 13y ago

One question: What's keeping you from developing a desktop client, so i can login without needing my phone around? From what i can see on your website, Clef simply uses a key stored on the phone to generate a password† that is then sent to the website to be logged in behind the scene. There shouldn't be anything stopping a user from using a program for this on any os, as long as it has the ability to obtain the nonce‡ from the website and the user-unique key. † password used here in the loose sense of being a user identificator including both the identity of the user and a secret unique to the user ‡ which is even more simple than a QR, as it's simply a barcode, albeit an animated one (the animation doesn't factor into the value at all, right?)

jessepollak 13y ago
Nothing is stopping us from a technical standpoint. Multiple devices is something we plan on adding, but we're being really careful about it because it increases complexity and introduces more vectors of attack. We also think that a phone is tied to a user's identity more than a computer or a tablet, so that's what we're really focusing on. Give the flow a shot and let me know what you think.
- Mithaldu 13y ago
  As a counterpoint: It's far more likely i might be mugged for the easy cash scored by a phone that has a 500€ market price, than to have my desktop stolen. ;) One more question: How about sites which don't have clef implemented? Can i enter a URL into the clef app (or use some kind of JS scriptlet to generate a QR code on the fly) and have it generate me the password for that, so i can type it in manually? Maybe even store usernames for such sites? Right now Clef has zero use for me, as i've never even seen a website that implemented it. But something like that would at least add some use. (Also i'm sad that you didn't confirm or deny the footnotes.)
  - jessepollak 13y ago
    Right now, sites need to explicitly integrate with us. We've thought a lot about creating something that manages passwords to bridge the gap. We've actually been working on this with some community members (Joe is here somewhere) and are hoping to roll something out in the next few weeks. Sorry for not addressing the footnotes! 1. exactly, we generate a digital signature similar to SQRL 2. right. from a technical perspective, the barcode is simpler than a QR code; however, it's actually proven really important from a usability standpoint. by animating the interaction, we have more control of the user's mental model of what's going on and can provide a much more intuitive user experience.
    - Mithaldu 13y ago
      Thanks for the answers. I'll be looking forward to see it hit hackernews.† :) I've mentioned it elsewhere here, but i'd suggest you also look into https://github.com/habnabit/passacre https://github.com/habnabit/passacre , since its creators put a LOT of value in getting the crypto parts right and its main creator is very responsive online. And thanks for answering the footnotes. It is an interesting thought that users can be helped by the wiggling animation of the barcode and its inherent suggestion. (That would be worth a trip report on how you got there.) † I'd prefer to follow an rss feed, but your blog seems to be 90% marketing and only 10% user-relevant posts with no categories.
      - jessepollak 13y ago
        We're working on the blog :D I'll definitely make sure to look over passacre; it seems great. And no problem on the footnotes, if you ever have any more questions don't hesitate to email me at jesse at our domain name!
      - josephwegner 13y ago
        Mithaldu, just as a reference, I'm the guy working with Clef on enabling Clef on more sites.. We've got a pretty cool system, and it's getting dang close to release. Hopefully I'll have it finished soon!
- deleted 13y ago
  [deleted]

nly 13y ago

Technical crypto spec?

jessepollak 13y ago
shoot me an email at jesse@getclef.com and I'll send it your way

victorf 13y ago

That looks awesome. It works everywhere that OAuth does? Can it be used with a password as a 2FA?

jessepollak 13y ago
Yep, you can find our docs at http://developer.getclef.com http://developer.getclef.com. Clef is actually 2FA already because it relies on both possession (the device) and knowledge (the 4-digit PIN that protects the app). We're working right now to (optionally) replace the PIN with finger print scanning, when available. Either way, the knowledge (or biometric) portion is much more about asserting ownership of the device (if it gets lost or stolen, you can deactivate online) than as part of the actual authentication process.
- eastern 13y ago
  Possession of the device and typing a PIN into the _same_ device does not qualify as 2FA. It's not 2FA unless information flows between the user and the authenticator through two independent routes. For example, in Twitter's (and others') 2FA, information must flow between Twitter's servers and the user through the Twitter UI as well as through a GSM text message. That's 2FA.
  - jakobe 13y ago
    I am pretty sure that possesion of device and typing PIN into the same device qualifies as 2FA. A spy that watches you type your PIN can't log in without your device. At the same time, a thief that steals your device, but doesn't know your PIN, also can't log in. You need both; hence TWO FACTOR AUTHENTICATION.
    - eastern 13y ago
      The casual thief case is trivial. Surely, clef's goal includes protection against a somewhat more sophisticated adversary who is targeting you, specifically. Someone gets some malware on to the phone and gets the run of it. Records the pin, later steals the phone, or is able to replicate the entire device. This could be guarded against if the pin changed every time and was delivered through an independent channel, which is what 2FA if all about. A complete, undetected compromise of a single device or a single information channel should not be able to defeat 2FA. That doesn't appear to be the case here.

abcd_f 13y ago

You should really make a "Show HN" post. Just make sure to mention it on Twitter ;)

frezik 13y ago

How does this work for mobile sites? This looks great for using your phone to login on the desktop, but how do you use your phone to login on the phone? I'd love to push this where I work, but I don't think it will fly if it doesn't work on the mobile site.

jessepollak 13y ago
When you click the button, you'll just be redirected to the app where you can confirm or deny the login. If you confirm, you'll be redirected back and logged in. We thought about building a mirror contraption that would allow you to scan the code on your own phone...sarcasm send me an email, I'd love to help convince your workplace to integrate.