Comment by dredmorbius | Hacker News Reader

Comment by dredmorbius | Hacker News Reader

Parent Full thread

Near-field worn devices.

http://nfcring.com is an example of what I have in mind.

What I'd like to see is this tied into an identity system, such that the ring (or other very-hard-to-misplace, but replaceable and discardable) token is not itself an identity, but rather an access token to an identity store which can present any given identity to any given system.

That might be a consistent identity across multiple sessions or unique identities on each session. The identity might be tied to some central certifying agency (e.g., a motor vehicles department or national pensions fund), or not.

There are several elements of this which I'd like to see developed further, including how keys might be reconstructed or recovered using a quorum system of trusted sources (divide your key into pieces, share those amongst friends, family, or some local authority, such that key loss need not equal data loss), and possibly via law enforcement.

I'm also looking at the possibility of a public ledger system which might allow for both workfactor requirements and public disclosure of keys being revealed. This may be a viable application of crypto, though I'm not entirely sure of this.

(The feature might also be optional -- you could take the risk of key loss, or allow for recovery. But the present situation with PKI of losing access to all previously-encrypted data in the event of key loss would be mitigated.)

There's also the requirement for devices to have support for near-field readers. I'm told this is alreadly largely a reality, though my reading of specs for various mobile devices suggests otherwise.

The biggest challenges through all of this are not the technology itself, but the adoption, requirement, and enforcement of standards, including availability of tokens at low or no end-user price. Trust of the information ecosystem overall might be a suitable incentive for this to happen.

So, someone steals the NFC ring and then own the phone? Ring + heat detection of PIN tap pattern will end up giving a false sense of 2FA. (not sure how the ring auths on being worn, didnt see it on the website).

You can repudiate the device.

Stealing physical data itself is far harder than password appropriation.

And a PIN or password / passphrase, plus rate limiting, might still thwart scale attacks.

You're raising attack costs significantly.

Or cutting off a finger or hand?

Difficult to arrange by a phishing email, website, or trojan.

Possible to countermeasure as well.

Personally, I'd like to see identity tied to my smartwatch, with authentication happening via capacitive coupling + Bluetooth.

The way I'm envisioning it:

1. Physically touch the object you want to authenticate to. (E.g. Computer, payment terminal, smart lock, etc.) Watch uses capacitive coupling to bootstrap a Bluetooth connection to that device.

2. Device requests authentication & authorization from Watch.

3. Watch either authenticates you instantly (for lower security applications), or requests you to confirm the transaction with your fingerprint/face/PIN (higher security applications)

This method would also enable a lot of other neat tricks to further increase security, like checking your heart rate and refusing to authenticate if you're asleep or the watch isn't strapped to your wrist anymore, requiring additional authentication methods to unlock your watch after you take it off, displaying the dollar amount for monetary transactions on your watch when asking for approval, etc.

A watch or bracelet could also work, of course. Even a neck pendant if that's your thing. The point is physical, on your person, and crypto based on near field.

The problem with longer ranges, even just a few cm, is the prospect for snooping or triggerring unintended authentications. My preference would be mm range.

> The problem with longer ranges, even just a few cm, is the prospect for snooping or triggerring unintended authentications.

The advantage of using a watch (or another device with a built-in screen) is that it avoids exactly that problem. When you authenticate, you have to physically press a button on the device, and the screen tells you precisely what it is you're authorizing.

Using capacitive coupling as the initial communication channel would also help with that, since you'd have to actually touch the object you want to authenticate to with your bare skin.

Both good points. I've been thinking of some contact / button interaction as well, though that's a toss between keeping the device as physically and electrically simple as possible, vs. some level of interaction. A circuit-completion button on a ring might work, which wouldn't require, say, an additional battery. Though battery life would quite likely be years.

Do you have any refs on capacitive coupling? Is that essentially touchscreen devices? How does that fare in exposed / outdoor environments? I'm thinking of wide applications, and something which wouldn't operate at, say, Tokyo Subway levels of use and demand aren't particularly amenable.

(That's tabling the discussion of whether or not you'd want to have per-use charges for transit use or want to offer that as a public service, or only filter based on individuals, etc.)

Field range might be set by speed-of-light delays. Roughly a nanosecond per 30cm (about 10 foot).

Given a 4 GHz clockspeed, your time resolution is about 0.25 nanosecond, or 7.5 cm -- call it 3 inches.

Slightly ironically the TLS is broken on that nfcring website.

Yeah. I ... had to edit the URL, as I'm used to specifying https rather than http these days.

There are a few other flags raised about that particular implementation, though the concept itself is the key point. The idea of a signet ring to authenticate, sign, access, pay, claim, and/or decrypt seems useful.

You’re not alone - I do that every time I copy or share a URL too, it’s a good habit to get people into and sites that fail to provide working HTTPS don’t really have an excuse these days.

Eh. For me having smart unlock attached to my watch works. Sure, the range is farther than with nfc, but it's acceptable to me.

Reply on news.ycombinator.com