News for hackers. Stuff that matters.

A comment on Soft U2F: A software-based U2F authenticator for macOS. Parent comment

Re:Soft U2F: A software-based U2F authenticator for macOS by Freak_NL on Tuesday July 25, 2017 @03:51AM (#14845934)
With hardware U2F the benefit lies in not having the private key available on the client device at all. That means that copying it is impossible (without dismantling the key and using quite advanced equipment to attempt to read the private key).

With software U2F I think you are right; client-side certs just work, now, in all major browsers. Installing them is a hassle, but it can be managed with good documentation (we use client-side certificates for authentication at the moment).

Personally, I don't think software U2F should exist outside of development and testing scenarios.

[ Parent | on HN ]
Re:Soft U2F: A software-based U2F authenticator for macOS by hdhzy on Tuesday July 25, 2017 @03:00PM (#14850822)
Well you can have client certificate on hardware. Some hardware even has attestation built in [0] so you can be sure that the private key is non exportable. PIV based smartcards do not require external drivers on most modern OSes.

[0]: https://developers.yubico.com/PIV/Introduction/PIV_attestati...

U2F is designed for only one algorithm and allows a lot of optimizations (e.g the private keys are not really stored on the device but rather generated from master seed and origin). That's why they are substantially cheaper than PIV devices.

[ Parent | on HN ]