71–76 of 76 posts
Looks great for web content, but how does it support the workflow of signing up for a website on my browser and then downloading their mobile app, and signing in on the app without a password? Or is that TBD?
How costly are these devices ? Are these readily available in the market to buy ?
There are competing U2F keys, but I don't know of any competitors that support FIDO2 yet.
I wonder if this API can be coaxed into providing a method of authentication for "the other" 99% of people and use cases, without a hardware token and in a device-independent fashion, using passwords only . That may sound contradictory or that it misses the point, but let me explain. The password can be used to locally decrypt a secret key that is stored on the server at registration time, and that is retrieved based…
You just described https://github.com/sakurity/securelogin
While I congratulate you for your efforts, I can't really see the point of implementing this outside of the browser as anything more than a proof of concept. The whole idea is to replace the trust in a web service with the trust into the user agent, I would approach this as specification/standardization work, not something you whip up an electron app for.
The Failsafe work is fascinating, I just discovered it thanks to your link and I'm digging in.
Earlier quoted context omitted.
You just described https://github.com/sakurity/securelogin
It's an interesting project, although the blockchain incarnation seems to go in a different direction, more akin to social login. While I congratulate you for your efforts, I can't really see the point of implementing this outside of the browser as anything more than a proof of concept. The whole idea is to replace the trust in a web service with the trust into the user agent, I would approach this as specification/s…
It's definitely would be more successful being part of the browser, but Web Auth API is too slow to move so I went out to make a PoC instead. In the end: I hate electron apps now :) Also I now know what kind of effort is needed to change the auth space... I don't believe it will happen short term :/ It's too hard and too little incentive to change things.
The only perk of being outside the browser is being able to auth regular desktop apps like Spotify or Btc wallets. But yes, 99% are web apps so seamless in-browser login would make more sense.
I wonder if this API can be coaxed into providing a method of authentication for "the other" 99% of people and use cases, without a hardware token and in a device-independent fashion, using passwords only . That may sound contradictory or that it misses the point, but let me explain. The password can be used to locally decrypt a secret key that is stored on the server at registration time, and that is retrieved based…
I'm not sure I understand the advantage here. You're still dependent on a password.
> you will have a strong authentication scheme that is as secure as your (salted and stretched) master password
So, as secure as we have now.
> where you are guaranteed that a compromise on one of the sites does not spill over to the rest
Why not? If I use the same password for all sites, the attacker can just use that password to authenticate to all other sites (by decrypting all the other secret keys with it).
> Unless you choose to reuse a username, your identities will be independent and unlinkable
They're independent and unlinkable with passwords now, too. The only improvement is that your password doesn't go over the wire, which, admittedly, is a moderate improvement.