I clicked on this hoping it was about FidoNet ( https://en.wikipedia.org/wiki/FidoNet ).
My first thought was "Is FIDOnet still relevant after all these decades?" then remembered FIDO U2F
FIDO Alliance
41–50 of 57 posts
Re: FIDO Alliance
#42Apple, Microsoft and Google together to improve how you login to sites without password. And they will store your "secret" so that you don't need to type it. And you'll be able to recover from any device that is already authenticated. At the same time, every week we see a "Tell HN: how I lost all access to my email/site/account because of {reason}", where {reason} is some stupid thing that the AI flagged. Seems that…
Unlike username/password you can register as many FIDO devices as you like in each service so if you lose one (because Apple disabled your Apple ID or whatever) you can still login.
Re: FIDO Alliance
#43FIDO does some dirty things: >FIDO requires an attestation private key, which must be shared between a batch of at least 100,000 security keys. Using a DIY or cli app solution (application running on the host) will likely mean you'll be generating that private key yourself, this makes you identifiable across registrations. >Some sites (Cloudflare) may reject the use of attestation keys which are not found on the Fido…
In Firefox you can, and I do, tell the browser to refuse Attestation. There's a prompt during the enrolment process.
There's no reason why you should provide Attestation for the Web generally. It could make sense (though I'd argue it does not) for some specialised applications but generally it's probably a waste of your time (collating the necessary data to make it work) and your users time (now some stuff they want doesn't work and needs explicit authorisation).
Re: FIDO Alliance
#44Hmm, seminars and "certified professional" exams. I don't recall needing those in order to understand or implement username/password auth. I keep hearing this is simpler and more secure, but I really doubt explaining this to my aging parents is going to be a fun afternoon. Can we just leave well enough alone? Was never a fan of centralizing my identity in the first place.
What's there to explain? We're presumably not teaching your parents to actually implement this for a web site (although I did it in a weekend once to learn) just to use it. Do your ageing parents still have car keys? House keys at least? The physical Security Keys are probably easiest to grok for older people, because of that familiarity.
Re: FIDO Alliance
#45Earlier quoted context omitted.
> just kind of suck at p/w management. The risk/reward ratio doesn't justify it in their lives. It's also a pernicious ratio because there is almost no way to increase the "reward" portion, just decrease "risk." In my experience, solutions balanced on this type of ratio always fail to solve the fundamental problem. Which is why we have to have commercials that tell people "medicare will _never_ call you. If anyone ca…
> So, I'm assuming we can now look forward to "no one will ever call and ask for information from your key, if they do, hang up!" There's usually no way to take your key off your device, so don't worry about that :P
I guess it's possible that particularly vulnerable people might be persuaded to physically send the actual device to bad guys. I'd like to hope that existing advice to such people warns them not to send stuff to bad guys, we don't want them sending their credit cards, house keys, etc. to bad guys either.
Re: FIDO Alliance
#46FIDO does some dirty things: >FIDO requires an attestation private key, which must be shared between a batch of at least 100,000 security keys. Using a DIY or cli app solution (application running on the host) will likely mean you'll be generating that private key yourself, this makes you identifiable across registrations. >Some sites (Cloudflare) may reject the use of attestation keys which are not found on the Fido…
In Firefox you can, and I do, tell the browser to refuse Attestation. There's a prompt during the enrolment process. There's no reason why you should provide Attestation for the Web generally. It could make sense (though I'd argue it does not) for some specialised applications but generally it's probably a waste of your time (collating the necessary data to make it work) and your users time (now some stuff they want…
Chrome also allows you to say no to Attestation requests.
The only place I've seen a 'legitimate' use for requesting an attestation cert is to ensure that only specialized FIPS hardware is allowed to be registered when that is a business obligation.
Re: FIDO Alliance
#47FIDO does some dirty things: >FIDO requires an attestation private key, which must be shared between a batch of at least 100,000 security keys. Using a DIY or cli app solution (application running on the host) will likely mean you'll be generating that private key yourself, this makes you identifiable across registrations. >Some sites (Cloudflare) may reject the use of attestation keys which are not found on the Fido…
Most open source tools I've seen that implement FIDO use a shared Attestation cert[0].
[0]: https://github.com/github/SoftU2F/blob/master/SelfSignedCert...
Re: FIDO Alliance
#48The problem with the FIDO "alliance" is who runs it, which is corporate America and megabanks if you check the site. They are basically trying to be the arbiters of online identity, gaining more power than they already have. Many of these companies are also in surveillance tech. That it may or may not be more secure than existing practices is merely a side effect. Don't be fooled by the term "alliance" because you ar…
They're just trying to replace the current system of password reset calls, SMS two factor, credential stuffing, password database breaches, and a general wild wild west feeling on the Internet.
Of course it'll take more than public key authentication itself. For example in a enterprise businesses employees aren't allowed to install software, and there are procedures (however bad) to vet individuals.
Re: FIDO Alliance
#49Apple, Microsoft and Google together to improve how you login to sites without password. And they will store your "secret" so that you don't need to type it. And you'll be able to recover from any device that is already authenticated. At the same time, every week we see a "Tell HN: how I lost all access to my email/site/account because of {reason}", where {reason} is some stupid thing that the AI flagged. Seems that…
[Your account has been suspended due to user generated content not consistent with Metaverse(tm) community standards.]
Re: FIDO Alliance
#50Earlier quoted context omitted.
> So, I'm assuming we can now look forward to "no one will ever call and ask for information from your key, if they do, hang up!" There's usually no way to take your key off your device, so don't worry about that :P
I guess it's possible that particularly vulnerable people might be persuaded to physically send the actual device to bad guys. I'd like to hope that existing advice to such people warns them not to send stuff to bad guys, we don't want them sending their credit cards, house keys, etc. to bad guys either.
Mailing keys away would only be economical for targeted attacks. Trojans are more scalable. Even that is a big improvement as malware distribution is harder than credential stuffing, email hijacking, or SIM swap attacks.