{"action":"created","issue":{"url":"https://api.github.com/repos/winauth/winauth/issues/342","repository_url":"https://api.github.com/repos/winauth/winauth","labels_url":"https://api.github.com/repos/winauth/winauth/issues/342/labels{/name}","comments_url":"https://api.github.com/repos/winauth/winauth/issues/342/comments","events_url":"https://api.github.com/repos/winauth/winauth/issues/342/events","html_url":"https://github.com/winauth/winauth/issues/342","id":152540812,"number":342,"title":"Idea for yubikey: Use U2F instead of HMAC","user":{"login":"My1","id":6696524,"avatar_url":"https://avatars.githubusercontent.com/u/6696524?v=3","gravatar_id":"","url":"https://api.github.com/users/My1","html_url":"https://github.com/My1","followers_url":"https://api.github.com/users/My1/followers","following_url":"https://api.github.com/users/My1/following{/other_user}","gists_url":"https://api.github.com/users/My1/gists{/gist_id}","starred_url":"https://api.github.com/users/My1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/My1/subscriptions","organizations_url":"https://api.github.com/users/My1/orgs","repos_url":"https://api.github.com/users/My1/repos","events_url":"https://api.github.com/users/My1/events{/privacy}","received_events_url":"https://api.github.com/users/My1/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":16,"created_at":"2016-05-02T12:08:08Z","updated_at":"2016-05-03T19:31:25Z","closed_at":null,"body":"This has mainly 2 reasons.\r\n1) you dont need  a config slot on your yubi\r\n2) it isnt limited to (in comparison, pretty expensive) yubikey but can be used with ANY U2F compatible device such as this 5€ stick for example: http://www.amazon.de/dp/B00OGPO3ZS/\r\nthese are from the user perspective, but from the security side you dont need any shared secrets for U2F since it's public key crypto.\r\nin short it signs a challenge with its private key which can be verified using the public key.\r\n\r\nboth are challenge response so you cannot really encrypt but only authenticate the user, so there are no drawbacks.\r\n\r\nbut since there is no shared secret, no one can try to dive into the files and grab the secret to do the HMAC themselves."},"comment":{"url":"https://api.github.com/repos/winauth/winauth/issues/comments/216640010","html_url":"https://github.com/winauth/winauth/issues/342#issuecomment-216640010","issue_url":"https://api.github.com/repos/winauth/winauth/issues/342","id":216640010,"user":{"login":"winauth","id":12179488,"avatar_url":"https://avatars.githubusercontent.com/u/12179488?v=3","gravatar_id":"","url":"https://api.github.com/users/winauth","html_url":"https://github.com/winauth","followers_url":"https://api.github.com/users/winauth/followers","following_url":"https://api.github.com/users/winauth/following{/other_user}","gists_url":"https://api.github.com/users/winauth/gists{/gist_id}","starred_url":"https://api.github.com/users/winauth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/winauth/subscriptions","organizations_url":"https://api.github.com/users/winauth/orgs","repos_url":"https://api.github.com/users/winauth/repos","events_url":"https://api.github.com/users/winauth/events{/privacy}","received_events_url":"https://api.github.com/users/winauth/received_events","type":"User","site_admin":false},"created_at":"2016-05-03T19:31:25Z","updated_at":"2016-05-03T19:31:25Z","body":"Right, WinAuth is using HMAC for key generation, because (it being standalone) all it can do is encrypt data.\r\n\r\nI wish they could make a more versatile and cheaper security key. Right now, the [YubiHSM](https://www.yubico.com/products/yubihsm/) would be perfect if everyone had one. It would provide absolute security because the encryption is done internally. Alas, at $500 a pop, it isn't exactly consumer-friendly.\r\n\r\n\r\n"}}