Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

fidoalliance.org

Post reply on HN
Print view View original

101–110 of 525 posts

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#101

Post by eMGm4D0zgUAVXc7 »

jurmous wrote: post #85
throwaway52022 wrote: post #74

I don't trust Google or Apple to be my main authentication provider, or to manage syncing my private key. Their customer service is terrible and they are way too arbitrary on locking folks out. I would trust my bank (well, my credit union.) I can go see them in person if I need to and they take my lawyer seriously, they also take security seriously, they're properly regulated, and ultimately they're my main concern i…

In the Netherlands the banks provide the iDIN system, so you can authenticate on more sites with the bank provided logins. Each bank has a slightly different system often using bank card and bank card readers and ways to authenticate through authorised banking app on individual mobile phones. - https://www.idin.nl/en/about-idin/ - https://nl.wikipedia.org/wiki/IDIN - (Use translate function in browser to read as ther…

Given that banks usually MUST validate their customers' identity card the opportunities for tracking your users with this must be superb.

I'd frankly prefer "insecure" user+pass over all of these guardrails which are 90% about control over the users and 10% about security.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#102

Post by zozbot234 »

vngzs wrote: post #77
bedast wrote: post #55

The weakest link in security is always going to be humans. Account compromise is is more often a human problem than a technological one (spamming requests, password reuse, simple passwords, (spear) phishing, direct social engineering, etc). If I'm understanding correctly, they're aiming to reduce multi-factor auth back down to a single factor that's "easier" than passwords. Easier to use. Easier to social engineer a…

There's a frequent misconception that hardware keys are no better than, say, a TOTP seed on a secure element of your phone. The core practical difference between a hardware key and that TOTP code on a secure element is the hardware key, when registered with a domain, is programmed with the domain name in it. Lookalike domains - or anything besides the exact domain you registered the key with - fail to 2FA because the…

Doesn't TOTP use current time as part of the challenge? Why couldn't a refinement of TOTP add the domain name as a further element?

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#103

Post by toomuchtodo »

throwaway52022 wrote: post #95
0daystock wrote: post #83

Earlier quoted context omitted.

This announcement isn't about that and neither provider is asking to sync your private key. In fact the opposite is true: with FIDO2, you're in much greater control of your account security because authentication creds are now on a hardware token versus as bearer credentials you type and an adversary can steal and replay. Many of us believe we're very good at protecting our passwords, but this isn't true in reality a…

Except it kind of is - the way I read this is "Apple/Google will turn your phone into a hardware FIDO token, but will use iCloud/whatever to reduce the huge painpoint of having more than one hardware token and keeping them all in sync" I really love the idea of FIDO and making sure that my authenticator only authenticates to sites that I've approved, but having multiple keys right now is a huge pain, but I'm not exci…

Your average user is more concerned about losing their password than they are about authenticator sovereignty. Moving towards cryptographic primitives for auth versus shared secrets is a net benefit versus current state.

> but having multiple keys right now is a huge pain, but I'm not excited about "just sign up for Apple and that pain goes away" because I sure as hell don't trust Apple not to cause me pain in the future.

Compromise is necessary, and probably a bit of regulation from government to enforce good outcomes from exception handling. Passkeys need to be stored and managed somehow, and your average user does not want to do that, just like they don't want to run their own mail server, syncthing instance, or mastodon instance.

EDIT: (HN throttling, can't reply) @signal11 You can already be locked out of all of those accounts without recourse.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#104

Post by epistasis »

alberth wrote: post #21

Dumb question: why are biometrics being used to replace the password , shouldn't the biometric replace the username ?

Without making any explicit argument for it, what I see coming out of Fido and U2F are really changing the importance of the long-standing "something you have, something you know..." mindset around security. That prior mode was not helping us design system that take human capabilities of the user into account.

Prior security seemed to focus entirely on attackers, and their agency, and what they could potentially do. But we also need to pay attention to what users can do in order to build a secure system. Requiring users to read domain name strings, potentially in Unicode, every time, and make sure they are correct, to prevent phishing, is a really bad design. Instead, have the website authenticate themselves to the user, automatically, and have the machine do the string comparisons.

Similarly, the distinction between user and password for a biometric doesn't make much sense in this case. It's neither. The user is identified by a different mechanism, the biometric is merely a way for the device to see that the user is there.

