Collaborate Disseminate
I’m trying to understand Yubico’s documentation of the U2F standard, and getting hung up on the PIV attestation piece.
The security claim appears to be that the authoritatively-signed attestation certificate sent by the device upon regist… Continue reading How does the attestation mechanism of U2F guarantee the provenance of the key material?
I know that in terms of security it is not good idea (as explained here: https://github.com/Yubico/libu2f-host/issues/45#issuecomment-337013420). But we can live with that.
Is there any extension of U2F or may be some version/manufacturer… Continue reading Looking for ability to identify U2F device
I’d like to be able to inject my own key material in the FIDO2 authenticator; at the very least it will remove the need to trust the vendor (because we have no guarantee whether the vendor keeps copies of the keys to themselv… Continue reading Does injecting my own key material into the authenticator undermine authenticator’s attestation?
I’ve been reading both FIDO and FIDO2 specs for a while tring to understand the similarities and differences between both. Here is how I broke it down so far:
FIDO: First iteration in creating a cross industry standard for passwordless … Continue reading FIDO and FIDO2 differences
My ideal bank would offer online banking from a browser with user/pwd and WebAuthn, for example with a NFC or USB key. No OTP or SMS or apps on the smartphone or physical devices required. (It goes without saying, no recovery… Continue reading Why don’t online banks use WebAuthn? [on hold]
I understand how FIDO works with yubikey: Yubikey device has a symmetric key and it uses appId, nonce and symmetric key to generate key pair for a website. And the device gives back public key and keyHandle (which can used to… Continue reading FIDO U2F – MacOS TouchBar
100K or so creators in the YouTube car community were targeted by a phishing campaign that captured 2FA codes. Continue reading YouTube ‘influencers’ get 2FA tokens phished
Of all the things which are annoying about the modern World Wide Web, the need to create and remember countless passwords is on the top of most people’s lists. From dozens of passwords for everything from social media sites to shopping, company, and productivity-related platforms like Github, a large part …read more
Continue reading FIDO2: The Dream Of Password-Free Authentication On The WWW
Google has discovered a flaw in a Chromebook security feature which allows owners to press their device’s power button to initiate U2F 2FA.
Continue reading Google fixes Chromebook 2FA flaw in ‘built-in security key’
I have a yubikey which supports only U2F. It doesn’t support FIDO2. I read about U2F and i understand how it works.
When i test my Yubikey for WebAuthn on https://webauthn.io it works. I wanted to know how WebAuthn works wi… Continue reading Yubikey – WebAuthn and U2F