I think the TFA module should support the new U2F standard.

References:
http://en.wikipedia.org/wiki/FIDO_Alliance
http://secureidnews.com/news-item/fido-alliance-members-demonstrate-new-...
http://www.yubico.com/tag/fido-alliance/
https://fidoalliance.org
(Latest FIDO news (Oct. 1st): "China giant Alibaba endorses FIDO authentication")

Comments

Leeteq’s picture

Leeteq commented

(U2F = Universal Two-Factor (authentication))

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

This standard looks like a cool idea/project.

The tfa module itself doesn't provide support for a specific backend. That's the job of a plugin, in the way that tfa_basic does.

Someone could make a FIDO-focused plugin for tfa. @Leeteq, are you interested in doing that?

batje’s picture

batje commented

Google now supports this, too.
http://googleonlinesecurity.blogspot.com/2014/10/strengthening-2-step-ve...

Leeteq’s picture

Leeteq commented
Project: Two-factor Authentication (TFA) » TFA Basic plugins
Version: 7.x-2.x-dev » 7.x-1.x-dev
Related issues: +#2239973: Deploy two-factor-authentication on drupal.org

Ok, so maybe the TFA_basic module is the right place for this feature request.

FYI - Ref. my comment #49 in the related drupal.org issue:
"Deploy two-factor-authentication on drupal.org"
https://www.drupal.org/node/2239973#comment-9282653

I think Drupal.org should also have support for the "U2F" ("Universal-Two-Factor") authentication standard that earlier this year was established by the FIDO alliance.

Ref. the FIDO alliance supporting members list:
https://fidoalliance.org/membership/members

(extracted a few well-known names...)

  • Google
  • Microsoft
  • Samsung
  • Paypal
  • VISA
  • MasterCard
  • Alibaba/Alipay (China)
  • Bank of America
  • Netflix
  • ARM
  • Blackberry
  • Qualcomm
  • Yubico
  • (and many more)

Demo video:
https://fidoalliance.org/adoption/video/yubico-fido-u2f-simple-secure-login

When many people now can use the same 2FA security token to secure their accounts with both Google, Paypal, Alipay, etc., as well as also easily for their individual Drupal sites using a Drupal contrib module, then I would think it be wise to avoid forcing people to choose between two different standards.

Therefore, I think it would be good if drupal.org not only support (require) TOTP, but also the U2F standard, which seems to be THE way forward. It seems that it is just a matter of a feature decision for the TFA module to also support U2F.

Notice also a significant flexibility detail between the two standards, where the latter does not require time stamp, meaning that the U2F standard supports security tokens that not need a battery. This is quite important. Then each of the security token devices can last much longer. One of the available U2F devices comes with 10 year warranty already.

Google just opened their U2F Security Key support for Gmail and Google Accounts earlier this week:

http://googleonlinesecurity.blogspot.com/2014/10/strengthening-2-step-ve...

Gmail U2F demo video:
http://vimeo.com/109365425

coltrane’s picture

coltrane
he/him
commented
Priority: Major » Normal

I'm for this but it's not something I'll look into until after next TFA/TFA Basic releases and TFA deployment on drupal.org. I don't think this standard blocks either of those goals. And as @greggles says, U2F could happen outside TFA Basic module too, as its own plugin. Moving priority to normal.

danquah’s picture

danquah commented

I actually got a basic module up and running at a company Hackathon this past weekend, it's currently mostly a PoC (eg it stores registrations in variables and is very rough UI-wise), but I got registration as well as signing ("login") working and integrated with TFA as a plugin.

I'll hopefully get some time to clean it up in the coming month or two, and setup a sandbox soon-ish.

frederickjh’s picture

frederickjh
he/him
Primary language English
Location The Big Island of Hawai'i
commented

For reference adding a link to developer resources for U2F at Yubico.

danquah’s picture

danquah commented

Btw, I have not had any time to work on my quick poc btw, hope looking at it during Drupalcon in the coming month.

cafuego’s picture

cafuego commented

Just walking through, making soft pinging noises :-)

coltrane’s picture

coltrane
he/him
commented

hi @cafuego! My opinion from #5 still holds, I'm not going to be working on this myself anytime soon, though I'm happy to review and test. Around that time @danquah said there's a basic module up and running to provide this. Perhaps @danquah could continue that effort and share something here so you or another person could build out as a patch or we can discuss it as a separate module?

(Edited this comment to correct who mentioned the sandbox project they had)

cafuego’s picture

cafuego commented

Hi @coltrane, yup... if there's work already done it doesn't make sense to start again from scratch.

@danquah if you haven't had the time to work on the working plugin, but it doesn't contain any code specific to the site you were using it on, would you be willing to share your work anyway? PoC code > no code ;-)

danquah’s picture

danquah commented

Sure thing: https://www.drupal.org/sandbox/danquah/2617020

As you can probably guess from my lack of updates I have made no progress on the PoC since i threw it together and to be honest looking at the code now I would probably just start from scratch rather than having to figure out how to make it tick :)

But, all the pieces are there, and I _did_ have it working so it's better than nothing.

Just ask away if there are any questions to the code, I'll try to remember what I where thinking at the time.

cafuego’s picture

cafuego commented

Thankyou, @danquah. I spent a bit of time over the weekend trying to get it to work, but no luck as yet. (Erroring out on registering of device)