Comment by Freak_NL | Hacker News Reader

Comment by Freak_NL | Hacker News Reader

I really like the Fido U2F concept, because it ticks all the right boxes; simple to use, reusable for multiple services without being traceable, multiple hardware vendors, open standard, soon implement in Chrome, Firefox, and Edge (although I am not sure about the status in Edge right now), and cheap.

But this solves logging in with a browser. I have been wondering about things like IMAP for e-mail access. To secure my mail a second factor sounds great, but right now all solutions mean I get 2FA when I log in with a browser, but as soon as I use an e-mail client I am back to username and password (application-specific or otherwise).

Ideally, Fido U2F would be an option to use with IMAP and SMTP as well, so that Thunderbird, Outlook, or Apple Mail can prompt me to touch the U2F key when I get my mail. I have not been able to find much information on this approach yet though. Is it possible? Desirable?

Any insights?

Nothing probits using UAF/U2F for other stuff outside web browsers. The problem is that the concept of "AppId" is not clearly defined in non Web Application but that should not stop people form doing it. Yubico has Open Source code that makes it relativly easy.

Yubico's pam_u2f allows u2f to be used for anything pam authenticates, which is nice for a Linux system.

Its a very cool feature, I agree, sadly making pam_u2f work for SSH is quite a hack. Their is a patch for OpenSSH but it never went upstream. I really hope this will be work soon.

There is an native U2F implementation for Android by yubico: https://github.com/Yubico/android-u2f-demo. Also take a look at this webinar https://www.yubico.com/2015/10/u2f-webinar-from-concept-to-i.... The client data part is what you have to send to the authenticator.

The client-side code and the standard are fairly trivial to implement — thanks to Yubico as well — but the problem lies in designing and standardising an extension to the existing mail protocols, and getting that accepted as a common feature for e-mail providers (such as Google and Microsoft) and a common feature in MTAs and MDAs.

Mac Mail already will use client certs to authenticate with GMail: https://i.imgur.com/gTE6tkt.png

Reply on news.ycombinator.com