Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

fidoalliance.org

Post reply on HN
Print view View original

241–250 of 525 posts

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#241

Post by NovemberWhiskey »

zozbot234 wrote: post #230
NovemberWhiskey wrote: post #228

Earlier quoted context omitted.

I think the point is it's up to the relying party to make the decision; so an uneven user experience is possible.

If an "insecure" authenticator reveals itself at enrollment, the only "unevenness" is that attempts to enroll it might fail, perhaps with a request to use a securely attested authenticator instead - you would never be locked out from any service after the fact. This is better than "cloning" a supposedly secure device and then failing a count check while trying to authenticate.

Yeah; being told "you can't use that here" for some sites is a pretty uneven user experience, wouldn't you say? Not sure why the scare quotes are necessary here.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#243

Post by rad88 »

fmakunbound wrote: post #187

Reading through the threads here: If the HN can't articulate FIDO and differences between it and the now decades old password model to each other, I think regular jack-offs are going to have trouble. People have the mental model that their secret is stored in their gray matter/post-it note/password manager, and now you're telling them it's in their phone, and somewhat related to the phone's security model, or maybe a…

Yeah, well what I want is a (physical, literal) membership card like I have at the gym or library. I think "regular" people can learn to use USB tokens, and that they might make more intuitive sense than passwords. These places don't challenge me for the "secret password" when I come in, I just present or scan my card.

It's very tricky obviously, in terms of engineering and operations, for an internet based company to arrange anything similar. But I don't think it's too mentally foreign for the user (assuming we develop good standards).

So cards make sense to me. Way more sense than passwords. Maybe someone else feels more comfortable with the details living inside their phone, but that doesn't affect my mental model. Users don't need to understand or be taught the entire standard.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#244

Post by dividedbyzero »

rootusrootus wrote: post #153
beefee wrote: post #99

Earlier quoted context omitted.

The services I interact with that support WebAuthn usually only allow you to register one key. Backup and recovery is a confusing puzzle for most of these services.

I haven't run into any like that, but I'm with you -- if I could only store one webauthn key, I wouldn't use it at all. Too risky.

I believe AWS root accounts don't support more than one key to be added.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#246

Post by andrey_utkin »

bpye wrote: post #217
georgyo wrote: post #59

Earlier quoted context omitted.

It's actually horrible! Even key rotation is horrible! My yubikey is getting to about 10 years old, and I have replacements for it but find it very difficult to switch. It will eventually fail as an things do and it will be problematic. The problem is that I have several dozen accounts connected to it and I don't know all of them. So either I'm carrying and trying multiple keys at all times or not getting into a site…

I’m going to need to work this out soon. I picked up a pair of new YubiKey 5Cs yesterday with their sale. I’ve been using a YubiKey Neo for years for U2F, TOTP and GPG. Moving the GPG key is easy - though I might try using the FIDO2 support in SSH instead. However for every TOTP and U2F key I’m going to have to re-enroll the new keys… It feels like there should be a better way.

I've recently started to track my service dependency graph! So like, to keep using github I need my password store, my email and one of my two security keys. To use my email, I need...

Please contact me if you're interested, I will release the tooling I have.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#247

Post by la6472 »

austinbv wrote: post #242

The problem with any key based auth or biometric auth is a user can be compelled by LEO to hand over private keys or open a biometric lock. Passwords are protected by the 5th amendment.

Why do we need another AuthN protocol? We should extend OIDC as needed instead of again trying to reinvent the wheel.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#248

Post by [deleted] »

CyberRage wrote: post #175
stjohnswarts wrote: post #132

Earlier quoted context omitted.

Once they have a way to fake your biometric though they have it for forever, that's the point. With a password you have a way to provide a key only known to you and while it can be faked, it can also be reset, you can't reset your fingerprint without surgery

I don't get the point... If someone steals your fingerprint, he stole your fingerprint. As I explained you can't get the fingerprint from the device\key, it is simply not there. This isn't the problem of the implementation\technology if someone stole your fingerprint. it didn't lead to your biometrics compromised What's easier to do? stealing someone's fingerprint or cracking\guessing their password. Definitely the l…

[deleted]

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#250

Post by stingraycharles »

austinbv wrote: post #242

The problem with any key based auth or biometric auth is a user can be compelled by LEO to hand over private keys or open a biometric lock. Passwords are protected by the 5th amendment.

The standard answers for these things is to use both; they’re not mutually exclusive, and for important things you almost certainly want both.
Post reply on HN