Apple, Google, and Microsoft commit to expanded support for FIDO standard

https://www.apple.com/newsroom/2022/05/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard/

by feross • 4 years ago

214 152 4 years ago

hawkeyedan• 4 years ago

Of course if you’re one of the platforms, owning some or all of other people’s login processes does happen to be a win for you.

Ajedi324• 4 years ago

WebAuthn is way better than (for example) OAuth in this regard, since the identity provider doesn't actually hold your private key; but I agree there are still potential concerns about vendor lock-in.

Ideally there will be third-party credential databases (just like with password managers), and a way to export your keystore and import it into another provider. That would solve this problem.

Zamicol6• 4 years ago

Why is there a need for a third party at all?

PikachuEXE• 4 years ago

This one is from fidoalliance.org

soci• 4 years ago

As far as I understood, FIDO pretends to change the login/password security model to one based in biometrical data like fingerprint or faceid. But, didn’t we all agree that “biometrical data is a login and not a password”? How can FIDO be more secure than different passwords per website or service?

jillesvangurp3• 4 years ago

Because there is no way to enforce those passwords are actually different or not endless variations of the same easy to guess password. Users have been doing all the wrong things with passwords ever since they were invented. I actually caught my father with an actual notebook of all the key passwords a few years ago and introduced him to Bitwarden. A burglar could have gotten access to pretty much everything with that notebook.

alaricus11• 4 years ago

Most of my accounts are unimportant and nothing would happen if they stolen or hijacked. I totally write down those passwords somewhere. The important ones are not in writing anywhere (like bank logins). There is no reason to pretent all accounts are similarly important or that the same security policies should apply.

fuzzy2• 4 years ago

That's not quite correct. FIDO is using public key cryptography. To not transmit secrets. On an authenticator, the private key could be (locally) secured using Face ID or whatever, even just using a PIN.

warkdarrior• 4 years ago

Not quite right. FIDO2 uses a public/private key pair to authenticate you to a website. The private key is stored on a device you control. The device could be something like a Yubikey, which does not authenticate you, or like a mobile phone, which typically authenticates you using a biometric. In any case, the website sees a FIDO2 authentication request from you based on the private key, not on your biometric.

vbezhenar• 4 years ago

didn’t we all agree that “biometrical data is a login and not a password”

No? For many years almost every smartphone on the market ships with fingerprint reader or face recognition acting as an alternative to pin-code.

r00fus2• 4 years ago

Well, the assumption is that ownership of the device and ability to unlock it (face | fingerprint | passcode) present 2 factors for authentication of the FIDO local keychain.

Passwords are time-tested and failed approach. They rely on user using different passwords for each system. Most people suck at passwords. Just look at your parents (or youngsters - your grandparents) - they probably suck. We probably would at their age also, except we use tooling like password managers that are still frustratingly difficult for non-techies.

boudin• 4 years ago

Passwords have their problems but this will not make things more simple so I really doubt it will be more secure in the end. If it's adopted it will just change attack methods.

On my side, I do not trust any company mentioned in the article and do not use any of their product. If i'm required to have anything to do with them, I'll just be locked out (and I don't think I'll be the only one)

darkwater• 4 years ago

can we stop with this ageism? There is plenty of teenagers or people in their 20s or 30s with ludicrous passwords. Unless you are a techie, passwords are chores and nobody wants to do complex chores.

diffeomorphism• 4 years ago

As far as I understood, FIDO pretends to change the login/password security model to one based in biometrical data like fingerprint or faceid.

No, not really. Much more commonly it is a security token (like a yubikey) or a TMP in another device.

https://en.wikipedia.org/wiki/FIDO_Alliance

How can FIDO be more secure than different passwords per website or service?

By generating these "passwords" for each website and service and each time you use them.

AnonHP• 4 years ago

No, not really. Much more commonly it is a security token (like a yubikey) or a TMP in another device.

If you see this reply within the short edit window, did you mean TPM (and not TMP)? I don't know what a TMP is in this context.

tempfs• 4 years ago

* We require you to have an account with us which we will use to track you everywhere.

