- Krypton was a U2F/WebAuthn emulator as a browser extension, controlled from an app on your phone (now part of Akamai) [they also handled SSH auth with a PAM plugin]
- MYKI kind of did this scanning barcodes thing (part of something else now or at least closed down)
- Countries with national ID schemes can do most of this via SmartCard or SIM.
- Client certificates would have been great for much of this but browsers have completely killed the usability for them.
- Think GLUU was doing something along these lines as well
Passwords can be easily stolen, bruted or guessed, en masse and remotely, but stealing phones, security keys, smartcards is way harder. So that's the only reason for 2FA. Regrettably few use 2FA without being forced into it.
But what's the redundancy going to be? I'm going to have two phones? How do I verify myself if I need to setup a new phone for auth? Can I backup my auth? And how am I authenticating to apps/sites on the phone itself?
Registration shouldn't need any input like user/email. That should just be sent when you scan the QR code (Phil just scanned our code, either sign him up or log him in if he has an account).
But in the end this has to be something that can work standalone/off-line and users shouldn't be tied to one identity/auth provider (it should be portable).
I know this a lot of rambling, I've been up for 20 hours :/
I just needed to login to Polish Gov site to do my taxes, and the app do just that. The gov site showed QR Code that I've scanned with an app. That was password protected and it automatically let me in. Imagine all apps work like this. You login to app and scan the code. But password managers works with stuff that's already there (passwords).
Comments
- Krypton was a U2F/WebAuthn emulator as a browser extension, controlled from an app on your phone (now part of Akamai) [they also handled SSH auth with a PAM plugin]
- MYKI kind of did this scanning barcodes thing (part of something else now or at least closed down)
- Countries with national ID schemes can do most of this via SmartCard or SIM.
- Client certificates would have been great for much of this but browsers have completely killed the usability for them.
- Think GLUU was doing something along these lines as well
Passwords can be easily stolen, bruted or guessed, en masse and remotely, but stealing phones, security keys, smartcards is way harder. So that's the only reason for 2FA. Regrettably few use 2FA without being forced into it.
But what's the redundancy going to be? I'm going to have two phones? How do I verify myself if I need to setup a new phone for auth? Can I backup my auth? And how am I authenticating to apps/sites on the phone itself?
Registration shouldn't need any input like user/email. That should just be sent when you scan the QR code (Phil just scanned our code, either sign him up or log him in if he has an account).
But in the end this has to be something that can work standalone/off-line and users shouldn't be tied to one identity/auth provider (it should be portable).
I know this a lot of rambling, I've been up for 20 hours :/
I just needed to login to Polish Gov site to do my taxes, and the app do just that. The gov site showed QR Code that I've scanned with an app. That was password protected and it automatically let me in. Imagine all apps work like this. You login to app and scan the code. But password managers works with stuff that's already there (passwords).