FIDO Alliance
fidoalliance.org
FIDO Alliance
1–10 of 57 posts
Re: FIDO Alliance
#2Hmm, seminars and "certified professional" exams. I don't recall needing those in order to understand or implement username/password auth.
I keep hearing this is simpler and more secure, but I really doubt explaining this to my aging parents is going to be a fun afternoon.
Can we just leave well enough alone? Was never a fan of centralizing my identity in the first place.
Re: FIDO Alliance
#3Hmm, seminars and "certified professional" exams. I don't recall needing those in order to understand or implement username/password auth. I keep hearing this is simpler and more secure, but I really doubt explaining this to my aging parents is going to be a fun afternoon. Can we just leave well enough alone? Was never a fan of centralizing my identity in the first place.
It's simple for users. No need to remember passwords anymore, no typing 6 digits numbers from your phone that you need to search in your house before tokens expire.
This comes with (some) additional complexity for implementing more complex auth flows for developers.
If you think that passwords are working "well enough" today you are clearly not educated on how most users (mis)use them. If you built a site and tried out the passwords people send to you on the logins for providers of the email addresses they send to you, there'd be a large fraction of people reusing their email account password for your service, allowing you to access their email.
Re: FIDO Alliance
#4Seems it's like ssh keys, but fiddled automatically in the browser. A password unlocks the local keys.
This means keys need to be transported between devices. Which means even tighter coupling to google and microsoft accounts.
Re: FIDO Alliance
#5Hmm, seminars and "certified professional" exams. I don't recall needing those in order to understand or implement username/password auth. I keep hearing this is simpler and more secure, but I really doubt explaining this to my aging parents is going to be a fun afternoon. Can we just leave well enough alone? Was never a fan of centralizing my identity in the first place.
The only real problem with passwords is that humans are extremely bad at those without an aid of a password manager (when they’re no longer words but turn into pre-shared tokens). There are more, of course, but not as important.
So people invented OpenID and OAuth and stuff, but all those things are fundamentally flawed because users were no longer a source of their “own” identifies. Their identities became provided by third parties - and this is notoriously bad.
WebAuthn (and FIDO stuff) is not centralized, on the contrary - users still own their credentials and are sources of their identities (though there are optional attestations). It doesn’t require cryptography knowledge to use it, but it does to implement it - thus the certification (though anyone can surely do it without certifying for anything).
Re: FIDO Alliance
#6Seems it's like ssh keys, but fiddled automatically in the browser. A password unlocks the local keys. This means keys need to be transported between devices. Which means even tighter coupling to google and microsoft accounts.
Or apple's iCloud (see their passkey thing also currently on the front page)
EDIT: Yes you don't need to use a syncing service. But it will be important for it to be portable between syncing services, as that is what most consumers will be using.
Re: FIDO Alliance
#7Hmm, seminars and "certified professional" exams. I don't recall needing those in order to understand or implement username/password auth. I keep hearing this is simpler and more secure, but I really doubt explaining this to my aging parents is going to be a fun afternoon. Can we just leave well enough alone? Was never a fan of centralizing my identity in the first place.
I've had so many of my non-tech relatives get hacked. Folks who don't live/breath/shit tech just kind of suck at p/w management. This is a huge improvement for them.
BUT, I absolutely think we should continue to demand the right to interact with services on our own terms: Even accepting the compromise of "less security" (debatable if you know what you're doing).
I think the only way forward is a Free/Libre implementation of FIDO2 that is NOT linked to any specific device and can be modified - along with direct access to the keys. Those are the users property and should not be held hostage by hostile designs. Users should have the right to move their keys, without justification, and use whatever manager they want. Even a fully-software one.
Re: FIDO Alliance
#8Hmm, seminars and "certified professional" exams. I don't recall needing those in order to understand or implement username/password auth. I keep hearing this is simpler and more secure, but I really doubt explaining this to my aging parents is going to be a fun afternoon. Can we just leave well enough alone? Was never a fan of centralizing my identity in the first place.
I've had so many of my non-tech relatives get hacked. Folks who don't live/breath/shit tech just kind of suck at p/w management. This is a huge improvement for them. BUT, I absolutely think we should continue to demand the right to interact with services on our own terms: Even accepting the compromise of "less security" (debatable if you know what you're doing). I think the only way forward is a Free/Libre implementa…
> implementation of FIDO2 that is NOT linked to any specific device and can be modified - along with direct access to the keys. Those are the users property and should not be held hostage by hostile designs. Users should have the right to move their keys, without justification, and use whatever manager they want
Is this not possible with current designs?
Re: FIDO Alliance
#9Seems it's like ssh keys, but fiddled automatically in the browser. A password unlocks the local keys. This means keys need to be transported between devices. Which means even tighter coupling to google and microsoft accounts.
> This means keys need to be transported between devices
Pure keys are on tokens that support Bluetooth/NFC/USB to talk to whatever devices you want. One can use a built in key on a device with a security enclave which means using one device to auth addition of another, but you might do that with alerts to authorize, etc.
Anyone who doesn't have a powned problem is using something like TOTP auth codes which has all of the downside of Fido and none of the convenience.
Re: FIDO Alliance
#10Earlier quoted context omitted.
I've had so many of my non-tech relatives get hacked. Folks who don't live/breath/shit tech just kind of suck at p/w management. This is a huge improvement for them. BUT, I absolutely think we should continue to demand the right to interact with services on our own terms: Even accepting the compromise of "less security" (debatable if you know what you're doing). I think the only way forward is a Free/Libre implementa…
> implementation of FIDO2 that is NOT linked to any specific device and can be modified - along with direct access to the keys. Those are the users property and should not be held hostage by hostile designs. Users should have the right to move their keys, without justification, and use whatever manager they want Is this not possible with current designs?
It pretty much is as far as I know. There are even open source hardware key specs.