Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

fidoalliance.org

Post reply on HN
Print view View original

131–140 of 525 posts

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#131

Post by avianlyric »

bcatanzaro wrote: post #4

This passwordless signin process sounds neat, but will it increase Google’s power to lock people out of things? I don’t understand why Google doesn’t have an ombudsman - consumers have no recourse when Google locks them out, and it seems the consequences of Google locking you out are ever increasing. I think we’re going to need legislation to force Google to make a proper appeals process.

> I don’t understand why Google doesn’t have an ombudsman - consumers have no recourse when Google locks them out

Coming soon to an EU country near you!

The EU digital markets act address this issue directly, by requiring “gatekeepers” to provide human customer response, and clear processes for appealing bans etc and generally forcing companies to provide something akin to due-process.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#132

Post by stjohnswarts »

CyberRage wrote: post #82
deelowe wrote: post #73

Earlier quoted context omitted.

Let's ignore the part about biometrics being faked since this seems to be a point of contention. Isn't it a fair argument that secret keys should be mutable by the user? In the future, some unforeseen event COULD occur which compromises or otherwise renders the particular biometric unusable. Now what?

But they are... Firstly, with how it works. even if you use the same finger to generate hundreds of keys, they should all be different because we are using noise\randomness within the algorithm itself. different sensors will generate different outputs and therefore it is pointless to worry about the key used stolen. I think what you want is secret keys completely detached from the user. we have that as well with hard…

Once they have a way to fake your biometric though they have it for forever, that's the point. With a password you have a way to provide a key only known to you and while it can be faked, it can also be reset, you can't reset your fingerprint without surgery

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#133

Post by [deleted] »

throwaway52022 wrote: post #35

I've resisted switching to a hardware key because I know that I'm going to break it, and that seems like a huge pain in the ass. I really want to be able to make a couple of backup keys, or maybe put another way, I want to be able to put the private key on the device myself, I don't necessarily care that the key is generated on the device and never leaves the device. I don't care if that slightly reduces my security…

[deleted]

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#134

Post by mavhc »

throwaway52022 wrote: post #74

I don't trust Google or Apple to be my main authentication provider, or to manage syncing my private key. Their customer service is terrible and they are way too arbitrary on locking folks out. I would trust my bank (well, my credit union.) I can go see them in person if I need to and they take my lawyer seriously, they also take security seriously, they're properly regulated, and ultimately they're my main concern i…

I wouldn't trust my bank to not give my account to someone pretending to have forgotten my password

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#135

Post by Hamuko »

alberth wrote: post #39
sph wrote: post #27

Earlier quoted context omitted.

Sounds to be like we're replacing the username and the password, i.e. something you know with username and your phone, i.e. something you have . It sounds like it's still a one factor authentication system, but different.

Follow-up dumb questions: - so what happens if you don't have your phone at time of login? - if I enroll on iPhone, is my identity forever tied to Apple or can it be migrated to Android if I ever wanted to change platforms? - Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc that use FIDO login?

>if I enroll on iPhone, is my identity forever tied to Apple or can it be migrated to Android if I ever wanted to change platforms?

A good FIDO implementation will give you the ability to enroll multiple authenticators. In fact, if you can't, you're basically going against the WebAuthn spec.

"Relying Parties SHOULD allow and encourage users to register multiple credentials to the same account. Relying Parties SHOULD make use of the excludeCredentials and user.id options to ensure that these different credentials are bound to different authenticators."

Basically, you should enroll your iPhone and a backup key. And if you get an Android device, you log in with the Android device using a backup key, and enroll the Android device and remove the iPhone. Alternatively, you remove the iPhone authentication using the iPhone, and enroll the Android device using an alternative authentication method (like traditional username/password).

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#137

Post by Hamuko »

beefee wrote: post #99
vngzs wrote: post #38

Earlier quoted context omitted.

You just register 2-3 keys. It's not so bad.

The services I interact with that support WebAuthn usually only allow you to register one key. Backup and recovery is a confusing puzzle for most of these services.

Tell the services you interact with that they're basically going against the spec.

"Relying Parties SHOULD allow and encourage users to register multiple credentials to the same account. Relying Parties SHOULD make use of the excludeCredentials and user.id options to ensure that these different credentials are bound to different authenticators."

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#138

Post by stjohnswarts »

CyberRage wrote: post #40
alberth wrote: post #21

Dumb question: why are biometrics being used to replace the password , shouldn't the biometric replace the username ?

From a theoretical point of view or practical? Username is simply an ID. Password is how we truly verify who the user is. Bio-metrics are just convenient because they are unique and hard\impossible to replicate.

they aren't impossible to replicate tho

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#139

Post by [deleted] »

throwaway52022 wrote: post #74

I don't trust Google or Apple to be my main authentication provider, or to manage syncing my private key. Their customer service is terrible and they are way too arbitrary on locking folks out. I would trust my bank (well, my credit union.) I can go see them in person if I need to and they take my lawyer seriously, they also take security seriously, they're properly regulated, and ultimately they're my main concern i…

[deleted]

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#140

Post by xur17 »

throwaway52022 wrote: post #35

I've resisted switching to a hardware key because I know that I'm going to break it, and that seems like a huge pain in the ass. I really want to be able to make a couple of backup keys, or maybe put another way, I want to be able to put the private key on the device myself, I don't necessarily care that the key is generated on the device and never leaves the device. I don't care if that slightly reduces my security…

Has anyone tried a Ledger or Trezor device for something like this? Your FIDO U2F private key is deterministically generated [0] based upon your seed phrase, which you can backup, and restore on other devices.

[0] https://www.reddit.com/r/ledgerwallet/comments/udzx1c/ledger...

Post reply on HN