** We will fingerprint your phone in order to abuse it as a pseudo hardware token.

*** Two of us also completely control your phone too, with the third one trying to worm our way into CPU-resident code.

This ought to be fun!

olliej• 4 years ago

* I thought only one of these companies was notorious for spyware and surveillance? One has made not tracking/privacy a primary marketing angle, the other is kind of an also-ran on mobile? That said I think I'm 100% on your side of the "hooray, lets require an account with some finite set of identity providers, wcgw?" debate

** This doesn't even make sense. The entire point of the modern secure elements is that they are a "real" hardware token. I get that a bunch of android devices are penny-pinching to the extent they may be dropping actual secure elements but the seems like something google could mandate real secure elements.

*** Agreed with you on <*> + A&G controlling the platforms, but curious about who is trying to get CPU-resident? I think I may have missed this latests insanity :D

armchairhacker• 4 years ago

The HN crowd hates passwordless sign ins but most of us actually know how to keep our passwords secure, at least relative to the average user. Non-techies have their passwords leaked and identities stolen time and time again. And get frustrated when they keep forgetting their password. Biometric passwords are incredibly useful for these people.

Of course Apple, Google, Microsoft have to keep non-biometric password authentication. Otherwise a lot of people (including me) will have to simply stop using their products, not even because of privacy, just because I doubt a Linux computer without a camera or old iPhone model will work for them.

Some argue that users without biometric authentication will be flagged suspicious and pressured to hand over biometric data. But honestly, I think so many people will stick to regular passwords, and more will be physically unable to use biometric passwords, so it won’t work.

Overall I think having the option to use biometric authentication is a net positive. Companies want them to get user data, but non-technical people want them because (when done right) they’re a lot easier and more secure than passwords.

alaricus11• 4 years ago

Your solution to insecure passwords is to hand the keys of the internet to a small number of companies? This is beyond ridiculous.

Not only this creates single points of failure, it also entrenches the already existing monopolies out there. (not to mention forcing everyone to dox themselves by providing biometrics)

H8crilA2• 4 years ago

Uhm, it's the public key, and yes pretty much anyone can have my public key. That's why it's called the "public" key. The private key never leaves the dongle, much like in a hardware cryptocurrency wallet.

I really fail to understand the whole confusion about FIDO, the amount of misinformation in the threads here (like in the parent comment) is staggering. It is a fantastic invention for expanding privacy& security. Maybe a lot of people confuse it with "log-in with X"?

mrtksn8• 4 years ago

Passwords are extremely counterintuitive and require understanding of the architecture of the systems to make any sense of it. Why do you need a password to your phone and then why do you need a password for the apps and websites? Why do you need an SMS and why do you need a code generator? Why do you sign in into your Google account to sign in into Stackexchange? None of that makes unless you understand the distinctions between systems and all that happens when we race to make the experience seamless as if there's no distinctions. It's getting so messy that phishing becomes hard to detect even for the more experienced people, you simply follow the instructions of typing codes and clicking links.

It only makes sense to have a device that can identify you personally and then use that device to get identified to other systems. That's actually why anonymous accounts and fingerprinting are very effective in tracking people(remember that companies like FB can identify you without you ever creating an account with them).

Passwords only use is account sharing IMHO. Once everyone goes passwords-less, sharing a Netflix account will be a thing of the past for example. Maybe this is one of the motivations of the big tech but overall I think it's for the greater good and sharing a service will be served better through explicit means of sharing the service.

mschuster915• 4 years ago

It only makes sense to have a device that can identify you personally and then use that device to get identified to other systems.

What to do then if the device gets lost, damaged, soft-bricked, or worst case seized by the police?

alaricus11• 4 years ago

This sounds dystopian and also really bad engineering.

First, I don't want a single login for everywhere. For obvious privacy reasons, using multiple disjoint accounts is preferable.

Second, using a device to identify someone creates a single point of failure. That device will get stolen or will break at the most inconvenient time. The battery will run out. Or something else will happen.

This is far from theoretical. My phone died on a business trip. It turned into a nightmare because almost everything needs two factor authentication. It's really bad not being able to spend money you have. That is when I learned the value of cash.

The obsession with passwordless logins and 2FA is anti-consumer. It needs to stop.

anilakar2• 4 years ago

most of us actually know how to keep our passwords secure, at least relative to the average user.

I'm an IT professional and despite using a password manager, I still prefer a physical security solution to a cybersecurity one. An attacker might be able to dump unencrypted secrets from my password manager, but they'll have to pry that U2F token out of my cold dead hands.

The password field in its current inlined form has to go in one way or another.

