{"action":"created","issue":{"url":"https://api.github.com/repos/privacyidea/privacyidea/issues/182","labels_url":"https://api.github.com/repos/privacyidea/privacyidea/issues/182/labels{/name}","comments_url":"https://api.github.com/repos/privacyidea/privacyidea/issues/182/comments","events_url":"https://api.github.com/repos/privacyidea/privacyidea/issues/182/events","html_url":"https://github.com/privacyidea/privacyidea/issues/182","id":104213215,"number":182,"title":"U2F Token","user":{"login":"cornelinux","id":1908620,"avatar_url":"https://avatars.githubusercontent.com/u/1908620?v=3","gravatar_id":"","url":"https://api.github.com/users/cornelinux","html_url":"https://github.com/cornelinux","followers_url":"https://api.github.com/users/cornelinux/followers","following_url":"https://api.github.com/users/cornelinux/following{/other_user}","gists_url":"https://api.github.com/users/cornelinux/gists{/gist_id}","starred_url":"https://api.github.com/users/cornelinux/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cornelinux/subscriptions","organizations_url":"https://api.github.com/users/cornelinux/orgs","repos_url":"https://api.github.com/users/cornelinux/repos","events_url":"https://api.github.com/users/cornelinux/events{/privacy}","received_events_url":"https://api.github.com/users/cornelinux/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/privacyidea/privacyidea/labels/tokentype","name":"tokentype","color":"bfe5bf"}],"state":"open","locked":false,"assignee":{"login":"cornelinux","id":1908620,"avatar_url":"https://avatars.githubusercontent.com/u/1908620?v=3","gravatar_id":"","url":"https://api.github.com/users/cornelinux","html_url":"https://github.com/cornelinux","followers_url":"https://api.github.com/users/cornelinux/followers","following_url":"https://api.github.com/users/cornelinux/following{/other_user}","gists_url":"https://api.github.com/users/cornelinux/gists{/gist_id}","starred_url":"https://api.github.com/users/cornelinux/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cornelinux/subscriptions","organizations_url":"https://api.github.com/users/cornelinux/orgs","repos_url":"https://api.github.com/users/cornelinux/repos","events_url":"https://api.github.com/users/cornelinux/events{/privacy}","received_events_url":"https://api.github.com/users/cornelinux/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/privacyidea/privacyidea/milestones/16","html_url":"https://github.com/privacyidea/privacyidea/milestones/2.7%20continuing%20easy","labels_url":"https://api.github.com/repos/privacyidea/privacyidea/milestones/16/labels","id":1295886,"number":16,"title":"2.7 continuing easy","description":"","creator":{"login":"cornelinux","id":1908620,"avatar_url":"https://avatars.githubusercontent.com/u/1908620?v=3","gravatar_id":"","url":"https://api.github.com/users/cornelinux","html_url":"https://github.com/cornelinux","followers_url":"https://api.github.com/users/cornelinux/followers","following_url":"https://api.github.com/users/cornelinux/following{/other_user}","gists_url":"https://api.github.com/users/cornelinux/gists{/gist_id}","starred_url":"https://api.github.com/users/cornelinux/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cornelinux/subscriptions","organizations_url":"https://api.github.com/users/cornelinux/orgs","repos_url":"https://api.github.com/users/cornelinux/repos","events_url":"https://api.github.com/users/cornelinux/events{/privacy}","received_events_url":"https://api.github.com/users/cornelinux/received_events","type":"User","site_admin":false},"open_issues":1,"closed_issues":0,"state":"open","created_at":"2015-09-08T16:41:30Z","updated_at":"2015-09-08T16:41:51Z","due_on":"2015-10-29T23:00:00Z","closed_at":null},"comments":2,"created_at":"2015-09-01T08:19:55Z","updated_at":"2015-09-08T16:51:41Z","closed_at":null,"body":"U2F hardware tokens are used by end users to authenticate anonymously/pseudonymously to correspondingly enabled websites.\r\nU2F is a system that is designed to work without a central management. \r\nBut it provides cheap hardware tokens.\r\nUnfortunately these hardware tokens all contain a preseeded secret key, which could enable the vendors to identify the \"anonymous\" users.\r\n\r\nWe would prefer hardware tokens, that can be initialized. \r\nNevertheless due to the pricing of those tokens, it might be interesting to support U2F tokens this way, that a user can register his U2F token and use it to authenticate against privacyIDEA.\r\n\r\n**Note**: In this case again the user would loose his anonymity.\r\n\r\nhttps://fidoalliance.org/specifications/download/\r\n\r\nTake a look at:\r\nhttps://github.com/Yubico/u2fval"},"comment":{"url":"https://api.github.com/repos/privacyidea/privacyidea/issues/comments/138631110","html_url":"https://github.com/privacyidea/privacyidea/issues/182#issuecomment-138631110","issue_url":"https://api.github.com/repos/privacyidea/privacyidea/issues/182","id":138631110,"user":{"login":"cornelinux","id":1908620,"avatar_url":"https://avatars.githubusercontent.com/u/1908620?v=3","gravatar_id":"","url":"https://api.github.com/users/cornelinux","html_url":"https://github.com/cornelinux","followers_url":"https://api.github.com/users/cornelinux/followers","following_url":"https://api.github.com/users/cornelinux/following{/other_user}","gists_url":"https://api.github.com/users/cornelinux/gists{/gist_id}","starred_url":"https://api.github.com/users/cornelinux/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cornelinux/subscriptions","organizations_url":"https://api.github.com/users/cornelinux/orgs","repos_url":"https://api.github.com/users/cornelinux/repos","events_url":"https://api.github.com/users/cornelinux/events{/privacy}","received_events_url":"https://api.github.com/users/cornelinux/received_events","type":"User","site_admin":false},"created_at":"2015-09-08T16:51:41Z","updated_at":"2015-09-08T16:51:41Z","body":"Thanks a lot for the heads up.\r\n\r\nThats true. Well, I looked at it and with 849 sloc it look rather expensive to me.\r\nThere was a similar case with ORCA. Granted, the ocra2token.py with ~1100 sloc of LinOTP might be a more complete implementation, but I rather took the chance to implement it a new in privacyIDEA's tiqrtoken.py with ~420 sloc. I also looked at the python oath module - but integrating the oath module which was not packed for debian, seemed more complicated to me.\r\n\r\nAnd there are also some significant changes. While LinOTP introduced new controllers / endpoints for OCRA and U2F, privacyIDEA tries to avoid this by using the ttype endpoint. (see http://privacyidea.readthedocs.org/en/latest/modules/api/ttype.html) I think it is a rather good idea, to give any token the possibility to define some token specific endpoint action. Avoiding adding new endpoints with new token types.\r\n\r\nSo I guess I will take a look at some implementations to understand the specification but implement it anew."}}