111–120 of 154 posts
Earlier quoted context omitted.
Correct. You'll need a FIDO key to log in in that case
What in the spec precludes this from being implemented in software? [edit] Reading more of the spec it definitely seems like they meant for it to be possible to implement this in software. So while a physical FIDO device might be preferable, it shouldn't be necessary.
I think fundamentally most users don't understand anything more complicated than passwords. Passwords are easy. They make sense. A kindergartener understands the idea of a secret word that only they know. Tokens, certificates, FIDO -- it's black magic. Therefore people don't trust it. It has to be as easy and intuitive as passwords or it's a non-starter. That's why the SMS codes (though insecure) are so popular. Peop…
Earlier quoted context omitted.
Interesting link, thanks! For the time being, passphrases + TOTP 2F are sufficient, but I will look forward to being able to use a security key instead.
U2F is fundamentally quite a bit more secure than TOTP - you probably already know this, but just to clarify for those reading.
Yes, IIRC it's impossible (or nearly so) to phish U2F.
I think fundamentally most users don't understand anything more complicated than passwords. Passwords are easy. They make sense. A kindergartener understands the idea of a secret word that only they know. Tokens, certificates, FIDO -- it's black magic. Therefore people don't trust it. It has to be as easy and intuitive as passwords or it's a non-starter. That's why the SMS codes (though insecure) are so popular. Peop…
I don't think it's that conceptually difficult to understand even for a layman.
The bare minimum understanding of web security is that authentication is the process of proving who you are (your identity). You can do it one of three ways (or a combination of them):
1. "Something you know" - Password, Background questions, etc.
2. "Something you have" - Yubikey, Smartcard, TOTP, SMS, email, etc.
3. "Something you are" - BiometricsI recently used auth0 to implement passwordless login (via "magic link" emails) for a client project. Auth0's documentation is not great, but some of their blog posts are pretty good. In any case, if you're interested in WebAuthN, you could do worse than reading what Auth0 has to say about it: https://auth0.com/blog/web-authentication-webauthn-overview-...
I was saying for a long time that a new protocol for a biometric driven login scheme should become the new default. We use biometrics to log into our phone, then a password manager uses the same biometric to authenticate on the same device to log me into a website by auto populating the username + password for me. Afterwards I'll get a 2FA confirmation on the same device which again I'll have to confirm via the same…
I don't want to let the password go. It gives me the freedom to rightfully access my service if I just know the secret, without any entanglent to some app, device, or other account.
I've avoided getting a Yubikey because there's not an easy way to use it on my iPhone, sticking with TOTP. But that's a bit of an edge case. (iPhones lack NFC chips)
I think fundamentally most users don't understand anything more complicated than passwords. Passwords are easy. They make sense. A kindergartener understands the idea of a secret word that only they know. Tokens, certificates, FIDO -- it's black magic. Therefore people don't trust it. It has to be as easy and intuitive as passwords or it's a non-starter. That's why the SMS codes (though insecure) are so popular. Peop…
I get what you're saying though. Users are used to passwords, so moving to an alternative means of authentication will introduce a bit of friction. That said, I think that done right WebAuthn will actually be way easier to use than passwords. Users will just be able to sign in to their browser once, then use what is effectively single-sign-on for every site thereafter.
We're still quite a ways away from that point, but that's where we're headed.
I moved from primarily using a MacBook Pro to an iMac Pro a few months ago, and have struggled to find a non-awkward FIDO U2F key due to the ports being on the back. I'm really looking forward to a decent range of BLE U2F keys that are supported on Desktop and Mobile.