What I Wish I Knew About U2F and Other Hardware MFA Protocols

Re:What I Wish I Knew About U2F and Other Hardware MFA Proto... by jrockway on Friday April 16, 2021 @07:17PM (#26840081)

U2F is the predecessor to the current standard, WebAuthn. If a web app supports WebAuthn, then that integrates with native keystores (Windows Hello, Face ID, whatever Android has), as well as hardware keys. The site operator has some flexibility to prefer certain methods (platform vs. external) and devices (attestation).

I wrote an authenticating proxy that uses Webauthn: https://github.com/jrockway/jsso2. I don't think you should use it, but you can fire it up locally and try enrolling the various devices. Actually, you can just use Duo's demo: https://webauthn.io/

[ Parent | on HN ]

Re:What I Wish I Knew About U2F and Other Hardware MFA Proto... by shaicoleman on Friday April 16, 2021 @08:37PM (#26840603)

Unfortuately WebAuthn with the native keystores requires Bluetooth, which is a constant source of pain. That's a deal-breaker for me.

[ Parent | on HN ]

Re:What I Wish I Knew About U2F and Other Hardware MFA Proto... by jrockway on Friday April 16, 2021 @08:45PM (#26840648)

I don't think that's true. I just logged into my own WebAuthn implementation via my iPhone with an NFC security key. (Bonus points: the key was enrolled on my PC.)

The server operator can choose to reject NFC, but the implementation/standard doesn't require that behavior.

Edit: Actually, I don't understand your question. Are you trying to authenticate on a PC using your phone as the security key? If so, I don't know how to do that. I just enroll Windows Hello and Face ID.

[ Parent | on HN ]

Re:What I Wish I Knew About U2F and Other Hardware MFA Proto... by tialaramex on Saturday April 17, 2021 @12:05AM (#26841493)

Google built a not as yet standard way for Chrome on a PC to reach out to a Phone and get WebAuthn credentials that way. It has to talk to the nearby phone somehow and so Bluetooth comes into the picture. I've never used this, and I don't know anybody who has, my Security Key plugs into USB, my cheaper FIDO dongle likewise, no Bluetooth here.

[ Parent | on HN ]

Re:What I Wish I Knew About U2F and Other Hardware MFA Proto... by Rafert on Saturday April 17, 2021 @01:51PM (#26846078)

I think you're confusing the cloud-assisted Bluetooth (caBLE) transport with actual built-in device keystores. Google is testing this on their properties while it's being standardized in CTAP and WebAuthn, see https://github.com/w3c/webauthn/issues/1381

[ Parent | on HN ]