Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless login done right

programming.tudorconstantin.com

Post reply on HN
Print view View original

11–20 of 56 posts

Re: Passwordless login done right

#11

Post by namochan »

millsuk wrote: post #5
struct wrote: post #3

Cool idea, how is re-authentication handled beyond the initial sign up? Do you get a text message each time?

Push notification to your phone. They don't have iOS support yet which counts me out from trying it out.

I have quite a few android devices, but the play store tells me that "This app is incompatible with all of your devices". But I'll keep an eye on this, seems nice. I guess it's two-factor enough, because I have a password on my phone.

Re: Passwordless login done right

#14

Post by Globz »

I fail to see the 2 form factor but here's something I found inside the documentation an application can request the last 3 digits of a user phone number + valid email to allow a successful login.

http://unloq.readme.io/v1/docs/authenticate

DIGITS_REQUIRED

Please provide the last 3 digits of your profile's phone number. (Only when application has its authentication type set to email and digits

Re: Passwordless login done right

#15

Post by nly »

This method isn't secure unless both the website and phone display a code (e.g. a short hash over a Diffie-Hellman, or other, shared secret and the session id) so you can determine which session you're authenticating. Otherwise, anyone who can determine that you're logging in (traffic analysis is possible even if it's encrypted) can initiate a timing attack.

I've also only glanced over the API docs, but it looks like the app just provides a secret to the server with each authentication request. So this is still essentially password authentication, you're just relying on your phone being more secure than a potentially key-logged terminal.

Re: Passwordless login done right

#16

Post by chrisfarms »

juriansluiman wrote: post #8

> Basically, this is an extremely secure, 2 form factor, idiot proof login system As far as I know, factors are 1. Something you know (password) 2. Something you have (a dongle or phone) 3. Something you are (iris or fingerprint) With only pressing a button on a phone, how can this be two-factor? There is no password ("passwords are obsolete" and usernames are not a knowledge factor in multi auth) and nothing of biom…

I guess if the phone has a pin/pattern unlock... that could be argued as the "something you know" part.

Re: Passwordless login done right

#17

Post by nodata »

juriansluiman wrote: post #8

> Basically, this is an extremely secure, 2 form factor, idiot proof login system As far as I know, factors are 1. Something you know (password) 2. Something you have (a dongle or phone) 3. Something you are (iris or fingerprint) With only pressing a button on a phone, how can this be two-factor? There is no password ("passwords are obsolete" and usernames are not a knowledge factor in multi auth) and nothing of biom…

Perhaps the timing of the press is a factor.

Re: Passwordless login done right

#18

Post by snupa »

olemartinorg wrote: post #7

I'm intrigued! But a few questions/comments: * How is this two-factor? I only see one factor (a thing you have, your phone). Email adresses are not secret. * Again, email adresses are not secret. How do you limit login-spamming? I don't want to wake up in the middle of the night because someone is trying to break into my account. * What about timing attacks? If i stand over your shoulder while you're in the library -…

* Once you create an application, you can set how you want your users to provide their identity. You can ask just for the email, email+digits or just their phone number. However, when you deny a notification from your phone, the user is required to provide the second identifier (email requires additional last 3 digits, phone number also requires email, and email+digits requires the full number in addition) * The system only allows a single login per user, so if you have initiated the request first, somebody else would have to wait for you to finish the request until they can initiate it). There are additional limitations happening in the background that prevents spammy logins to reach the user's phone. * We're still trying to improve our UX, so we might take that in consideration for future releases

Re: Passwordless login done right

#19

Post by arethuza »

olemartinorg wrote: post #7

I'm intrigued! But a few questions/comments: * How is this two-factor? I only see one factor (a thing you have, your phone). Email adresses are not secret. * Again, email adresses are not secret. How do you limit login-spamming? I don't want to wake up in the middle of the night because someone is trying to break into my account. * What about timing attacks? If i stand over your shoulder while you're in the library -…

So two factor would be "something you know" (password) and "something you have" (phone) - and this just has the latter. So it's single factor but with a different single factor than the passwords we are all used to.

Re: Passwordless login done right

#20

Post by snupa »

chrisfarms wrote: post #16
juriansluiman wrote: post #8

> Basically, this is an extremely secure, 2 form factor, idiot proof login system As far as I know, factors are 1. Something you know (password) 2. Something you have (a dongle or phone) 3. Something you are (iris or fingerprint) With only pressing a button on a phone, how can this be two-factor? There is no password ("passwords are obsolete" and usernames are not a knowledge factor in multi auth) and nothing of biom…

I guess if the phone has a pin/pattern unlock... that could be argued as the "something you know" part.

yes, currently the app has an optional pin unlock that you can set per profile. However, we're looking to add additional "something you know"'s on the user's part to minimize unauthorized access to the device.
Post reply on HN