I don't like that browsers, email clients, etc. come bundled with CAs and that there is no emphasis for a more decentralized authentication mechanism. Fortunately, it's not too bad, because at the least, whatever is our favorite platform, we can create our own clients, say an IMAP client, using any programming language we like, say Python, with whatever bundled CAs we like.
It will be too bad that we lose that flexibility and start to depend on new platforms, new USB devices, etc. Sure, it is an open standard, but if it is a part of this open standard, that servers can accept only specific hardware such as special USB devices, then in practice, one programmer will not be able to program a client on the platform of his choice. Sure, any big company would be able to build a device that respects the standard, but still a lot of flexibility would be lost. I am not saying that this is the situation with the new FIDO U2F standard, but I am curious about that.
For me, a good standard must restrict as little as possible both sides. As soon as a "standard" allows one side to impose constraints on the implementation on the other side, even in the name of security, it seems that a fundamental notion of freedom, implicit in the open source original idea, is under attack. This original idea was to allow any programmer to create practical code with as little constraints as possible. It maybe that the situation is as before with CAs for website or email certificates and it is just that the current emphasis in on specific hardware on the client side - that would not be too bad.
- How can we build our own clients, using the platform and the language of our choice to connect with any U2F compliant server?
- Is it possible to build, say an IMAP client, on the platform of our choice, to authenticate with any, say IMAP server, that respects the U2F standard?