Please Remember Me: Security Analysis of U2F Remember Me Implementations in The Wild Gwendal Patat, Mohamed Sabt To cite this version: Gwendal Patat, Mohamed Sabt. Please Remember Me: Security Analysis of U2F Remember Me Implementations in The Wild. Actes SSTIC 2020, 18ème Symposium sur la sécurité des technologies de l’information et des communications (SSTIC 2020), 2020, Rennes, France. hal-02865105 HAL Id: hal-02865105 https://hal.inria.fr/hal-02865105 Submitted on 11 Jun 2020 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Please Remember Me: Security Analysis of U2F Remember Me Implementations in The Wild Gwendal Patat and Mohamed Sabt
[email protected] [email protected] Univ Rennes, CNRS, IRISA Abstract. Users and service providers are increasingly aware of the security issues that arise because of password breaches. Recent studies show that password authentication can be made more secure by relying on second-factor authentication (2FA). Supported by leading web service providers, the FIDO Alliance defines the Universal 2nd Factor (U2F) protocols, an industrial standard that proposes a challenge-response 2FA solution. The U2F protocols have been thoughtfully designed to ensure high security.