V1ndaar• 4 years ago

but they'll have to pry that U2F token out of my cold dead hands.

That is a trade off between attack surface and difficulty of the "hack" though. Depending on who and where you are, getting your physical token by force is trivial. If your token is important enough, there will be plenty of people that won't shy from using violence.

_trampeltier• 4 years ago

I use for some websites a Yubikey. But for me it feels very "blackbox like". I did read about a lot of functions on the internet, but I'm affraid to play with it, because I won't break anything. Also in the end, there is allways a second password for emergency. So if your password list leaks, the emergency password leaks with it for most people I guess.

philistine4• 4 years ago

Some argue that users without biometric authentication will be flagged suspicious and pressured to hand over biometric data

The distinction is about the usage of modern technologies, not handing over biometric data. There will come a time where you will need to use a device with a Secure Enclave or a TPM. That device will keep biometric data on device. You will not hand in the data, you will have to use the feature.

everdrive• 4 years ago

Non-techies have their passwords leaked and identities stolen time and time again. And get frustrated when they keep forgetting their password. Biometric passwords are incredibly useful for these people.

In other words, broad technology adoption will always dilute and degrade the quality of different technology solutions.

zozbot2343• 4 years ago

People will get even more frustrated when their flimsy physical authenticators break down. Passwordless authentication is perfectly okay for a service like a physical bank, employer etc. that can always check your identity and re-enroll you via some other means if need be. It's a disaster in the making for something like Google, Facebook, MS etc. etc. that offer no such thing. Make no mistake, the same people who pick weak passwords today will neglect proper care about any kind of disaster recovery scenario.

The best you could do is use a "software-based" or "virtual" authenticator that explicitly refuses to protect against a user cloning and subsequently restoring its identity, at least as a last resort. Not good enough for bank payments, ofc. but plenty usable for everything else.

jillesvangurp3• 4 years ago

Historically, it's bad news when big corporations get involved with standardizing anything security related. It generally means it's going to be complicated, convoluted, and hopelessly tied to proprietary stuff you can only get from these big corporations. Interoperability is almost guaranteed to not be a thing.

Just look at how the big FANG companies managed to adopt OpenID and yet made it so that it can't be used to authenticate users between them. They never liked identity federation because it would mean not controlling the user's identity completely. Google loves identity standards as long as Google is the one and only party doing the authenticating. Same with Microsoft. Apple for sure is not going to let anyone do anything that matters on their platforms.

That's why people still use simple email/password as a way to authenticate. It's just too much of a pain to implement anything else for independent web developers. Take fido/webauthn for example, which FIDO standardized and which then got restandardized/reimagined by the W3C as webauthn. That stuff was delivered years ago in a half-assed way. Pretty much the only widely used thing in this space is yubikey. The only people I know that actually use that or know about it are developers.

Nobody ever did the obvious thing of hooking this stuff up to biometric readers deployed by the billions in the form of phones using either photo recognition or finger print readers, laptop finger print readers, etc. Such an obvious thing to do. Never happened. What are Google and Apple waiting for? What's the holdup? Do they lack the imagination or is there another reason that perfectly sane proposals from engineers they employ to do something like that consistently get shot down by management? Which is probably exactly what happened. Over and over again.

They fundamentally don't like security standards that reduce their grip on user identity and "owning" that.

microtonal3• 4 years ago

On Apple platforms, you can use webauthn with Touch ID and Face ID in Safari. For some reason it doesn't work on all sites (probably because they implement the older FIDO standard, not webauthn?).

These passkey FIDO credentials mentioned on the linked post are also activated with Touch ID on macOS. I have passkey configured on one or two websites and I authanticate with Touch ID. (And still a password, but it's the first step.)

number6• 4 years ago

The only people I know that actually use that or know about it are developers.

Never saw this used outside of the tech space. Even adoption af standart password managers is painfully slow.

Avamander6• 4 years ago

For some reason it doesn't work on all sites (probably because they implement the older FIDO standard, not webauthn?).

Because Apple decided to improvise and added some broken and nonstandard "user interaction" requirement to Webauthn. With a whitelist for the big players.

jsmith99• 4 years ago

What happens if they lose the device?

xyzzy1232• 4 years ago

The device tends to be tied to an underlying "cloud identity" (apple id, google account, microsoft account etc).

You can use that account to re-enrol / manage devices etc.

