4

I've been wondering about this for a while, but couldn't find much on the web, so I hope that someone could point me in the right direction for better understanding about this topic.

Would it be viable / safe to use something like a Fido U2F device as primary authentication method (mostly thinking about web apps here, but possibly not limited to)?

I've been using client-side SSL certificates in the past for this, but of course that requires client configuration; I know the same should be possible using a standard smartcard, but of course most devices nowadays lack a smartcard reader. The Fido keys look like the perfect form factor to carry around a private key pair without need for a reader; for mobile devices you could just use NFC (as newer yubikey do) or a built-in "on the go" adapter.

Now, I understand the problem of the key being stolen, but I imagine that could be solved / mitigated by using some PIN to unlock the key, as with most smartcards. As an additional security measure, websites could ask for a password as "2nd-factor". That would mean of course having to remember a password, but just for those really crytical systems you absolutely want to be well protected.

In my hope, something like this could help greatly improving both on the security point of view and lowering the login friction (for users) and complexity (for implementers) as well.

Now, is there any major issue / roadblock in going this way? It almost sounds like browsers would already be able to use a smartcard for auth, the only thing missing would be to develop an actual device (assuming there is no way to add a PIN to Fido devices)..

  • If you want to use standard smartcards and your only problem is the lack of a reader: There are quite a lot of crypto tokens, which integrate a smart card chip within a small usb device. Checkout NitroKey Pro, YubiKey or Safenet eToken, for example. – mat Apr 4 '17 at 7:14
  • @mat yep, what I'm trying to understand is what's preventin widespread usage of smartcards for authentication, instead of passwords (and the addition of 2fa methods -- that create a lot of "friction" -- to mitigate the risks from weak / reused passwords). It sounds like the technical side of it wouldn't be an issue.. – redShadow Apr 6 '17 at 10:05
  • Well, using tradtional smartcards is not exactly easy, plus they don't work for your mobile devices. U2F ist trying to fix these usability problems my making it work without any installation or configuration (of the device or the host machine, the service obviously has to be configured) so this could be imo the first 2FA device to gain a widespread usage. But still, the main problem remains, which is that most people just don't care. – mat Apr 6 '17 at 13:12
2

Indeed! I use/build/deploy both standard smart card PKI solutions (SSL client certificate, applets, browser plugin, middleware...) and FIDO U2F simplified PKI solutions and FIDO U2F works great even as a primary authentication method.

It can be used as a primary authentication through a shared login url page with username and FIDO U2F or through a by-user-unique login url (to identify username without even asking) with FIDO U2F. Another non-standard use case but easy solution if you only have to deal with a very few users: you can even skip the "asking for a username part" (server only need to send every known key handles to the device to find the right one).

About adding PIN protection, we are starting to see products with local PIN entry protection like the onlykey (https://crp.to/p/)

You can even develop your own FIDO U2F API compatible solution with enhanced features to add PIN protection, shared identity, simplified encryption... I am one of the few "mad dogs" working on such solutions.

Note/reminder : FIDO U2F works on Chrome on Windows, Linux, OSX, Android. Firefox built-in support should be available in a few weeks. There are already FIDO U2F USB security keys, NFC Cards/keys and soon there will be Bluetooth Low Energy (BLE) devices.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.