Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico and Microsoft Introduce Passwordless Login

yubico.com

Post reply on HN
Print view View original

51–60 of 218 posts

Re: Yubico and Microsoft Introduce Passwordless Login

#51

Post by sp332 »

russell_h wrote: post #48
sp332 wrote: post #31

Earlier quoted context omitted.

Anyone in the world could crack your password. (Well, any of 2.5 billion people with an internet connection.) Requiring a physical key instead cuts the attack surface down quite a bit. If you can secure your car and house keys, you can secure this.

I think you should elaborate on the specific threat model you're describing. Are you assuming a dumped database? Or are you talking about a brute force against an online service?

That is exactly the question a user should ask themselves. I can't answer it for anyone else. But for your two cases, the key is more secure because there is no relatively short password that can be guessed. An attacker has to brute force the cryptographic key, which should be infeasible. Passwords are easier to crack online or offline, unless you've picked a password with 112 bits of entropy.

Re: Yubico and Microsoft Introduce Passwordless Login

#52

Post by mcbain »

guitarbill wrote: post #43
Spone wrote: post #40

Earlier quoted context omitted.

It already works in Firefox (behind a flag), but sadly some websites explicitly target Chrome...

FF traditionally required a plugin, I think native support is recent?

It was added in Firefox 57.

Works fine for me.

Re: Yubico and Microsoft Introduce Passwordless Login

#53

Post by lrem »

BartBoch wrote: post #9

Two things - is there really need for them to be this large? They also look vulnerable? Maybe its just the look, but the blue one looks like it won't survive proper stress test... And second thing - is exposing connector safe against mechanical damage? Will it withstand constantly being scratched by keys?

There are multiple sizes, including ones that barely stick out of a USB-A or USB-C port. The keychain form factor is for convenience. I have multiple keys in multiple sizes for 3 or 4 years now, none fell to mechanical damage (but one pretty much stopped responding to touch, requiring replacement).

Re: Yubico and Microsoft Introduce Passwordless Login

#54

Post by e12e »

vzaliva wrote: post #10

Correct me if I am wrong, but passwordless login is a single-factor authentication and less secure than MFA. Depending on whenever hardware key is more or less secure than the password, the mass adoption of this could make things LESS secure.

> passwordless login is a single-factor authentication and less secure than MFA

If you go from MFA to fido2, maybe. If you go from single-factor password, to single-factor fido2 - it's likely security will improve. A lot.

> Depending on whenever hardware key is more or less secure than the password

It is:

A password can be sniffed, filmed, inferred from sound recording.

You don't know when someone knows your password; a key will be missing (or copied, but that's supposed to be Very Difficult (tm)).

A password is unlikely to encode as much entropy; certainly any password/phrase you actually type in. 128+ bits of entropy is surprisingly hard to encode in a manageable size (it's 16 completely random binary bytes).

Now, if the assumption is that the alternative is a ssh key locked on a device, additionally protected by a pin... Maybe The fido2 is slightly less secure.

But if you try and list the failure modes / do some threat modelling ; I think you'll see it ends up a close race.

It would certainly pair well with "something you know" - eg a pin/password with somehow proper rate-limiting.

Re: Yubico and Microsoft Introduce Passwordless Login

#55

Post by waisbrot »

Someone1234 wrote: post #19
vzaliva wrote: post #10

Correct me if I am wrong, but passwordless login is a single-factor authentication and less secure than MFA. Depending on whenever hardware key is more or less secure than the password, the mass adoption of this could make things LESS secure.

It depends what your threat model looks like. For example if you have good physical security and limit passwordless login to physically secure machines via AD computer groups, this may protect you from remote attackers. If however organizations allow the use of this over the internet from "any" endpoint then this completely replaces a password 1:1 and theft/loss of the Yubikey could be a major problem. This could als…

Unless you're asserting that the hardware token is just as crackable as a password, it's not a 1:1 replacement. The problem with passwords is that you have 10,000 users and more than one of them has a bad password. The problem with hardware tokens is that I've stolen your token. So passwords are vulnerable to bots, while the hardware token requires a human to find/steal something and connect it with a specific account.

Re: Yubico and Microsoft Introduce Passwordless Login

#56

Post by floatboth »

guitarbill wrote: post #42
pg_bot wrote: post #15

Earlier quoted context omitted.

There is the "nano" version available which is a lot smaller than the one advertised. The ones that I own have held up just fine for the past year on my keychain. https://www.yubico.com/product/yubikey-4-series/#yubikey-4-n...

Do previous YubiKeys support FIDO2? From the post, I assume you need one of the new ones.

They plan to support it on "additional keys", whatever that means:

https://twitter.com/Yubico/status/993923882829529088

Re: Yubico and Microsoft Introduce Passwordless Login

#57

Post by BoppreH »

Did they improve the stories for recovery ("I lost my device") and revocation ("my device has been stolen")? As far as I knew you had to buy 2 devices to have a chance of recovery, and Fido 1 explicitly said "revocation is something that needs to be resolved by each website that authenticates users", which is just asking for trouble.

I would love to have a hardware (or even phone-based) alternative to passwords, with no third-party and better privacy, but I feel like this solution only handles the happy path.

For an example of a happy-path-only system that makes me nervous, look at Google Authenticator. Recovery is made with backup codes, but they are also "resolved by each website" (https://security.stackexchange.com/questions/167563/where-to...), which often means no support at all. Not to mention having to create a new backup after creating a new account. I still use Google Authenticator myself, but I dread the day I lose my phone.

If the protocol doesn't handle recovery/authentication, the fallback is a trusted third party (e.g. email) or legal identity (e.g. scanned passport). Aside from being a huge hassle and creating a weak point, it weakens the user's privacy.

Re: Yubico and Microsoft Introduce Passwordless Login

#58

Post by floatboth »

fabian2k wrote: post #29

What I'd find interesting is using U2F (or FIDO2, which seems to be an evolution of this) as a second factor for SSH logins. But that doesn't seem possible without changes to SSH itself. And I hope that this might trigger more widespread support for U2F and similar mechanisms in browsers and websites.

No need to touch SSH itself, PAM is a thing (unless you're on OpenBSD). Here's an example of pam-u2f with OpenSSH:

https://aprilmacdonald.com/two-factor-ssh-authentication-wit...

I actually use a Yubikey for SSH in a different way: with gpg-agent. E.g. https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey-NEO....

Re: Yubico and Microsoft Introduce Passwordless Login

#60

Post by Ajedi32 »

BoppreH wrote: post #57

Did they improve the stories for recovery ("I lost my device") and revocation ("my device has been stolen")? As far as I knew you had to buy 2 devices to have a chance of recovery, and Fido 1 explicitly said "revocation is something that needs to be resolved by each website that authenticates users", which is just asking for trouble. I would love to have a hardware (or even phone-based) alternative to passwords, with…

Neither of those problems (lost key, compromised key) are anything new. Why wouldn't sites just handle them the same way they currently handle revoking/resetting passwords?
Post reply on HN