Any plans for a Windows version?
Soft U2F: A software-based U2F authenticator for macOS
31–40 of 114 posts
Re: Soft U2F: A software-based U2F authenticator for macOS
#32What's wrong with client certificates? Instead of reinventing the wheel they should've just used those which would've given browser vendors a reason to improve their UX regarding client certs.
Re: Soft U2F: A software-based U2F authenticator for macOS
#33U2F adoption seems quite slow. Google were in early, and later github and Dropbox. But since then? Feels like nothing happened.
Re: Soft U2F: A software-based U2F authenticator for macOS
#34Can someone explain how this is an improvement on phone-based, non-SMS 2FA? This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.
The improvement is accessibility. It's less secure than physical 2FA but more so than just 1FA. As the article says, "for many, the security of software-based U2F is sufficient and helps to mitigate against many common attacks such as password dumps, brute force attacks, and phishing related exploits."
It's really not that much less secure than physical 2FA: I'm willing to bet that most people just leave their hardware key in their laptop at all times. (where "most people" ends up being corporate U2F users, who are probably given YubiKey Nanos and the like)
At that point, your laptop is basically your 2nd factor - which this software is pretty similar to.
Re: Soft U2F: A software-based U2F authenticator for macOS
#35What's wrong with client certificates? Instead of reinventing the wheel they should've just used those which would've given browser vendors a reason to improve their UX regarding client certs.
That is roughly all U2F is. It is a per-origin key pair that is registered with each site and used to sign challenges. At some point browsers themselves might implement something like Soft U2F, at which point, they basically will have "improved the UX of client certs".
Re: Soft U2F: A software-based U2F authenticator for macOS
#36Re: Soft U2F: A software-based U2F authenticator for macOS
#37What's wrong with client certificates? Instead of reinventing the wheel they should've just used those which would've given browser vendors a reason to improve their UX regarding client certs.
Most sites can't sacrifice all their users in the short term for the good of the Internet long-term.
Re: Soft U2F: A software-based U2F authenticator for macOS
#38What's wrong with client certificates? Instead of reinventing the wheel they should've just used those which would've given browser vendors a reason to improve their UX regarding client certs.
That is roughly all U2F is. It is a per-origin key pair that is registered with each site and used to sign challenges. At some point browsers themselves might implement something like Soft U2F, at which point, they basically will have "improved the UX of client certs".
The advantage of client certs over U2F is that client certs use the same proven mechanism your browser uses to verify the server's cert, and can even be handled by the web server. It's also seamless for the user - if needed you can be logged in right from the first request. U2F needs to be implemented over the top in the app itself and the login process is at the minimum two steps (no way to login from the first request).
Re: Soft U2F: A software-based U2F authenticator for macOS
#39U2F adoption seems quite slow. Google were in early, and later github and Dropbox. But since then? Feels like nothing happened.
I think it is attack-driven. Most bitcoin wallets/exchanges have 2FA/U2F because it is a must given the value at stake. If you are running a forum board, you probably don't care much neither are your users going to bother.
Re: Soft U2F: A software-based U2F authenticator for macOS
#40Can someone explain how this is an improvement on phone-based, non-SMS 2FA? This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.
Passwords are often already on the users phone. Such as if you use say Authy or Google Authenticator for your 2 factor, your phone if say an iPhone already stores all your passwords in your keychain which is accessible on your iPhone just like on your computer. Or if you use 1Password your passwords are accessible on your phone just like on your desktop. So still comes down to you having a strong master password for…
> But hopefully someone else can comment on the security improvements of Soft U2F or if its more just building a standard rather than people having to rely on Authy or such.
The main difference is that U2F is phishing-resistant because it binds keys to the origin. TOTP, on the other hand, can still be phished.
(I believe Authy attempted to solve some of this with their browser extension for sites that use their first-party integration, rather than just for users using Authy as a generic TOTP app. I would generally avoid their first-party integration because of their reliance on SMS.)