There are always lots of attack modes for biometrics, but they are convenient and good enough to capture nearly all common and practica attack modes. And a huge problem of the 90s and 2000s security thinking was focusing on the wrong attack modes for the internet age.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#105

Post by londons_explore »

throwaway52022 wrote: post #74

I don't trust Google or Apple to be my main authentication provider, or to manage syncing my private key. Their customer service is terrible and they are way too arbitrary on locking folks out. I would trust my bank (well, my credit union.) I can go see them in person if I need to and they take my lawyer seriously, they also take security seriously, they're properly regulated, and ultimately they're my main concern i…

> they also take security seriously,

Despite what most people think, banks are often a really long way behind on security. Banks don't care about security of any individual customer, merely security of the bank as a whole. That means if 0.01% of customers lose all their funds due to credential stuffing, it isn't an issue - the bank will just refund them if needed.

Unlike say ssh with key authentication, where it would be a total failure if 0.01% of attackers were allowed to login without the key.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#107

Post by netheril96 »

zozbot234 wrote: post #102
vngzs wrote: post #77

Earlier quoted context omitted.

There's a frequent misconception that hardware keys are no better than, say, a TOTP seed on a secure element of your phone. The core practical difference between a hardware key and that TOTP code on a secure element is the hardware key, when registered with a domain, is programmed with the domain name in it. Lookalike domains - or anything besides the exact domain you registered the key with - fail to 2FA because the…

Doesn't TOTP use current time as part of the challenge? Why couldn't a refinement of TOTP add the domain name as a further element?

You can't rely on the end users to check the domain name, because

* Most users have no idea what a domain name is.

* It is tedious to compare the domain name character by character.

* Phishing sites have used many UI tricks historically to make their domain name look authentic (e.g lookalike Unicode characters).

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#108

Post by judge2020 »

throwaway52022 wrote: post #95
0daystock wrote: post #83

Earlier quoted context omitted.

This announcement isn't about that and neither provider is asking to sync your private key. In fact the opposite is true: with FIDO2, you're in much greater control of your account security because authentication creds are now on a hardware token versus as bearer credentials you type and an adversary can steal and replay. Many of us believe we're very good at protecting our passwords, but this isn't true in reality a…

Except it kind of is - the way I read this is "Apple/Google will turn your phone into a hardware FIDO token, but will use iCloud/whatever to reduce the huge painpoint of having more than one hardware token and keeping them all in sync" I really love the idea of FIDO and making sure that my authenticator only authenticates to sites that I've approved, but having multiple keys right now is a huge pain, but I'm not exci…

This is a net benefit over synced passwords, which everyone already trusts them to do. You haven't been forced to use a (syncing) password manager over a physical password book in the past, and you won't be forced to use Passkeys[0] or the Android equivalent in the future; hardware security keys will still be usable since this announcement is about embracing the FIDO Standard.

0: https://developer.apple.com/documentation/authenticationserv...

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#109

Post by epistasis »

eMGm4D0zgUAVXc7 wrote: post #98
0daystock wrote: post #83

Earlier quoted context omitted.

This announcement isn't about that and neither provider is asking to sync your private key. In fact the opposite is true: with FIDO2, you're in much greater control of your account security because authentication creds are now on a hardware token versus as bearer credentials you type and an adversary can steal and replay. Many of us believe we're very good at protecting our passwords, but this isn't true in reality a…

Quoted post unavailable.

Not at all, because before anybody could take your account away from you if you did not accurately compare two visual strings, potentially in Unicode.

By replacing that operation, which humans can not perform reliably, with computer operations, users are no longer subject to others taking control of their account.

It is wonderful.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#110

Post by [deleted] »

eMGm4D0zgUAVXc7 wrote: post #98
0daystock wrote: post #83

Earlier quoted context omitted.

This announcement isn't about that and neither provider is asking to sync your private key. In fact the opposite is true: with FIDO2, you're in much greater control of your account security because authentication creds are now on a hardware token versus as bearer credentials you type and an adversary can steal and replay. Many of us believe we're very good at protecting our passwords, but this isn't true in reality a…

Quoted post unavailable.

[deleted]
Post reply on HN