Ideally people have more than 1 device enrolled to enable easy fallback if one is lost. However, if the user loses access to their primary / cloud account for any reason, they will have a bad day.

wereHamster• 4 years ago

The FIDO2 spec is written by someone who has no idea how web apis work. Lots of it is based on CBOR instead of JSON which makes it a PITA to handle in JS code (yes, there is a cbor npm library but why… WHY?!?).

robocat• 4 years ago

CBOR

Ugggghh. https://en.wikipedia.org/wiki/CBOR

Negative numbers are encoded in such a way that can express a number than can’t fit into an int64. Undefined can be encoded. Floating point numbers are sent raw, so Infinity, -Infinity, -0, Signalling NaN, other NaN values can be encoded. A horrific choice for a security related API - a security API should never add unnecessary corner cases.

  Type 1 encodes negative integers, with a value of −1−count, for values from −2^64 to −1.

  The values 20–23 are used to encode the special values false, true, null, and undefined

  Short counts of 25, 26 or 27 indicate a following extended count field is to be interpreted as a (big-endian) 16-, 32- or 64-bit IEEE floating point value

Edit: oh god no. https://www.rfc-editor.org/rfc/rfc8949.html Epoch-Based Date/Time allows 5 different integer or floating point representations (what to do with NaN numbers unspecified, so t+Infinity and beyond are representable). Tag number 36 is for MIME messages. Read the rest of the RFC for a truely hideous kitchen-sink specification.

pg_bot• 4 years ago

I agree that CBOR is unnecessarily shoe horned into the spec, but it honestly isn't that bad. IMO there are two other problems that need to be resolved for webauthn to go mainstream. The first is the fact that there is no mechanism for changing/updating the url tied to a device for a website. This is intentional for phishing reasons, but if you want to rebrand or are acquired you're going to run into problems. The second is the frontend JS API is a bit awkward to implement.

tialaramex2• 4 years ago

WebAuthn is a web protocol. FIDO however is a device protocol.

On the Web, ASCII human readable JSON is a great choice. On a cheap USB device ASCII human readable JSON sounds like a lot of extra work for no reward.

The device doesn't need to implement most of CBOR and if all you use it for is WebAuthn you don't either.

mschuster915• 4 years ago

Nobody ever did the obvious thing of hooking this stuff up to biometric readers deployed by the billions in the form of phones using either photo recognition or finger print readers, laptop finger print readers, etc.

The last thing I want to expose to some random shady internet site is my photo or fingerprint.

jillesvangurp3• 4 years ago

The photo or fingerprint never leaves your device ...

currysausage2• 4 years ago

If it's FIDO2, then you don't actually expose biometrics to the site. The verification is done on device and unlocks a key saved in the TPM/secure enclave.

Of course, once Face ID/Windows Hello logins on the web become a thing, web sites may trick users into enabling their regular camera instead, for whatever reason.

jolux• 4 years ago

Actually Apple does support using Touch ID and Face ID for WebAuthn on their platforms, it even works in Chrome.

judge20204• 4 years ago

You can try it currently - set an iOS device as a development target in Xcode, go to the iOS developer menu (settings->developer) and turn on the passkey option[0]. Then, on a desktop or laptop with Bluetooth and in a Chromium-based browser, attempt to enroll a security key on a website that supports Webauthn - Chrome will popup the prompt to "add a new Android device", which will then show a QR code that you can scan on your iOS device. It'll prompt you to enroll a security key with the text about "save a passkey for this account in iCloud Keychain"[1]. In reality, all it does is create and sync fresh security key private keys for use across devices, with interoperability over BLE so it's easier to use them even if you don't have an expensive iMac.

0: https://developer.apple.com/documentation/authenticationserv...

1: https://photos.app.goo.gl/5LwhDsXbWg4yb6326

_wldu• 4 years ago

Yubikeys are awesome. I have a copy of a signing only PGP key on a Yubikey and I use it to sign all of my git commits. Easy and very secure. Cheap too.

jml7c5• 4 years ago

Cheap too.

