Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Soft U2F: A software-based U2F authenticator for macOS

githubengineering.com

Post reply on HN
Print view View original

101–110 of 114 posts

Re: Soft U2F: A software-based U2F authenticator for macOS

#101

Post by doorley »

ptoomey3 wrote: post #61
petee wrote: post #54

This seems misguided - it is watering down a decent system simply to appease and attract people too cheap to buy tokens; if 2fa is something that is so important to you, and you need it, just buy the damn tokens! A vague comparison, would be me selling pre-printed 'random' passwords on paper because a user generating their own was 'too difficult' IMHO, soft token u2f is only useful for testing, development, and perso…

What is the attack scenario you feel a hardware token protects you against that a software token will not (for the use cases U2F was designed for)? Sure, hardware tokens prevent malware from actually lifting your private keys. But, to steal your software private keys you likely need malicious code running on your computer. And, once an attacker has that, it is largely game over for all intents and purposes anyway. Th…

You can use a hardware token on multiple machines.

My bank, for example, has both your password entry and the private keys on the token. All you ever enter onto a computer or smartphone is the one time password, even when using their smartphone app.

I like my bank.

Re: Soft U2F: A software-based U2F authenticator for macOS

#102

Post by atonse »

tptacek wrote: post #57
atonse wrote: post #9

To Github people: I ordered your yubikey token but stayed away from U2F out of fear that I'd be locked out if I lost the hardware token. But I didn't realize you could setup U2F and TOTP as a backup.

Not only can you do this, but the major services won't even let you set up U2F without a backup factor. The best current Google auth stack, by the way, is: 1. U2F 2. Phone-based authenticator app (TOTP) 3. Password-manager password 4. Printed codes 5. DISABLE SMS. (Google forces you to enroll in SMS to turn on 2FA; you can simply delete your phone number after enrolling everything else).

For some reason I made the wrong assumptions. Thanks for the clarification. I'm going to activate that U2F key asap, and also disable SMS for my google account.

Re: Soft U2F: A software-based U2F authenticator for macOS

#103

Post by drodgers »

sowbug wrote: post #44
philip1209 wrote: post #21

Until Yubikey releases a USB-c version of their nano, I think I'll use this. Since I've had to transition to a keychain U2F device instead of one I can leave in my laptop, I find myself using it far less.

I'd expect the U2F protocol to be built into secure elements on laptops before a Type-C Nano comes into existence. USB-C ports are too precious to keep them filled all the time with an authentication device, and there doesn't seem to be enough room in the male side of the Type-C coupling to allow the necessary circuitry to exist in a slim form factor. Both these problems are solvable, but meanwhile secure elements ar…

Honestly, I don't know why Apple don't implement U2F on the secure enclave (activated via the TouchId sensor); it seems like such an obvious move.

Maybe they're trying to get iCloud and Safari support all ready to release at-once?

Re: Soft U2F: A software-based U2F authenticator for macOS

#104

Post by cormacrelf »

drodgers wrote: post #103
sowbug wrote: post #44

Earlier quoted context omitted.

I'd expect the U2F protocol to be built into secure elements on laptops before a Type-C Nano comes into existence. USB-C ports are too precious to keep them filled all the time with an authentication device, and there doesn't seem to be enough room in the male side of the Type-C coupling to allow the necessary circuitry to exist in a slim form factor. Both these problems are solvable, but meanwhile secure elements ar…

Honestly, I don't know why Apple don't implement U2F on the secure enclave (activated via the TouchId sensor); it seems like such an obvious move. Maybe they're trying to get iCloud and Safari support all ready to release at-once?

¡Hola 2018!

Re: Soft U2F: A software-based U2F authenticator for macOS

#106

Post by mastahyeti »

tscs37 wrote: post #80
ptoomey3 wrote: post #78

Earlier quoted context omitted.

Once you have malicious software running it is largely game over. Sure, the hardware token can require a press..but once pressed what challenge is being signed? Malware can just wait and send a challenge for Site A when you are actually trying to sign into site B. Or, the malware can just wait until you login and steal your browser cookies. Oh, also, Soft U2F can require a similar physical touch if you have a mac wit…

Atleast for my u2f token, I'm being shown the site I'm signing for on a hardware screen.

Which device are you using? With U2F, the browser doesn't send the name of the site to the authenticator.

Re: Soft U2F: A software-based U2F authenticator for macOS

#107

Post by tscs37 »

mastahyeti wrote: post #106
tscs37 wrote: post #80

Earlier quoted context omitted.

Atleast for my u2f token, I'm being shown the site I'm signing for on a hardware screen.

Which device are you using? With U2F, the browser doesn't send the name of the site to the authenticator.

I'm using Trezor, I believe it has been preloaded with certain websites so it knows Github and Google and the likes.

It also shows parts of the public key (or so I believe, it is a unique identifier) per website.

Re: Soft U2F: A software-based U2F authenticator for macOS

#109

Post by petee »

ptoomey3 wrote: post #61
petee wrote: post #54

This seems misguided - it is watering down a decent system simply to appease and attract people too cheap to buy tokens; if 2fa is something that is so important to you, and you need it, just buy the damn tokens! A vague comparison, would be me selling pre-printed 'random' passwords on paper because a user generating their own was 'too difficult' IMHO, soft token u2f is only useful for testing, development, and perso…

What is the attack scenario you feel a hardware token protects you against that a software token will not (for the use cases U2F was designed for)? Sure, hardware tokens prevent malware from actually lifting your private keys. But, to steal your software private keys you likely need malicious code running on your computer. And, once an attacker has that, it is largely game over for all intents and purposes anyway. Th…

Well physical presence is huge - your software-compromised token can sign infinite number of bogus token requests, where as with hardware, you'd have to be an idiot to press the button for random requests, or repeatedly; and has nothing to do with stolen passwords.

The best an attacker can do at that point is access whatever account-specific token that was 'intercepted', and use that until it expires on whatever site...which if implemented correctly won't let you make any major changes without your token press - aka, software-token just gave up your account, where hardware would have stopped it.

Re: Soft U2F: A software-based U2F authenticator for macOS

#110

Post by hdhzy »

Rjevski wrote: post #32

What's wrong with client certificates? Instead of reinventing the wheel they should've just used those which would've given browser vendors a reason to improve their UX regarding client certs.

Client certificates are best from security perspective but lack UX (this could be fixed) and are not designed with privacy in mind. U2F on the other hand generates unique pair of keys for each origin. By default.
Post reply on HN