7 ms·

So for this to work, the website has to be on board, the user has to be on board, the user has to have their phone present, the user's phone has to be in workin

So for this to work, the website has to be on board, the user has to be on board, the user has to have their phone present, the user's phone has to be in working order (camera working, network working), the clef server has to be running correctly, and the software has to be working correctly on [the user's phone, the website's frontend, the website's backend, and the Clef servers]. Current process: click login box, type, tab, type, enter. With clef: click cleff box, find phone, unlock phone, launch clef app, hold in front of screen, wait. All of this to create an "advantage" of not having to remember a password at the cost of probably 15-30 seconds longer login time and a login process with more brittleness, as many steps, and more complicated steps. Is there a big advantage I'm missing, because right now this looks worse in almost every way and dubiously better in only one. I say dubious because I wouldn't trust the system to work, so id still memorize backup passwords. But some people have higher trust and thus would get the benefit. The animation is cool though.

staticshock 13y ago
> the user's phone has to be in working order (camera working, network working) battery not dead...
- johnsocs 13y ago
  Just about all the widely public 2 factor schemes out there leverage cell phones via SMS or another route, they all require your device to be some battery life.
  - pipeep 13y ago
    I bought a yubikey, but hardly any web services support it.
    - mutemule 13y ago
      Actually, any website that supports Google 2FA also happens to support your Yubikey Neo, assuming you have a Neo. Step 1: Install the Yubico Authenticator from the Play Store. Step 2: Install the OATH applet. Linux instructions are at http://forum.yubico.com/viewtopic.php?f=26&t=1159 http://forum.yubico.com/viewtopic.php?f=26&t=1159, but there are OS X instructions kicking around on the forums as well. Step 3: Wherever you would normally use Google Authenticator, use the Yubico Authenticator instead. You now have proper two-factor authentication. EDIT: Wrong link...
      - pipeep 13y ago
        Damn. I bought the standard.
        mutemule 13y ago
        Well, sit tight. There's a new version of the Neo that supports U2F (https://sites.google.com/site/oauthgoog/gnubby https://sites.google.com/site/oauthgoog/gnubby) coming out Real Soon Now (https://www.yubico.com/products/yubikey-hardware/yubikey-neo/yubikey-neo-u2f/ https://www.yubico.com/products/yubikey-hardware/yubikey-neo...) -- sometime in 2014 is all I've heard.
  - deleted 13y ago
    [deleted]
  - subsection1h 13y ago
    None of the 2FA services that I use require me to use an actual phone. The phone number that I associate with 2FA services is set up to forward SMS messages to an email account that is dedicated to receiving only SMS messages from 2FA services.
    - arjie 13y ago
      How is that two factor any more? You've broken the security model. You now have only a knowledge factor, no possession factor. The whole point of two-factor authentication is to make it so you need two things of two different types. You reduced this problem to having two passwords (two things of the same type).
      - drdaeman 13y ago
        Do you mean there is any significant difference between an email and SMS accounts?
        gcommer 13y ago
        I think that depends on the adversary. Against the NSA there might not be a major difference (depending on your email provider), but SMS is probably more secure in the typical case, as it is much more common for your run of the mill script kiddie/phisher/etc to get access to someone's email than their phone.
        drdaeman 13y ago
        At least some mobile operators have "SMS archive" option, that can be enabled and accessible from self-service site. It requires some time to set up, but attacker with sufficient time, knowledge and patience may pull the attack relatively easily. No need for NSA-grade adversary. (Even worse, until relatively recently they had used numeric passwords (those had to be set from a phone, using DTMF tone dial). This had changed only 3 or maybe 4 years ago. Wonder whenever that change was 2FA-related. :) ) So I'm uncertain whenever SMS is more secure.
  - aqme28 13y ago
    But then you get added security. This isn't two factor, this is one factor.
    - pliu 13y ago
      You have to enter a 4 digit PIN number into the app. It's still two factor, since you have to auth to the app to get the one time pass.
- zyxley 13y ago
  Also, if you want to log into the site on your phone, you need a second phone.
  - habosa 13y ago
    Pretty sure they have an app to solve that.
habosa 13y ago
There are a few advantages you're not mentioning: 1) This is two factor authentication. I don't trust any of my really "essential" accounts like GMail or Coinbase without two factor. And all of the problems you mentioned around needing your phone are common to nearly all two-factor auth solutions. 2) More secure password. You won't be susceptible to many brute-force based hacking methods because your password won't be in any rainbow tables or anything like that.
- icebraining 13y ago
  This is not two factor authentication, since it eliminates one of the factors (the password). Gmail's doesn't, so that is two factor auth.
  - habosa 13y ago
    Clef app has a PIN. And my phone has a lock screen password.
    - icebraining 13y ago
      No, because you're not authenticating to the service. Think about what would happen if your phone gets owned by some malware that escalates to root. It can simply log the PIN, extract the key and then login as it wishes. That's because the phone is the single factor for the service. Compare that with the auth against, say, Gmail, where even if a malware were to own the Authenticator, it still couldn't login as you, since your password goes directly to the service.
- PakG1 13y ago
  I finally installed Google Authenticator on my phone yesterday because Digital Ocean utilizes it. It's great. Like RSA stuff, only more convenient. And hopefully given the response of Google's security people to NSA activity, more secure than the RSA stuff. This thing basically looks like a more automated version of Google Authenticator. Cool, but meh, would it really change my life? But maybe it would make a difference for the same market that feels like the iPhone 5s's fingerprint scanner is way more convenient than previous security mechanisms on the iPhone and so can never go back. I dunno.
ivanca 13y ago
Pretty much, yeah; this is condemned to fail and they should pivot ASAP.
deleted 13y ago
[deleted]
huhtenberg 13y ago
Yes, yes, except this allows you to log in from an untrusted computer.
- thedufer 13y ago
  How? An untrusted computer can just steal your session token.
AndrewKemendo 13y ago
This is wrong though because unless you have the same password for everything (you shouldn't) the process isn't the single serving: click login box, type, tab, type, enter It is moreso: click login box, type one of passwords 1-10, tab, type, enter Which assumes you remember each one. It's an even better use case scenario if you are the guy with only one password for everything.
- chadcf 13y ago
  I would think something like lastpass is an even better workflow however. 1. click login button 2. there is no step 2
  - fsckin 13y ago
    +1 for LastPass. Saves a bunch of time. They're pretty damn persistent about doing security the right way -- they don't have the key to open your data.
    - azinman2 13y ago
      Except that's a bandaid over existing solutions. It's hard to imagine in 50 years we'll still require people to remember both a user identifier plus a password. It's a tough problem. Human memories are fallible, yet it's with you always. Passwords can be given to others, which can be convenient in many situations (something bio recognition can't do). Bio markers like fingerprints are left everywhere as CCC has demonstrated, or the markers themselves can change such as with Macular degeneration in eyes. Phones can be stolen or run out of battery, physical key cards lost, and centralized systems like RSA's SecurID hacked. In a lot of ways the banks have it done best, with combining a replaceable physical object (loanable) with a short PIN (sharable and more memorable), and then throwing fraud detection on top of it. It's the last piece that's the best and also the least available for others to do easily. The problem would be better addressed by having a turn-key solution that any company can easily plug into their code to detect fraud attempts on short passwords. Big hole waiting for a startup to fill...
  - R_Edward 13y ago
jbcurtin2 13y ago
Beats the heck out of time-based algorithms that generate a code on a fob. Obviously not usable everywhere, but definitely a solid option.

