News for hackers. Stuff that matters.

A comment on Web Authentication: Proposed API for accessing Public Key Credentials. Parent comment

Re:Web Authentication: Proposed API for accessing Public Key... by xori on Tuesday April 10, 2018 @11:39AM (#16802152)
You're right, my bad. But I still do wish phones even supported emulating the existing FIDO U2F standard.
[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by girvo on Tuesday April 10, 2018 @12:23PM (#16802557)
Agreed. I adore U2F, and even have it running under Safari because I love it that much; but without phone support for it, my cute Yubikey really only helps for desktop usage currently.

As it stands, my pass phrase and fingerprint are the weak links, as phone logins rely on TOTP. One day I’ll be able to tap my phone against my Yubikey along with my pass phrase, and/or my fingerprint. That would be lovely.

[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by StavrosK on Tuesday April 10, 2018 @05:22PM (#16805580)
I was thinking about soft U2F tokens and came to the conclusion that they wouldn't be that much different from a cookie that just always bypassed the second factor for that specific browser. Of course, it could be stolen from the browser, but so could the U2F key.
[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by emilecantin on Tuesday April 10, 2018 @07:14PM (#16806514)
The browser never sees the key with U2F; everything is computed on the USB device.
[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by StavrosK on Tuesday April 10, 2018 @07:20PM (#16806574)
I'm talking about soft U2F tokens, i.e. software-based.
[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by Nullabillity on Wednesday April 11, 2018 @04:00AM (#16808964)
> One day I’ll be able to tap my phone against my Yubikey along with my pass phrase, and/or my fingerprint. That would be lovely.

That works fine for me on Android.

[ Parent | on HN ]
Re:Web Authentication: Proposed API for accessing Public Key... by StavrosK on Tuesday April 10, 2018 @11:43AM (#16802191)
Me too :/ It would be great against phishing.
[ Parent | on HN ]