Doesn't it cost $45? There's the FIDO one that's less expensive, but I thought it couldn't be used for signing commits.

merb• 4 years ago

Just look at how the big FANG companies managed to adopt OpenID and yet made it so that it can't be used to authenticate users between them. They never liked identity federation because it would mean not controlling the user's identity completely. Google loves identity standards as long as Google is the one and only party doing the authenticating. Same with Microsoft. Apple for sure is not going to let anyone do anything that matters on their platforms.

actually OpenID Connect 1.0 - the thing that most companies use (like google, apple, microsoft) actually does not yet support Federation. OpenID Connect is basically a little bit more than OAuth2 (which was never about Federation)

Of course there is a draft spec about federation: https://openid.net/specs/openid-connect-federation-1_0.html (unfortunatly only microsoft is included and not google), there is also: https://openid.net/specs/openid-connect-self-issued-v2-1_0.h... (also only a draft one...) but I'm pretty sure that both will probably allow the usage of federation at one point - at least for Commercial entities. Because Google Cloud Identity actually supports SCIM 2.0 and upstream OpenID Connect IdP's or SAML2 (https://cloud.google.com/architecture/identity/keycloak-sing...).

the original OpenID Authentication spec was about federatation, but barley nobody implemented it. (I can only think about StackOverflow (which dropped it in 2018) and something at RedHat/Fedora - can't remember?)

octoberfranklin• 4 years ago

Friendly reminder that device attestation is part of FIDO and webauthn.

It isn't enough that both your device and the website speak the protocol. The website gets to cryptographically verify that your device is not under owner control. If you want a FIDO/webauthn device that lets you have the key material (like HOTP does), you're out of luck. No owner-controlled devices allowed.

dane-pgp• 4 years ago

That's an important observation. We're going to go from "Log in with your Apple, Google, or Microsoft account" to "Log in with your Apple, Google, or Microsoft hardware".

nonrandomstring• 4 years ago

No owner-controlled devices allowed [1].

This is actually a key point with respect to digital rights.

When you analyse the debacle that put Jordan Peterson in the spotlight it was not really about gender pronouns as such, but about compelled speech. Compelled anything is a problem. Compulsion removes responsibility. For example, I am currently not compelled to own a car, so I can make the choice to help the climate by walking. I am not compelled to own a television, as in Orwell's 1984, so I can select my own entertainment and news.

What does this have to do with cybersecurity?

Ownership and control are central to the psychological motivations that allow security to work at all.

Let's ask the question, would you allow a stranger to dump their possessions in your lounge for a few weeks? No. You'd at least charge them rent for storage. Stuff that takes up your space, that you cannot use, and are responsible for is an encumbrance.

Now let's say that a government or some cabal of tech-monopolists, begin forcing you to shoulder encumbrances that you must install in your home, or walk around carrying - physical devices that you do not own in any real sense. This is an imposition. An analogy that springs to mind is the US constitutional third amendment on the quartering of soldiers in private homes without the owner's consent [2].

With secure enclaves we are seeing a drift toward devices as both an encumbrance and imposition. Hardware one is compelled to use and take responsibility for, such as repair or charging batteries, which serves the interests of others (to track and identify you) is a cost without benefit, and has no future.

Unless you physically attach it, like a prison tag, you can no more compel a person to carry an object than you can compel their speech. Unless the owner acts by volition, and chooses to take responsibility for an object in their own self-interest, various forms of sabotage are inevitable.

I've seen this where workplaces have tried to push workers into carrying a "company smartphone". It gets "lost". It gets "broken". People lock them and then "forget" the password.

Security solutions need the consent and cooperation of both subjects. Otherwise they are not "security", but simply means of control. At the very least we should stop dignifying them with the word "security".

[1] "Owner-controlled" is already a tautology. Ownership implies control (and freedom to dispose of) and vice versa. Anything else is simply "in my possession" or "upon my person" as legal-people would say.

[2] I never understood this seemingly ridiculous language about garrison of soldiers etc, but it increasingly makes sense to me as a catch all for any agent placed on my property. Hence I think that secure enclaves touch on 3rd amendment rights.

ryukafalz2• 4 years ago

This is a good point, but I don’t know of any sites that actually do this. I hope it remains that way.

I do wish the standard didn’t include that at all.

e2le• 4 years ago

Cloudflare is one example, using a security key not found in the FIDO Metadata Service, will not work on their site. This precludes the use of any hacker-friendly solution (making your own).

Supported: All security keys found in the FIDO Metadata Service 3.0, unless they have been revoked for security reasons.

https://support.cloudflare.com/hc/en-us/articles/44068890480...

Attestation keys, aren't very "privacy friendly" either and it's much worse for those who wish to create their own key.

