Ad companies that specialize in re-targeting are going to have an absolute blast with this!
How? Login is not automatic, you need to tap the key. So unless you tap the key each time you view an ad, the ad company gets nothing.
Yubico and Microsoft Introduce Passwordless Login
11–20 of 218 posts
Re: Yubico and Microsoft Introduce Passwordless Login
#12Can someone remind me why we don't use public key cryptography for authentication on websites?
That's exactly what this is. From the post:
> FIDO2 is built on the same security and privacy features of FIDO U2F: strong public key cryptography, no drivers or client software and one key for unlimited account access with no shared secrets.
They should've kept all the Microsoft stuff out of the post, other than just mentioning that they've been working on the spec together. The Azure stuff seems to have confused everyone about how this actually works.
There are also other app-based ways to login to websites with public key crypto, such as https://www.grc.com/sqrl/sqrl.htm, or https://www.civic.com/. But of course they are less secure than the hardware/Yubikey version, for the same reason Yubikey U2F tokens are more secure than Google Authenticator for 2FA (well, unless companies act stupid and enable "SMS backup" alongside Yubikey support, in which case it's even less secure than Google Auth-only as an option).
Re: Yubico and Microsoft Introduce Passwordless Login
#13Correct me if I am wrong, but passwordless login is a single-factor authentication and less secure than MFA. Depending on whenever hardware key is more or less secure than the password, the mass adoption of this could make things LESS secure.
I would expect things to be more secure in many cases. People are pretty good at keeping physical items somewhat safe and notice when they’re gone. Yubikeys cannot easily be cloned. The password cannot be attacked remotely. 2FA is certainly safer, though.
Re: Yubico and Microsoft Introduce Passwordless Login
#14Correct me if I am wrong, but passwordless login is a single-factor authentication and less secure than MFA. Depending on whenever hardware key is more or less secure than the password, the mass adoption of this could make things LESS secure.
From TFA:
FIDO2 adds more options to the login process:
Single Factor: This only requires possession of the security Key to log in, allowing for a passwordless tap-and-go experience.
Second-Factor: In a two-factor authentication scenario, such as the current Google and Facebook FIDO U2F implementations, the Security Key by Yubico is used as a strong second factor along with a username and password.
Multi-Factor: This allows the use of the Security Key by Yubico with an additional factor such as a PIN (instead of a password), to meet the high-assurance requirements of operations like financial transactions, or submitting a prescription.
It's an option, not a requirement.
Re: Yubico and Microsoft Introduce Passwordless Login
#15Two things - is there really need for them to be this large? They also look vulnerable? Maybe its just the look, but the blue one looks like it won't survive proper stress test... And second thing - is exposing connector safe against mechanical damage? Will it withstand constantly being scratched by keys?
There is the "nano" version available which is a lot smaller than the one advertised. The ones that I own have held up just fine for the past year on my keychain.
https://www.yubico.com/product/yubikey-4-series/#yubikey-4-n...
Re: Yubico and Microsoft Introduce Passwordless Login
#16Correct me if I am wrong, but passwordless login is a single-factor authentication and less secure than MFA. Depending on whenever hardware key is more or less secure than the password, the mass adoption of this could make things LESS secure.
That is confirmed in the "How does this work?" section. Your concern is addressed in the "Why is this important?" section. The key is definitely more secure against cracking than a password. It is more vulnerable to being physically stolen, but for most people, that is a lower risk.
Re: Yubico and Microsoft Introduce Passwordless Login
#17Okay, so I have two Yubico U2F keys and two other U2F keys so far. I don't think I'll buy a fifth and sixth anytime soon.
But hopefully U2F will actually work in non-Chrome browsers in the near future.
Re: Yubico and Microsoft Introduce Passwordless Login
#18Correct me if I am wrong, but passwordless login is a single-factor authentication and less secure than MFA. Depending on whenever hardware key is more or less secure than the password, the mass adoption of this could make things LESS secure.
Additionally passwords are protected by the fifth amendment [1]. A hardware key is not.
This is a big part of why you always want one of your factors to be something you know.
[1] https://en.wikipedia.org/wiki/Fifth_Amendment_to_the_United_...
Re: Yubico and Microsoft Introduce Passwordless Login
#19Correct me if I am wrong, but passwordless login is a single-factor authentication and less secure than MFA. Depending on whenever hardware key is more or less secure than the password, the mass adoption of this could make things LESS secure.
It depends what your threat model looks like.
For example if you have good physical security and limit passwordless login to physically secure machines via AD computer groups, this may protect you from remote attackers.
If however organizations allow the use of this over the internet from "any" endpoint then this completely replaces a password 1:1 and theft/loss of the Yubikey could be a major problem.
This could also be used only on a single layer of your security. For example passwordless VPN authentication but then a password/2F is required for actual user login.
Re: Yubico and Microsoft Introduce Passwordless Login
#20Two things - is there really need for them to be this large? They also look vulnerable? Maybe its just the look, but the blue one looks like it won't survive proper stress test... And second thing - is exposing connector safe against mechanical damage? Will it withstand constantly being scratched by keys?
There is the "nano" version available which is a lot smaller than the one advertised. The ones that I own have held up just fine for the past year on my keychain. https://www.yubico.com/product/yubikey-4-series/#yubikey-4-n...
This size is much better, but I assume it lacks the "touch" protection against remote attacks, like the other ones?
I still wonder about the exposed connector - what its durability. After all, I would like for such a tool to serve me for years fault-free.