Comment by JulianRaphael | Hacker News Reader

Comment by JulianRaphael | Hacker News Reader

Maybe Google's incredibly irresponsible response hints at their general strategy regarding authentication on the internet: they are already pushing for the replacement passwords. I'm quoting: "[Google plans] to release an ultra-secure and easy to use identity verification platform that eliminates the need for long, user-generated passwords. Dubbed U2F (Universal 2nd Factor), the consumer-facing side of this initiative will be a USB dongle called the YubiKey Neo. Built to Google’s specifications by security specialist Yubico, the YubiKey Neo is a small, durable and driverless device that requires no battery. Plugged into your computer’s USB port it will add a second, highly secure layer of verification when you point Google’s Chrome browser to your Gmail or Google Docs account. You’ll initiate the login by typing your username and a simple PIN. The browser will then communicate directly with the YubiKey Neo, using encrypted data, to authorize account access. With U2F verification, if someone wanted to login surreptitiously to your account, he or she would need to know your username and PIN while simultaneously having physical possession of that specific YubiKey Neo."

Furthermore, they had Regina Dugan, former DARPA director and now their VP of Engineering, Advanced Technology and Projects, on stage at All Things Digital in 2013 talking about electric tattoos and edible passwords which would turn your whole body into an authentication token with a 18bit ESG light signal. (Link to talk: https://www.youtube.com/watch?v=fzB1EcocAF8).

So maybe they just don't care because they won't use 2-factor-authentication for much longer anyway.

That will be a problem where USB ports are disabled (which is increasingly becoming a standard security practice). E.g. my workplace has separate PCs for accessing Gmail etc. but those still have USB ports disabled.

I imagine you could have a fallback to how YubiKey neo and 2fa works today: using a phone app to generate a code (in conjunction with the yubikey) and manually type that in.

If USB ports are disabled, how are the keyboard and the mouse connected? PS/2?

bluetooth?

Requires batteries. NFC is the obvious choice, and yubikey neo already supports that. Note that (going back to top-level parent comment) current yubikey neos cannot support U2F; all they say is U2F compatible devices will be available sometime [later] this year.

They can be permanently connected to computer.

Yes but even such a solution would surely use some sort of existing internal interface such as USB or PS/2, even if in practice the wires are soldered directly to the motherboard? Otherwise you'd have to build special hardware, controller chips, develop and maintain the driver?

Now that you mentioned it, I think only USB Mass Storage was disabled, not the ports themselves. So the keyboard/mouse etc continue to work.

So Yubikey would work. It identifies itself as a Keyboard to the OS.

These are HID devices, because they need to do challenge/response with the website that's trying to authenticate. The old OTP YubiKeys were keyboards. Better than nothing but phishable.

Believe Google already uses YubiKeys for authentication internally - certainly some of the Google staffers I know have them for authentication

Hmmm.... let passwords become unusable, and move to hardware crypto dongle? That sure sounds like a great way to remove any remaining anonymity on their services, once they tie shipping addresses to accounts.

// I like the idea of crypto dongles... when you control both sides

Accept the key isn't tied to you account when you buy it and you don't have to buy from google...

> Consumer provisioning should allow users to buy a compliant token from a vendor of their choice, insert it into a computer where they’re already authenticated to a website, and register their token with a single mouse click.

http://www.computer.org/cms/Computer.org/ComputingNow/pdfs/A...

Furthermore there are no serial number exchanged afaict, so the key itself isn't identified by the server, only the fact it has valid credentials.

Ahh, was not aware of that. I think this would solve a lot of my concern.

>Note that the secure element never returns a previously generated public key in any new registration step. >This makes tracking users across websites difficult by using the token as a supercookie that bypasses other anonymizing precautions.

So at least they make an effort to prevent that, and if they do not subvert this scheme you wont be trackable. But as the dongle is more or less a black box, it would probably be hard to ascertain that generated public keys do not have some property in common to allow them to be associated with each other.

Reply on news.ycombinator.com