Usually, the attestation private key is shared between a batch of at least 100,000 security keys of the same model. If you build your own OpenSK, your private key is unique to you. This makes you identifiable across registrations: Two websites could collaborate to track if registrations were attested with the same key material. If you use OpenSK beyond experimentation, please consider carefully if you want to take this privacy risk.

https://github.com/google/OpenSK/blob/f2496a8e6d71a4e8388849...

alaricus11• 4 years ago

It is a terrible idea to let Microsoft, Google and Apple to redesign a passwordless future. They don't have a spotless record.

willis936• 4 years ago

Is there anyone else that can?

alaricus11• 4 years ago

literally anyone else.

anjel• 4 years ago

The EFF

james_smith_007• 4 years ago

Sorry folks, I need to test hyperlinks, so here is a link to the [Apple website](https://apple.com/)

forgotmypw17• 4 years ago

If you think this all sounds terrible, it's time to start building your alternative.

sph3• 4 years ago

There already is, at least for the techies: YubiKey + OTP with your password manager.

Non techies are SOL as usual. Proper password education apparently is too hard, so big tech is frothing at the mouth to get total control over your password management so you can't ever leave.

JustFinishedBSG• 4 years ago

OTPs are terrible and can be MITMed. Meanwhile the non-OTP part of Yubikeys is exactly what the article is talking about.

Avamander6• 4 years ago

If Webauthn is not to your liking you can also do mTLS, both have large-scale deployments and usage.

dandanua• 4 years ago

FIDO standard by itself is a great technology, very secure and very well-thought. You can login to a service only if you possess a hardware token, which can't be cloned. Also, it automatically saves you from phishing sites.

But I share the fear of others that integration of this standard, curated by the top management of mega corporations, will lead to diminishing of its advantages.

FIDO keys give power to users, which is a threat to power hungry monster corporations.

alaricus11• 4 years ago

I don't see what problem FIDO is solving. As a consumer it's not solving any of my problems.

However, it is a great mechanism for vendor lock-in and for requiring Google/Apple/Microsoft approval for accessing large sections of the internet.

cute_boi2• 4 years ago

Good news for US government!!!. They can now track everyone easily :)

russelg• 4 years ago

And before?

hexo• 4 years ago

Thanks, I already hate it.

867-5309• 4 years ago

(Fast IDentity Online)

nuker• 4 years ago

What about multiple accounts on same device?

dancemethis• 4 years ago

Why use such a good Frank Zappa reference for such a prone-to-be-bad thing...

jpm_sd• 4 years ago

Let's do a mini Ask HN here in the comments.

Is it a good idea for me to buy Yubikeys or Titan keys for my personal Google account? My wife's? My childrens'? Will that make it less likely, or more likely, that I eventually get arbitrarily locked out? These are accounts that we use on Windows PCs, Chromebooks, and Android phones. The keys would never leave the house. I think.

I know the phones sorta fulfill this function already, but lost phone = big trouble, right?

alaricus11• 4 years ago

I lost my phone on a business trip. It was a nightmare. Don't use your phone as a 2FA for everything. It creates a devastating single point of failure.

stevemk14ebr• 4 years ago

how is a physical yubikey any different from a loss POV?

jagger272• 4 years ago

If you use FIDO keys as a backup second factor and keep them somewhere safe I'd argue that's strictly better than having a phone alone.

1970-01-01• 4 years ago

Is it a good idea for me to buy Yubikeys or Titan keys for my personal Google account? My wife's? My childrens'? Will that make it less likely, or more likely, that I eventually get arbitrarily locked out?

Yes. Buy the keys with at least one backup key. Treat the backup key(s) as 'critical data' and keep it in a fireproof safe or a safe deposit box. As you add more 2FA to existing accounts, you will need to periodically access this backup key and attach it to those accounts. It's extremely unlikely to be locked-out of your account if you authenticate with U2F key and password.

drivebycomment• 4 years ago

Highly recommended to get FIDO keys. Assuming you get multiple keys - and you can even share one physical key as a back up key across all family accounts, while each person has one personal key each - and register each phone as another fido key, and cross register parents keys with each other's, and for children's accounts. That way, every account will have at least 4 keys, with different physical exposure.

