Could you add the fido u2f plug-in?

tomeurp · Member · Dec 2, 2014 at 1:23 am
Copy link

Add topic to favorites
Could you please add fido u2f plug-in?

I think it’s a great idea to have this plug-in for anyone concerned about security in order to prevent phishin attacks. It is much more secure than time based one time passcodes.

Plug-in is available at https://github.com/shield-9/u2f-login

Thanks

The blog I need help with is: (visible only to logged in users)
quantumcrypto · Member · Dec 4, 2014 at 7:23 pm
Copy link
yes this would be very very useful! :)
quantumcrypto · Member · Jan 6, 2015 at 9:12 pm
Copy link
Yubico CEO blogged about the FIDO U2F plug-in for wordpress:
<a href=”https://www.yubico.com/2015/01/u2f-wordpress-security-people/
“>https://www.yubico.com/2015/01/u2f-wordpress-security-people/
auxclass · Member · Jan 6, 2015 at 9:22 pm
Copy link
you are aware that you can use https for your login link and two factor log-in has been an option for well over a year where you are required to have your cell phone in your possession and enter in a code sent to it?
quantumcrypto · Member · Jan 7, 2015 at 12:34 am
Copy link
@auxclass,

SMS for 2nd Factor authentication works, but it is problematic when one is travelling and using a local SIM. Then they are not able to get the Codes. That has happened to me. Or the phone is not charged / working.

FIDO U2F on the hand doesn’t require cellular connectivity or a device that needs charging.

Saqib
kevwe09 · Member · Jan 7, 2015 at 12:37 am
Copy link
nullThis is a topic which is near to my heart…
Thank you! Exactly where are your contact details though
raincoaster · Member · Jan 7, 2015 at 12:39 am
Copy link
If they put it in, all WP.com blogs would have to use it and not all of us want it. I lose phones a lot more frequently than I lose passwords.
quantumcrypto · Member · Jan 7, 2015 at 1:29 am
Copy link
@raincoaster, not really. It is opt-in. If you want strong auth you can enable on your account. If not, static password will be default.
quantumcrypto · Member · Jan 15, 2015 at 11:54 pm
Copy link
@auxclass,

One more thing I like about FIDO U2F / FIDO UAF is that it also protects against phishing using public key cryptography. The FIDO U2F / FIDO UAF devices actually mint certificates.

Using SMS for second factor doesn’t prevent against phishing attempts.

Saqib
darconeous · Member · Jan 20, 2015 at 5:02 am
Copy link
The linked U2F implementation is AGPLv3, which wordpress.com will probably never use.

However, this implementation is GPLv2: https://github.com/Yubico/wordpress-u2f

Please add this capability to wordpress.com!

No items found.