Re: Intent to implement and ship: FIDO U2F API

2016-02-16 Thread Frederic Martin
in for all your great work. -- Frédéric On Monday, February 8, 2016 at 11:36:38 PM UTC+1, Eric Rescorla wrote: > On Mon, Feb 8, 2016 at 10:13 PM, Frederic Martin <fredletaman...@gmail.com> > wrote: > > > Hi, > > > > thanx for the answer. > > > > Quoting

Re: Intent to implement and ship: FIDO U2F API

2016-02-08 Thread Frederic Martin
On Monday, February 8, 2016 at 10:54:36 PM UTC+1, Ryan Sleevi wrote: > On Mon, Feb 8, 2016 at 1:13 PM, Frederic Martin wrote: > > > > 1) From a security architect perspective. This is an official > > recommendation that makes sens to prevent MITM attacks. FIDO U2F was &g

Re: Intent to implement and ship: FIDO U2F API

2016-02-08 Thread Frederic Martin
s not yet published, but is already implemented > > in > > > recent versions of Chromium [2]. > > > * For the time being, U2F support will be gated behind preferences and > > > disabled by default. > > > > > > [1] > > > > > https://blog.moz

Re: Intent to implement and ship: FIDO U2F API

2016-01-27 Thread Frederic Martin
On Wednesday, December 2, 2015 at 2:23:28 AM UTC+1, Richard Barnes wrote: > The FIDO Alliance has been developing standards for hardware-based > authentication of users by websites [1]. Their work is getting significant > traction, so the Mozilla Foundation has decided to join the FIDO Alliance.

Re: Fido U2F, two-factor authentication support

2015-12-02 Thread Frederic Martin
Le lundi 9 novembre 2015 18:29:20 UTC+1, Michael Schwartz (m...@gluu.org) a écrit : > Hi guys... if you need a FIDO U2F server to test against, the Gluu Server has > endpoints built in. Its really easy to deploy on Ubuntu / Centos: > http://www.gluu.org/docs/admin-guide/deployment/ > > Also, I

Re: Intent to implement and ship: FIDO U2F API

2015-12-02 Thread Frederic Martin
>As I said in the other email, >I don't understand how this could be implemented when the spec has left the >>key piece undefined, as far as I see. You are completely right ! For now, FIDO 2 is currently being written (far far far from finished) and can't be implemented, so let's focus on

Re: Intent to implement and ship: FIDO U2F API

2015-12-02 Thread Frederic Martin
Le jeudi 3 décembre 2015 01:28:51 UTC+1, Justin Dolske a écrit : > On 12/2/15 6:48 AM, Richard Barnes wrote: > > > My initial intent was to propose implementing [1], then implementing [2] > > when it's ready. After all, there's a lot in common, and as you say, >the > > W3C version will be much

Re: Intent to implement and ship: FIDO U2F API

2015-12-02 Thread Frederic Martin
Le mercredi 2 décembre 2015 23:43:00 UTC+1, Ryan Sleevi a écrit : > On Wednesday, December 2, 2015 at 1:17:46 PM UTC-8, smaug wrote: > > I don't understand how 1) could be implemented when the spec has left the > > key piece undefined, as far as I see. > > As the spec puts it "This specification

Re: Intent to implement and ship: FIDO U2F API

2015-12-02 Thread Frederic Martin
> That said, I think we're in violent agreement that the specs are far, far, > far from finished - and I'm unclear whether we're in agreement that one is > under active development, while the other is a technological dead end which, > through a series of unfortunate events, happened to have