Hacker News Reader

FIDO U2F has a great anti phishing mechanism by incorporating the hostname.

However:

It's too difficult to setup FIDO U2F for your own webserver. There is still no Apache module or nginx plugin that allows you to protect a directory of your document root.

Also U2F is not available for PHPBB. There is a plugin that appears to be unfinished and buggy since 2015.

View on HN

Using an OpenID connect provider with one of Hans Zandbelt's plugins for Apache (mod_auth_openidc) or Nginx (lua-resty-openidc) would give you centralized authentication which could use U2F or any other supported 2FA mechanism.

I can echo this comment. Protecting websites with lua-resty-openidc was very easy and required no changes to the actual application code.

Reply on news.ycombinator.com