News for hackers. Stuff that matters.

A comment on Web Authentication: Proposed API for accessing Public Key Credentials. Parent comment

Re:Web Authentication: Proposed API for accessing Public Key... by xori on Tuesday April 10, 2018 @11:34AM (#16802099)
A phone provides a fingerprint scanner (something you are), and holds the keypair (something you have) and when combined with a password (something you know) you have all three.

But we still need the phones to support U2F.

[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by StavrosK on Tuesday April 10, 2018 @11:36AM (#16802117)
U2F is actually the older standard, Webauthn can work with U2F, but it adds some things like user identifiers that make it more useful to authenticate with.
[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by xori on Tuesday April 10, 2018 @11:39AM (#16802152)
You're right, my bad. But I still do wish phones even supported emulating the existing FIDO U2F standard.
[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by girvo on Tuesday April 10, 2018 @12:23PM (#16802557)
Agreed. I adore U2F, and even have it running under Safari because I love it that much; but without phone support for it, my cute Yubikey really only helps for desktop usage currently.

As it stands, my pass phrase and fingerprint are the weak links, as phone logins rely on TOTP. One day I’ll be able to tap my phone against my Yubikey along with my pass phrase, and/or my fingerprint. That would be lovely.

[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by StavrosK on Tuesday April 10, 2018 @05:22PM (#16805580)
I was thinking about soft U2F tokens and came to the conclusion that they wouldn't be that much different from a cookie that just always bypassed the second factor for that specific browser. Of course, it could be stolen from the browser, but so could the U2F key.
[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by emilecantin on Tuesday April 10, 2018 @07:14PM (#16806514)
The browser never sees the key with U2F; everything is computed on the USB device.
[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by StavrosK on Tuesday April 10, 2018 @07:20PM (#16806574)
I'm talking about soft U2F tokens, i.e. software-based.
[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by Nullabillity on Wednesday April 11, 2018 @04:00AM (#16808964)
> One day I’ll be able to tap my phone against my Yubikey along with my pass phrase, and/or my fingerprint. That would be lovely.

That works fine for me on Android.

[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by StavrosK on Tuesday April 10, 2018 @11:43AM (#16802191)
Me too :/ It would be great against phishing.
[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by rhizome on Tuesday April 10, 2018 @11:38AM (#16802135)
a fingerprint scanner (something you are), and holds the keypair (something you have)

What segregation between these is there within the phone? Doesn't it mean the fingerprint gets you the keypair for free?

[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by mattnewton on Tuesday April 10, 2018 @11:44AM (#16802206)
If you also have the physical phone in your hands, yes.
[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by xori on Tuesday April 10, 2018 @11:48AM (#16802249)
You now have a severed finger. Where's the phone? You'll still need both items.
[ Parent | on HN ]