Apache Allura™ / Tickets / #8119 U2F for multifactor auth

#8119 U2F for multifactor auth

Milestone: unreleased

Status: open

Owner: nobody

Labels: security (34)

Component: General

Reviewer: nobody

Updated: 2016-09-12

Created: 2016-08-15

Creator: Dave Brondsema

Private: No

Discussion

Dave Brondsema - 2016-08-19

Some sites (e.g gitlab) require you to set up regular TOTP before adding a U2F hardware key. Maybe because U2F isn't supported too broadly, so you need regular TOTP to log into non-Chrome browsers or shell services. Bitbucket requires ssh keys first too.

Many sites let you name your U2F devices, since you can add multiple. They may also record the date it was added.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Dave Brondsema - 2016-09-12

Reference material:

JS API

But Chrome doesn't implement the high-level API. Firefox plugin has one form of it, but it can vary function signatures. So, seems like common practice is to include a JS library like either of these:

https://github.com/google/u2f-ref-code/blob/master/u2f-gae-demo/war/js/u2f-api.js

https://demo.yubico.com/js/u2f-api.js

https://developers.yubico.com/U2F/Libraries/Using_a_library.html has a basic tutorial, but is pretty light on details

http://stackoverflow.com/questions/26637660/how-do-i-use-fido-u2f-to-allow-users-to-authenticate-with-my-website has more details, but uses older form of register() missing appId as first param

python U2F library isn't documented very well, but you can look at the source:

https://github.com/Yubico/python-u2flib-server/blob/master/examples/u2f_server.py which uses a higher-level python API

the u2f_v2.py file/module within that package seems to be easier and more direct to use, and https://github.com/gavinwahl/django-u2f/blob/master/django_u2f/views.py has good examples of using it

I've pushed some work in progress to db/8119 which is a good start and working well, but for various reasons I'm not going to keep working on this right now. One reason is that U2F is still forward looking, and since the common best practice is to require TOTP (since not all browsers and non-browser connections support U2F) so that means adding U2F on top of TOTP doesn't really add any true security benefit, TOTP & recovery codes are the weakest link.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Apache Allura™

Forge software for hosting software projects

Milestone

Searches

Help

#8119 U2F for multifactor auth

Discussion