Yubico and Microsoft Introduce Passwordless Login • Hacker News Board

Re: Yubico and Microsoft Introduce Passwordless Login

#21

Post by ilikepi » Tue, May 08, 2018, 7:07 PM UTC

BartBoch wrote: post #9

Two things - is there really need for them to be this large? They also look vulnerable? Maybe its just the look, but the blue one looks like it won't survive proper stress test... And second thing - is exposing connector safe against mechanical damage? Will it withstand constantly being scratched by keys?

The internals probably don't require a form factor that large. Some of Yubico's other products barely protrude from the port. I think there's a convenience trade-off, though...a smaller one is harder to insert and remove.

I have two of this form factor on my keyring, one of which is a couple years old now. Neither show appreciable signs of wear on their connectors beyond what you'd expect from regular insertion. They feel pretty robust, though I've never actually tried to break one...

EDIT: minor clarification

Re: Yubico and Microsoft Introduce Passwordless Login

#22

Post by swebs » Tue, May 08, 2018, 7:07 PM UTC

grondilu wrote: post #2

Can someone remind me why we don't use public key cryptography for authentication on websites?

It looks like there's a W3C draft "in the works" but I'm concerned since almost half the editors work for the two companies trying to pass this proprietary Azure/AD vendor lock-in nonsense.

https://www.w3.org/TR/2018/CR-webauthn-20180320

Re: Yubico and Microsoft Introduce Passwordless Login

#23

Post by pishpash » Tue, May 08, 2018, 7:08 PM UTC

Xylakant wrote: post #13

vzaliva wrote: post #10

Correct me if I am wrong, but passwordless login is a single-factor authentication and less secure than MFA. Depending on whenever hardware key is more or less secure than the password, the mass adoption of this could make things LESS secure.

I would expect things to be more secure in many cases. People are pretty good at keeping physical items somewhat safe and notice when they’re gone. Yubikeys cannot easily be cloned. The password cannot be attacked remotely. 2FA is certainly safer, though.

Passwords are utterly broken. All the entropy of memorizable passwords among humans have probably been extracted by this point. All they give you is a false sense of security. The password portion of 2FA is mostly theater, conditioned on the notion that passwords are broken. Hardware keys is the way of the future.

Re: Yubico and Microsoft Introduce Passwordless Login

#24

Post by Risord » Tue, May 08, 2018, 7:09 PM UTC

vzaliva wrote: post #10

Correct me if I am wrong, but passwordless login is a single-factor authentication and less secure than MFA. Depending on whenever hardware key is more or less secure than the password, the mass adoption of this could make things LESS secure.

I think best practice will be that you can login with single-factor and see basic stuff but if you want to do anything more critical like money related or changing email depending from context you are forced to use two-factor.

Also if it's at least approximately to password security this is very welcome options. Most services I use I just want access easily.

Re: Yubico and Microsoft Introduce Passwordless Login

#25

Post by sametmax » Tue, May 08, 2018, 7:11 PM UTC

sp332 wrote: post #16

vzaliva wrote: post #10

Correct me if I am wrong, but passwordless login is a single-factor authentication and less secure than MFA. Depending on whenever hardware key is more or less secure than the password, the mass adoption of this could make things LESS secure.

That is confirmed in the "How does this work?" section. Your concern is addressed in the "Why is this important?" section. The key is definitely more secure against cracking than a password. It is more vulnerable to being physically stolen, but for most people, that is a lower risk.

I doubt that.

Friends or family can't read your mind, but they can steal your physical key.

People putting pins on their phones or password on their laptop are not afraid of being pirated. This is a vague, abstract threat to them. Becoming part of a botnet is really not important to them, and they getting their credit card stolen from the web is really not credible enough for non tech saavy user.

What they are afraid of is other people looking at their stuff. Internet history. Pictures. Their clear text personal document.

Beside, a key is annoying. Where do you think they will store it when they travel ? In the same bag than the laptop. So you steal the bag, you steal the password.

Re: Yubico and Microsoft Introduce Passwordless Login

#26

Post by d4l3k » Tue, May 08, 2018, 7:12 PM UTC

pishpash wrote: post #23

Xylakant wrote: post #13

Earlier quoted context omitted.

I would expect things to be more secure in many cases. People are pretty good at keeping physical items somewhat safe and notice when they’re gone. Yubikeys cannot easily be cloned. The password cannot be attacked remotely. 2FA is certainly safer, though.

Passwords are utterly broken. All the entropy of memorizable passwords among humans have probably been extracted by this point. All they give you is a false sense of security. The password portion of 2FA is mostly theater, conditioned on the notion that passwords are broken. Hardware keys is the way of the future.

Except that passwords at least protect you if your hardware key is stolen. Using just a hardware key seems similarly risky to just using a password.

Re: Yubico and Microsoft Introduce Passwordless Login

#27

Post by Someone1234 » Tue, May 08, 2018, 7:13 PM UTC

grondilu wrote: post #2

Can someone remind me why we don't use public key cryptography for authentication on websites?

Because you'd need a cross-platform, cross-machine, cross-device key management infrastructure and browser support that simply doesn't exist.

Even if you contrast it against something like e.g. LastPass or Keepass, you're still missing a ton of infrastructure.

Re: Yubico and Microsoft Introduce Passwordless Login

#28

Post by pishpash » Tue, May 08, 2018, 7:13 PM UTC

Good. After all the roundabout bullshit of "factors" ("2FA") and password managers, people have finally come to their senses that physical tokens are a very natural evolution of analog keys and the only real security, and should have been used from the get-go.

Re: Yubico and Microsoft Introduce Passwordless Login

#29

Post by fabian2k » Tue, May 08, 2018, 7:14 PM UTC

What I'd find interesting is using U2F (or FIDO2, which seems to be an evolution of this) as a second factor for SSH logins. But that doesn't seem possible without changes to SSH itself.

And I hope that this might trigger more widespread support for U2F and similar mechanisms in browsers and websites.

Re: Yubico and Microsoft Introduce Passwordless Login

#30

Post by pishpash » Tue, May 08, 2018, 7:14 PM UTC

d4l3k wrote: post #26

pishpash wrote: post #23

Earlier quoted context omitted.

Passwords are utterly broken. All the entropy of memorizable passwords among humans have probably been extracted by this point. All they give you is a false sense of security. The password portion of 2FA is mostly theater, conditioned on the notion that passwords are broken. Hardware keys is the way of the future.

Except that passwords at least protect you if your hardware key is stolen. Using just a hardware key seems similarly risky to just using a password.

What you need is a mechanism to detect loss of contact with the human and revoke. One way is to require several hardware tokens to combine their entropy to authenticate. Again, don't make a password be a part of this, use another token.