The chance of lock out is basically 0 at that point. Added bonus is that security key auth don't need most of the heuristics based phishing or credential theft detection applied, as they are provably unphishable. So the sign-in is less likely to be subject to false positives of heuristics.

PedroBatista• 4 years ago

".. will be available to consumers across leading devices and platforms"

Did someone said "Best of Breed™"?

Also good to know everything that isn't FIDO is already considered "legacy" by these techno Gods.

eulers_secret2• 4 years ago

Is anyone working on a FOSS software solution for a FIDO2 authenticator? I know of Authy (which isn’t FIDO2, iirc) and some other projects, but none implement the passwordless login.

I have some time and the interest. I know attestation is an (optional?) part of FIDO2, and an OSS app will probably never be “verified”. Still, having a pure-software option/reference would be a boon.

Since this is extremely important for the future of the free web, I’m absolutely willing to help any project with these goals.

Zamicol6• 4 years ago

Is there any place that I can PM you?

eulers_secret2• 4 years ago

Not necessarily PM (yet), but I have added my e-mail and github to my profile here on HN.

To make it easy, my e-mail is eulers.secret at google's very popular email service, for now.

danstiner2• 4 years ago

I've considered adding FIDO2 support to the software-only U2F token I wrote in Rust. It's a fair bit of work though, and I am not sure how comfortable I am with passwordless login unless the keys are kept purely in hardware such as a TPM.

That said, my reading of this post is that FIDO2 support will get built into Chromium directly, which is itself open source. Or if you do want a hardware key but running open software, I'd definitely recommend https://solokeys.com/, I've been following them for a long time.

Also there was some related discussion on this same article last week: https://news.ycombinator.com/item?id=31274677

edit: I see someone already pointed you to my project earlier, feel free to poke around and I'm also open to contributions!

zozbot2343• 4 years ago

I am not sure how comfortable I am with passwordless login unless the keys are kept purely in hardware such as a TPM.

Shouldn't this be something for the user to decide? Using a TPM as a key is a bit silly; it amounts to turning the computer as a whole (strictly speaking, its motherboard and/or CPU) into a big smartcard/FIDO key. If that physical device breaks down, the associated identity is toast. A purely software-based key you can always back up.

Zamicol6• 4 years ago

Now that there's less eyeballs on this. Here's our open source JWT alternative:

https://github.com/Cyphrme/Coze. We've got a roadmap in using that to build alternatives to FIDO. Please feel free to message me with questions or anything else and I will detail our plans.

Before competing against FIDO, the libraries need to be far more ergonomic. Coze is a good start.

I’m absolutely willing to help any project with these goals.

We would love your help.

Zamicol6• 4 years ago

Hello, it's me again.

We just made public the java script implementation of Coze.

https://github.com/Cyphrme/cozejs.

egberts1• 4 years ago

As long as those three are devising standards, there will be no privacy, pure and simple.

andyjohnson02• 4 years ago

Meanwhile here in 2022 I still can't use my classic blue Yubikey to secure my Microsoft account, even though it works fine with Github/Google/Fastmail/etc. I don't want passwordless, I just want 2FA that isn't linked to my phone.

(If anyone knows why I get a "this security key can't be used" error when I try to add my Yubikeys to my msft account then I'd be interested to know. My theory is that the browser is trying to store a secret on the key but the key is immutable, but its very hard to tell.)

judge20204• 4 years ago

My theory is that the browser is trying to store a secret on the key but the key is immutable, but its very hard to tell.)

Pretty much. Microsoft requires Webauthn resident key[0], which allows the authenticator to authenticate passwordlessly, including without a username or email[1]. This means the authenticator has to store the relying party ID (domain/hostname) and associate it with a new key, so that it won't sign login requests to a different website.

0: https://www.w3.org/TR/webauthn-2/#enumdef-residentkeyrequire...

1: https://support.microsoft.com/en-us/windows/sign-in-to-your-...

andyjohnson02• 4 years ago

Thank you for taking time to explain the problem.

sharno• 4 years ago

Why don't we have 2FA apps as browser extensions first to help have multiple devices with the same 2FA code as a fallback option?

iampivot• 4 years ago

One way to view this is that they are formalising how password managers should work; integrated in the browser / device, and use public key certificates for logins instead of username / password.

There are of course side issues such as big vs small players, privacy, security etc, but that's not the major thing about this.

Apple, Google, and Microsoft commit to expanded support for FIDO standard

Related Stories