Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The cheapest available FIDO2 option is PIN-based so your PIN (actually any password, it doesn't need to be like a bank PIN) is the something you know, and the FIDO2 authenticator is something you have, two factors. You don't need to pick a PIN to have conventional "second factor" working but if you want a usernameless authentication you can have that by choosing a PIN.

What's different compared to having a web site password? The web site knows the password, but they don't know your PIN. This means suddenly relatively weak human memorable passwords are good enough, because bad guys can't break in and steal 40 million of them in seconds or leverage them across multiple sites, the PIN is useless without the authenticator.

But other FIDO2 authenticators can do fingerprints, making it something you are (a person with that fingerprint) and something you have (the authenticator) so two factors again.

Usernameless (rather than passwordless) is the differentiator. You can literally have the sign-in flow be a "Sign In" button and the user does the thing (finger on reader, types in PIN, or maybe looks at camera) and they're authenticated. No step where you type in an email address or a username. This has a privacy cost because it means the authenticator knows in some sense who you are, but it is super convenient if that's what you're all about - while being much more secure than today's username + password dance.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: