Re:WebUSB API: draft spec to safely expose USB device servic...
by Freak_NL on Sunday April 10, 2016 @02:31PM
(#11467479)
That is probably one of the driving forces behind this and similar technologies (NFC and Bluetooth LTE integration with the browser). All technologies supported by 2FA standard Fido U2F incidentally.
So yeah, I understand why adding this to a web browser seems unwanted, but as long as the API is well-defined and built with security as its first and primary concern, this could actually improve the overall security of on-line services significantly by making two-factor authentication something your browser just does, and does right. I can recommend skimming the Fido U2F spec [1] to anyone with doubts about the applicability and necessity of this standard.
The linked article basically starts with a section on privacy and security concerns though, so that is somewhat reassuring.
So yeah, I understand why adding this to a web browser seems unwanted, but as long as the API is well-defined and built with security as its first and primary concern, this could actually improve the overall security of on-line services significantly by making two-factor authentication something your browser just does, and does right. I can recommend skimming the Fido U2F spec [1] to anyone with doubts about the applicability and necessity of this standard.
The linked article basically starts with a section on privacy and security concerns though, so that is somewhat reassuring.
1: https://fidoalliance.org/specifications/overview/ (look for U2F in particular)