How FIDO U2F Security Keys Work
summary
Explains how FIDO U2F replaces OTPs with public‑key auth stored on a hardware dongle, using a key handle and per‑site public key bound to the browser origin (relies on TLS), with transports USB/NFC/Bluetooth and vendor certs (Yubico referenced). Registration sends challenge + appID; authentication returns a signed challenge and a monotonic counter for clone detection. Notes browser support (Chrome/Chromium, Firefox, Safari extension), site adoption (Google, FastMail) and tooling like dongleoff.info and Yubico client libraries.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker intro
- 1:25Passwords are still bad
- 5:42FIDO Alliance and U2F solution
- 7:28How U2F security keys work
- 11:19Registration ceremony explained
- 15:11Authentication ceremony deep dive
- 19:04Lost key recovery process
- 20:07Live demo of U2F in action
- 23:56How to use U2F yourself
- 26:41Adding U2F to your services
- 28:28Conclusion and call to action
related talks
38mBreaking FIDO: Are Exploits in There?
33mSimple. Open. Mobile: A Look at the Future of Strong Authentication
47mWhy FIDO Security Keys & Webauthn are Awesome
33mNavigating Passwordless Authentication with FIDO2 & WebAuthn
02h 22mFIDO 101
32mSecuring Online Identities with Simple, Secure, Open Standards
17mModern Authentication, Real life stories
24mOf Two Minds about Two-Factor: Understanding Everyday FIDO U2F Usability