Soft U2F: A software-based U2F authenticator for macOS • Hacker News Board

Re: Soft U2F: A software-based U2F authenticator for macOS

#111

Post by hdhzy » Tue, Jul 25, 2017, 7:00 PM UTC

Freak_NL wrote: post #92

Rjevski wrote: post #32

What's wrong with client certificates? Instead of reinventing the wheel they should've just used those which would've given browser vendors a reason to improve their UX regarding client certs.

With hardware U2F the benefit lies in not having the private key available on the client device at all. That means that copying it is impossible (without dismantling the key and using quite advanced equipment to attempt to read the private key). With software U2F I think you are right; client-side certs just work, now, in all major browsers. Installing them is a hassle, but it can be managed with good documentation (…

Well you can have client certificate on hardware. Some hardware even has attestation built in [0] so you can be sure that the private key is non exportable. PIV based smartcards do not require external drivers on most modern OSes.

[0]: https://developers.yubico.com/PIV/Introduction/PIV_attestati...

U2F is designed for only one algorithm and allows a lot of optimizations (e.g the private keys are not really stored on the device but rather generated from master seed and origin). That's why they are substantially cheaper than PIV devices.

Re: Soft U2F: A software-based U2F authenticator for macOS

#112

Post by jack12 » Tue, Jul 25, 2017, 7:39 PM UTC

Freak_NL wrote: post #90

mongol wrote: post #33

U2F adoption seems quite slow. Google were in early, and later github and Dropbox. But since then? Feels like nothing happened.

Cost is the major problem, with a couple of technical/deployment issues. The technical/deployment issues to me are the lack of browser support (that means Edge, Firefox, Safari, etc.), the long and slow migration from USB-A to USB-C, and the missing parts of the mobile puzzle. With the latter I mean U2F support for Bluetooth Low Energy (BLE) and NFC on (at least) smartphones. Ideally, you could visit some secured web…

Just a heads up: on the US Amazon site Feitian has a USB-A + NFC token for $16 (and there's a one-per-customer coupon on the amazon product page to knock it down to $10).

Feitian also have a BLE + NFC + USB token for $24 (with a coupon to buy it for $16), but that requires charging a battery, is less rugged, and the USB requires a cable to connect to it.

It's not as cheap as USB-only (there used to be a $6 USB token sold), but NFC support doesn't have to cost much more (especially as the secure element chips they're built around all move towards having NFC support as a baseline anyway).

Also there seem to be a handful of Java Card implementations of U2F on github already (one of them is even sold as a Fidesmo app, if you want to pay for easy installation), so an NFC-only U2F token could presumably be had for as cheap as any javacard-compatible NFC smart card, and then just registered as a second token.

I don't think it's enough to help push U2F forward by itself, but I think if webauthn can get solid cross-browser support for U2F implemented, price won't continue to be a big problem. Having just read up on webauthn, and seeing how many browsers already have test implementations shipping, I'm pretty optimistic U2F is going to be seeing a lot more interest soon.

Re: Soft U2F: A software-based U2F authenticator for macOS

#113

Post by hdhzy » Wed, Jul 26, 2017, 1:19 PM UTC

drodgers wrote: post #103

sowbug wrote: post #44

Earlier quoted context omitted.

I'd expect the U2F protocol to be built into secure elements on laptops before a Type-C Nano comes into existence. USB-C ports are too precious to keep them filled all the time with an authentication device, and there doesn't seem to be enough room in the male side of the Type-C coupling to allow the necessary circuitry to exist in a slim form factor. Both these problems are solvable, but meanwhile secure elements ar…

Honestly, I don't know why Apple don't implement U2F on the secure enclave (activated via the TouchId sensor); it seems like such an obvious move. Maybe they're trying to get iCloud and Safari support all ready to release at-once?

Wow, great idea!

I think Web Authentication will slowly make U2F obsolete, in a sense that U2F will become one of many authentication methods, others could also be implemented. Checking WebAuth specs one can see references to Android attestation, TPM attestation so generally secure hardware elements. Implementing a U2F solution would require emulating USB exchange I guess.

Of course U2F still has an advantage that you can take your token and authenticate on a different device but unfortunately newer Yubikeys do not support U2F over NFC and there are not so many other solutions.

Re: Soft U2F: A software-based U2F authenticator for macOS

#114

Post by Buge » Fri, Jul 28, 2017, 4:49 AM UTC

RainaRelanah wrote: post #83

Buge wrote: post #72

Earlier quoted context omitted.

My bet on the reason for creating this: new Macs have no USB-A port, and there are no USB-C U2F tokens that fit flush in the port. Github isn't too cheap to buy the token. The token they want to buy simply doesn't exist.

By flush, do you mean fully hidden inside the port? Yubikey has the 4C which should work on the MacBook and is the same size as their normal keys.

I mean you put it in the port, and leave it there permanently. Moving the laptop around, putting it in/out of backpacks and bags with no risk of damage or serious snags or pressure.

Yubikey 4C definitely does not qualify.