Hardware Authenticators

[Hatertots]

Does Nash plan to integrate the use of hardware authenticators such as Yubikey on the platform? Does the Nash team feel like having this would be worthwhile and add further security to users accounts?

I would be interested to hear the thoughts from the team as well as the communities thoughts on hardware authentication keys, as well as its hypothetical integration with the Nash ecosystem.

[chris.fenwick]

Hardware keys like YubiKey offer excellent security and everyone at Nash is obliged to use them. They render phishing attacks impossible. However, for everyday users they are too expensive and complicated: two keys are required in case one gets lost, and there can be compatibility issues with mobile devices.

We are foremost interested in providing solutions that are accessible to anyone, so our next upgrade will involve device registration and push-based 2FA. This will offer a high level of security and will be very convenient for users.

Nonetheless, we do want to add hardware keys as a 2FA option in future to meet the needs of institutional users.

[CypherInvestor]

Security question

U2F solves phishing by binding the authentication to the SSL certificate of the domain. That doesn’t avoid that a local executable reads memory allocated from another process. But yes, we do plan to support U2F in a future upgrade as WebAuth is being implemented in most browsers, MVP is using TOTP still.

Interesting alternative 2FA method

The current MVP 2FA is just that: minimal viable, even if its implementation is already superior to current market leaders. As mentioned before: we have several plans to improve 2FA. And yes we will support FIDO2, all our internal systems already use hardware keys on many different ways since day one (2y ago). There are other strong upgrades that will not require additional hardware but instead rely on advanced cryptography and use the mobile secure enclave. [image]