4 ms·

Maybe Google's incredibly irresponsible response hints at their general strategy regarding authentication on the internet: they are already pushing for the repl

Maybe Google's incredibly irresponsible response hints at their general strategy regarding authentication on the internet: they are already pushing for the replacement passwords. I'm quoting: "[Google plans] to release an ultra-secure and easy to use identity verification platform that eliminates the need for long, user-generated passwords. Dubbed U2F (Universal 2nd Factor), the consumer-facing side of this initiative will be a USB dongle called the YubiKey Neo. Built to Google’s specifications by security specialist Yubico, the YubiKey Neo is a small, durable and driverless device that requires no battery. Plugged into your computer’s USB port it will add a second, highly secure layer of verification when you point Google’s Chrome browser to your Gmail or Google Docs account. You’ll initiate the login by typing your username and a simple PIN. The browser will then communicate directly with the YubiKey Neo, using encrypted data, to authorize account access. With U2F verification, if someone wanted to login surreptitiously to your account, he or she would need to know your username and PIN while simultaneously having physical possession of that specific YubiKey Neo." Furthermore, they had Regina Dugan, former DARPA director and now their VP of Engineering, Advanced Technology and Projects, on stage at All Things Digital in 2013 talking about electric tattoos and edible passwords which would turn your whole body into an authentication token with a 18bit ESG light signal. (Link to talk: https://www.youtube.com/watch?v=fzB1EcocAF8 https://www.youtube.com/watch?v=fzB1EcocAF8). So maybe they just don't care because they won't use 2-factor-authentication for much longer anyway.

noisy_boy 12y ago
That will be a problem where USB ports are disabled (which is increasingly becoming a standard security practice). E.g. my workplace has separate PCs for accessing Gmail etc. but those still have USB ports disabled.
- growse 12y ago
  I imagine you could have a fallback to how YubiKey neo and 2fa works today: using a phone app to generate a code (in conjunction with the yubikey) and manually type that in.
- DrJokepu 12y ago
  If USB ports are disabled, how are the keyboard and the mouse connected? PS/2?
  - noisy_boy 12y ago
    Now that you mentioned it, I think only USB Mass Storage was disabled, not the ports themselves. So the keyboard/mouse etc continue to work.
    - Kell 12y ago
      So Yubikey would work. It identifies itself as a Keyboard to the OS.
      - jrockway 12y ago
        These are HID devices, because they need to do challenge/response with the website that's trying to authenticate. The old OTP YubiKeys were keyboards. Better than nothing but phishable.
  - mgkimsal 12y ago
    bluetooth?
    - harshreality 12y ago
      Requires batteries. NFC is the obvious choice, and yubikey neo already supports that. Note that (going back to top-level parent comment) current yubikey neos cannot support U2F; all they say is U2F compatible devices will be available sometime [later] this year.
  - lotu 12y ago
    They can be permanently connected to computer.
    - DrJokepu 12y ago
youngtaff 12y ago
Believe Google already uses YubiKeys for authentication internally - certainly some of the Google staffers I know have them for authentication
pdkl95 12y ago
Hmmm.... let passwords become unusable, and move to hardware crypto dongle? That sure sounds like a great way to remove any remaining anonymity on their services, once they tie shipping addresses to accounts. // I like the idea of crypto dongles... when you control both sides
- im3w1l 12y ago
  >Note that the secure element never returns a previously generated public key in any new registration step. >This makes tracking users across websites difficult by using the token as a supercookie that bypasses other anonymizing precautions. So at least they make an effort to prevent that, and if they do not subvert this scheme you wont be trackable. But as the dongle is more or less a black box, it would probably be hard to ascertain that generated public keys do not have some property in common to allow them to be associated with each other.
- tonfa 12y ago
  Accept the key isn't tied to you account when you buy it and you don't have to buy from google... > Consumer provisioning should allow users to buy a compliant token from a vendor of their choice, insert it into a computer where they’re already authenticated to a website, and register their token with a single mouse click. http://www.computer.org/cms/Computer.org/ComputingNow/pdfs/AuthenticationAtScale.pdf http://www.computer.org/cms/Computer.org/ComputingNow/pdfs/A... Furthermore there are no serial number exchanged afaict, so the key itself isn't identified by the server, only the fact it has valid credentials.
  - pdkl95 12y ago
    Ahh, was not aware of that. I think this would solve a lot of my concern.

noisy_boy 12y ago

That will be a problem where USB ports are disabled (which is increasingly becoming a standard security practice). E.g. my workplace has separate PCs for accessing Gmail etc. but those still have USB ports disabled.

growse 12y ago
I imagine you could have a fallback to how YubiKey neo and 2fa works today: using a phone app to generate a code (in conjunction with the yubikey) and manually type that in.
DrJokepu 12y ago
If USB ports are disabled, how are the keyboard and the mouse connected? PS/2?
- noisy_boy 12y ago
  Now that you mentioned it, I think only USB Mass Storage was disabled, not the ports themselves. So the keyboard/mouse etc continue to work.
  - Kell 12y ago
    So Yubikey would work. It identifies itself as a Keyboard to the OS.
    - jrockway 12y ago
      These are HID devices, because they need to do challenge/response with the website that's trying to authenticate. The old OTP YubiKeys were keyboards. Better than nothing but phishable.
- mgkimsal 12y ago
  bluetooth?
  - harshreality 12y ago
    Requires batteries. NFC is the obvious choice, and yubikey neo already supports that. Note that (going back to top-level parent comment) current yubikey neos cannot support U2F; all they say is U2F compatible devices will be available sometime [later] this year.
- lotu 12y ago
  They can be permanently connected to computer.
  - DrJokepu 12y ago

youngtaff 12y ago

Believe Google already uses YubiKeys for authentication internally - certainly some of the Google staffers I know have them for authentication

pdkl95 12y ago

Hmmm.... let passwords become unusable, and move to hardware crypto dongle? That sure sounds like a great way to remove any remaining anonymity on their services, once they tie shipping addresses to accounts. // I like the idea of crypto dongles... when you control both sides

im3w1l 12y ago
>Note that the secure element never returns a previously generated public key in any new registration step. >This makes tracking users across websites difficult by using the token as a supercookie that bypasses other anonymizing precautions. So at least they make an effort to prevent that, and if they do not subvert this scheme you wont be trackable. But as the dongle is more or less a black box, it would probably be hard to ascertain that generated public keys do not have some property in common to allow them to be associated with each other.
tonfa 12y ago
Accept the key isn't tied to you account when you buy it and you don't have to buy from google... > Consumer provisioning should allow users to buy a compliant token from a vendor of their choice, insert it into a computer where they’re already authenticated to a website, and register their token with a single mouse click. http://www.computer.org/cms/Computer.org/ComputingNow/pdfs/AuthenticationAtScale.pdf http://www.computer.org/cms/Computer.org/ComputingNow/pdfs/A... Furthermore there are no serial number exchanged afaict, so the key itself isn't identified by the server, only the fact it has valid credentials.
- pdkl95 12y ago
  Ahh, was not aware of that. I think this would solve a lot of my concern.