staticshock 13y ago

> the user's phone has to be in working order (camera working, network working) battery not dead...

johnsocs 13y ago
Just about all the widely public 2 factor schemes out there leverage cell phones via SMS or another route, they all require your device to be some battery life.
- pipeep 13y ago
  I bought a yubikey, but hardly any web services support it.
  - mutemule 13y ago
    Actually, any website that supports Google 2FA also happens to support your Yubikey Neo, assuming you have a Neo. Step 1: Install the Yubico Authenticator from the Play Store. Step 2: Install the OATH applet. Linux instructions are at http://forum.yubico.com/viewtopic.php?f=26&t=1159 http://forum.yubico.com/viewtopic.php?f=26&t=1159, but there are OS X instructions kicking around on the forums as well. Step 3: Wherever you would normally use Google Authenticator, use the Yubico Authenticator instead. You now have proper two-factor authentication. EDIT: Wrong link...
    - pipeep 13y ago
      Damn. I bought the standard.
      - mutemule 13y ago
        Well, sit tight. There's a new version of the Neo that supports U2F (https://sites.google.com/site/oauthgoog/gnubby https://sites.google.com/site/oauthgoog/gnubby) coming out Real Soon Now (https://www.yubico.com/products/yubikey-hardware/yubikey-neo/yubikey-neo-u2f/ https://www.yubico.com/products/yubikey-hardware/yubikey-neo...) -- sometime in 2014 is all I've heard.
- deleted 13y ago
  [deleted]
- subsection1h 13y ago
  None of the 2FA services that I use require me to use an actual phone. The phone number that I associate with 2FA services is set up to forward SMS messages to an email account that is dedicated to receiving only SMS messages from 2FA services.
  - arjie 13y ago
    How is that two factor any more? You've broken the security model. You now have only a knowledge factor, no possession factor. The whole point of two-factor authentication is to make it so you need two things of two different types. You reduced this problem to having two passwords (two things of the same type).
    - drdaeman 13y ago
      Do you mean there is any significant difference between an email and SMS accounts?
      - gcommer 13y ago
        I think that depends on the adversary. Against the NSA there might not be a major difference (depending on your email provider), but SMS is probably more secure in the typical case, as it is much more common for your run of the mill script kiddie/phisher/etc to get access to someone's email than their phone.
        drdaeman 13y ago
        At least some mobile operators have "SMS archive" option, that can be enabled and accessible from self-service site. It requires some time to set up, but attacker with sufficient time, knowledge and patience may pull the attack relatively easily. No need for NSA-grade adversary. (Even worse, until relatively recently they had used numeric passwords (those had to be set from a phone, using DTMF tone dial). This had changed only 3 or maybe 4 years ago. Wonder whenever that change was 2FA-related. :) ) So I'm uncertain whenever SMS is more secure.
- aqme28 13y ago
  But then you get added security. This isn't two factor, this is one factor.
  - pliu 13y ago
    You have to enter a 4 digit PIN number into the app. It's still two factor, since you have to auth to the app to get the one time pass.
zyxley 13y ago
Also, if you want to log into the site on your phone, you need a second phone.
- habosa 13y ago
  Pretty sure they have an app to solve that.

