bk99.de entertain the web since 1997

bk99.de
Hostblogger · AuthenticationCurated

FIDO U2F as a second factor in the customer menu

Summary

Manuel Schmitt adds FIDO U2F to the customer menu and thereby supports physical as well as virtual security keys. FIDO U2F was offered in addition to SMS and OATH-TOTP. The web hosting management itself had not yet been switched over at the time of publication.

Ideas

  • Hardware-backed factors resist phishing better than reusable one-time codes.
  • A customer portal can offer several methods without immediately rebuilding every target system.
  • Biometric devices can act as virtual security keys without sending biometric data to the service.

Insights

  • Strong authentication is first useful at a service’s administrative control points.
  • A gradual rollout is justifiable if the remaining protection gaps stay visible.

Facts

  • Physical and virtual U2F-compatible security keys are supported.

Recommendations

  • Register at least two independent security keys.
  • Document recovery and revocation of lost factors.

References

Read the original article on Hostblogger

Search the Web Archive

RFC · 2025

RFC 9700: Running OAuth 2.0 securely

RFC 9700 brings together current security practices for OAuth 2.0 and rejects risky historical patterns. A flexible authorisation framework needs secure profiles and defaults. Best practices can later explicitly replace early standard options.

Hackaday · 2017

OAuth2 for Gmail on Linux and ESP8266

Hackaday explains token-based Gmail login so that scripts and microcontrollers can send email without a stored account password. Gmail documents its OAuth2 interface. The approach runs on Linux and the ESP8266.

RFC · 2015

RFC 7519: JWT: Signed claims in JSON format

RFC 7519 defines compact JSON Web Tokens for transferable claims with signature or encryption. Self-contained tokens reduce lookups and make immediate revocation harder. Flexible cryptography requires strict checking of algorithms and claims.