Beyond Passwords: 2FA, U2F and Google Advanced Protection

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by xaduha on Thursday November 15, 2018 @05:50AM (#18458321)

I wish that SmartCards were used more for this purpose https://github.com/OpenSC/OpenSC/wiki

There's an applet you can load into your own JavaCard presumably https://github.com/LedgerHQ/ledger-u2f-javacard

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by IloveHN84 on Thursday November 15, 2018 @06:58AM (#18458552)

They died when everybody ditched Java applets for web.

I wish they were more useful and programmable without a Java applet (eg. Custom C/C++ driver)

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by xaduha on Thursday November 15, 2018 @08:18AM (#18458995)

Smartcards aren't dead, they are all around us in sim cards and credit cards.

> They died when everybody ditched Java applets for web.

How's that relevant? Are you saying no one uses Java anymore?

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by IloveHN84 on Thursday November 15, 2018 @02:37PM (#18462512)

Well, Java for frontend / client side not anymore, since Java applets are insecure and can be exploited easily.

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by xaduha on Thursday November 15, 2018 @03:44PM (#18463108)

Java applets for browsers and Javacards have nothing in common except the name and the language.

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by Technetium_Hat on Thursday November 15, 2018 @09:20AM (#18459373)

Many smart cards use an extremely minimal version of java, so I imagine that java applets were able to interact with them more easily.

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by xaduha on Thursday November 15, 2018 @09:29AM (#18459441)

I'm not saying that writing for Javacards is easy, but that's not the problem here. There is plenty of software written already

https://github.com/EnigmaBridge/javacard-curated-list

It's just didn't catch on, there's no thriving community around it. You have the software, you have the hardware (search for JCOP21 or JCOP3 on Aliexpress), but no users.

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by rocqua on Thursday November 15, 2018 @07:37AM (#18458747)

The JubiKeys support a smart-card functionality.

There is a similar thing in SIM-cards, but that is under-utilized as well.

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by xaduha on Thursday November 15, 2018 @08:13AM (#18458967)

You mean YubiKey? I know, but it's hard for me to view YubiKey as anything other than a proprietary solution. It's great they built a business out of it, but at the same time I want open-source options to exist.

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by zyberzero on Thursday November 15, 2018 @11:21AM (#18460504)

Enter Solokeys [0]. They support U2F out of the box, and they say OpenPGP (can be used for SSH) is in the works.

I've yet to receive mine, so I don't know if they work or not..

[0] https://solokeys.com

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by notamerican on Thursday November 15, 2018 @07:52AM (#18458837)

> There is a similar thing in SIM-cards

Got any good resources on this subject? I'd be interested to know more :)

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by xaduha on Thursday November 15, 2018 @08:28AM (#18459040)

I'm not entirely sure what he means by that, but SIM-cards are smartcards.

https://en.wikipedia.org/wiki/Subscriber_identity_module#/me...

And you can buy smartcards in this formfactor e.g. https://www.cardomatic.de/epages/64510967.sf/en_GB/?ObjectPa...

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by rocqua on Thursday November 15, 2018 @11:52AM (#18460849)

Look into EAP-SIM and EAP-AKA for some concrete examples.

I believe mobile payment also uses the SIM card, but I'm not sure.

For a more general overview see https://en.wikipedia.org/wiki/Universal_integrated_circuit_c....

There is apparently a toolkit to design applications to run on the SIM https://en.wikipedia.org/wiki/USIM_Application_Toolkit

I don't know of any other implementations. An SSH auth module using SIM would be pretty cool.

[ Parent | on HN ]