Hacker News Reader

Comment by bsder | Hacker News Reader

This is neat, but my biggest problem isn't the key.

My biggest problem is how many things I have to configure to even be able to start to use the key.

There is a reason why Duo got bought for >2Gigabucks. 2FA is a PITA to administer.

Technically, nothing needs to be additionally configured for FIDO U2F to be implemented for an application. You just need to connect the key to your account and it should just prompt you to click the button when you need to sign in. If a company requires a phone number or some other byzantine process for registering a key that is their own design choice.

I get that simple U2F key registration is not what's seen in a lot of time in the real world, but most implementations are needlessly complex IMO.

"You just need to connect the key to your account" is the onerous part, though. Google doesn't require a phone number or whatever, but you have to click through like four pages to get to it.

Google Account -> Sign-in & Security -> 2-Step Verification

Or just click: https://myaccount.google.com/signinoptions/two-step-verifica...

Yes. Then click U2F. Then start messing around with that.

It takes time. And I have a ton of accounts. I like my U2F key but it is still a pain in the ass.

Seems pretty easy to me, in my opinion.

All barriers are insurmountable UX burdens to a significant portion of users, no matter how trivial the barrier.

Do it for 20 apps. On two keys. When every app has a different place they hide the feature, when every app has a different workflow to get it done, and most of them don't tell you they support it in the first place. It really sucks. At minimum, WebAuthN should enable detecting when the key has been slotted and ask if you want to enable U2F, then take you through it...but nobody does, and nobody probably will anytime soon.

At work, Okta at least will handle it for us, but personally? It really sucks.

Yea, that is cumbersome and not at all user-friendly. I was operating under the assumption of a single app + device use-case at solely Google in my original comment.

Sure - and like I said, Okta does a good job of that for us. But to get people to really embrace it, I tend to think it's gotta work for them personally too. Otherwise it's just this "thing" on a keychain, you know? It's not important.

Ideally, there would be an event emitted by the browser that could detect that a U2F key was inserted, but do to the design limitations of the key this is unlikely to happen. The U2F key is essentially a keyboard that has been plugged into your USB port. Some people keep "nano"[0] ones plugged in at all times for convenience. To address the common use cases of real users, you would need the browser to be able to check if an external keyboard is plugged in to a USB port on DOM ready, and when inserted into the computer.

I will let your imagination run wild with what a nefarious person could do if every browser has the ability to detect if you are using a specific type of USB keyboard. I could point you in direction of device fingerprinting to start, but that's the bare minimum of what you expose.

[0]: https://www.yubico.com/product/yubikey-4-series/#yubikey-4-n...

I appreciate the explanation, but I do understand at least at a high level how this works. I understand why it's not being done this way. How it's being done is kind of messed up.

WebAuthN is able to tell you that the web page wants you to put a hardware key in. That should be enough to be able to prompt users who've opted into using such a key elsewhere that they can do so here.

> You just need to connect the key to your account

Which account? Where is the account? Who runs that account?

In a 10-person office, I want to be able to hand 3 keys to each person (1 for use, 1 for loss, and 1 just in case the other two somehow foul up), and then have them use those keys for computer login, email login, AWS login, GCP login, NXP/ST/SiLabs support forum login, etc.

And when one of them goes to another company (it happens), I need to be able to shut those keys down without their cooperation.

Until I can do this, 2FA is going to remain the province of big companies and not be very useful.

So basically you need SSO with an identity provider that supports key-only logins. Perhaps SimpleSamlPHP with privacyIdea would fit the bill.

I'd really like to use FIDO for entire organization. For windows logins, .NET apps etc. But there is no easy solution.

On the other hand TOTP is simple to add for .NET apps.

By using the key, I assume you mean how painful it is to implement it server-side?

Reply on news.ycombinator.com