habosa 13y ago

There are a few advantages you're not mentioning: 1) This is two factor authentication. I don't trust any of my really "essential" accounts like GMail or Coinbase without two factor. And all of the problems you mentioned around needing your phone are common to nearly all two-factor auth solutions. 2) More secure password. You won't be susceptible to many brute-force based hacking methods because your password won't be in any rainbow tables or anything like that.

icebraining 13y ago
This is not two factor authentication, since it eliminates one of the factors (the password). Gmail's doesn't, so that is two factor auth.
- habosa 13y ago
  Clef app has a PIN. And my phone has a lock screen password.
  - icebraining 13y ago
    No, because you're not authenticating to the service. Think about what would happen if your phone gets owned by some malware that escalates to root. It can simply log the PIN, extract the key and then login as it wishes. That's because the phone is the single factor for the service. Compare that with the auth against, say, Gmail, where even if a malware were to own the Authenticator, it still couldn't login as you, since your password goes directly to the service.
PakG1 13y ago
I finally installed Google Authenticator on my phone yesterday because Digital Ocean utilizes it. It's great. Like RSA stuff, only more convenient. And hopefully given the response of Google's security people to NSA activity, more secure than the RSA stuff. This thing basically looks like a more automated version of Google Authenticator. Cool, but meh, would it really change my life? But maybe it would make a difference for the same market that feels like the iPhone 5s's fingerprint scanner is way more convenient than previous security mechanisms on the iPhone and so can never go back. I dunno.

ivanca 13y ago

Pretty much, yeah; this is condemned to fail and they should pivot ASAP.

deleted 13y ago

[deleted]

huhtenberg 13y ago

Yes, yes, except this allows you to log in from an untrusted computer.

thedufer 13y ago
How? An untrusted computer can just steal your session token.

AndrewKemendo 13y ago

This is wrong though because unless you have the same password for everything (you shouldn't) the process isn't the single serving: click login box, type, tab, type, enter It is moreso: click login box, type one of passwords 1-10, tab, type, enter Which assumes you remember each one. It's an even better use case scenario if you are the guy with only one password for everything.

chadcf 13y ago
I would think something like lastpass is an even better workflow however. 1. click login button 2. there is no step 2
- fsckin 13y ago
  +1 for LastPass. Saves a bunch of time. They're pretty damn persistent about doing security the right way -- they don't have the key to open your data.
  - azinman2 13y ago
    Except that's a bandaid over existing solutions. It's hard to imagine in 50 years we'll still require people to remember both a user identifier plus a password. It's a tough problem. Human memories are fallible, yet it's with you always. Passwords can be given to others, which can be convenient in many situations (something bio recognition can't do). Bio markers like fingerprints are left everywhere as CCC has demonstrated, or the markers themselves can change such as with Macular degeneration in eyes. Phones can be stolen or run out of battery, physical key cards lost, and centralized systems like RSA's SecurID hacked. In a lot of ways the banks have it done best, with combining a replaceable physical object (loanable) with a short PIN (sharable and more memorable), and then throwing fraud detection on top of it. It's the last piece that's the best and also the least available for others to do easily. The problem would be better addressed by having a turn-key solution that any company can easily plug into their code to detect fraud attempts on short passwords. Big hole waiting for a startup to fill...
- R_Edward 13y ago

jbcurtin2 13y ago

Beats the heck out of time-based algorithms that generate a code on a fob. Obviously not usable everywhere, but definitely a solid option.