Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico and Microsoft Introduce Passwordless Login

yubico.com

Post reply on HN
Print view View original

121–130 of 218 posts

Re: Yubico and Microsoft Introduce Passwordless Login

#121

Post by emlun »

tracker1 wrote: post #85
pishpash wrote: post #28

Good. After all the roundabout bullshit of "factors" ("2FA") and password managers, people have finally come to their senses that physical tokens are a very natural evolution of analog keys and the only real security, and should have been used from the get-go.

Keys are not the only real security... real security includes something you are, something you have, and something you know. Having something like this combined with the something you know (passphrase) would be real closer security. Now anyone with your token can access everything that key gets access to, without you needing to be there, or sharing a passphrase. That's less secure imho.

As xur17 points out, these devices support an on-device PIN like smart cards. The protocol also has support for future devices with biometric authentication, which could give you all three factors in one device.

Re: Yubico and Microsoft Introduce Passwordless Login

#122

Post by fl0wenol »

ocdtrekkie wrote: post #7

So my biggest question here is: Is this Azure only? Each announcement about it seems to indicate that I might not be able to use this key with my local account PC. Specifically, I have one use case computer where I have no screen, and getting through Windows login without it can be troublesome. I'd love to use this key to unlock it instead, but it's an offline machine. I had this plan with Yubikey for Windows Hello,…

Unfortunately it only works with Azure (at the minimum AD federation with Azure if you have some on-prem)

Re: Yubico and Microsoft Introduce Passwordless Login

#123

Post by emlun »

sp332 wrote: post #51
russell_h wrote: post #48

Earlier quoted context omitted.

I think you should elaborate on the specific threat model you're describing. Are you assuming a dumped database? Or are you talking about a brute force against an online service?

That is exactly the question a user should ask themselves. I can't answer it for anyone else. But for your two cases, the key is more secure because there is no relatively short password that can be guessed. An attacker has to brute force the cryptographic key, which should be infeasible. Passwords are easier to crack online or offline, unless you've picked a password with 112 bits of entropy.

>brute force the cryptographic key, which should be infeasible.

Not only infeasible - physically impossible, in fact (barring quantum computers). Just 128 bits of entropy would take 1e16 (10 quadrillion) years to brute force at 1e15 attempts per second. :)

Re: Yubico and Microsoft Introduce Passwordless Login

#125

Post by youdontknowtho »

fl0wenol wrote: post #122
ocdtrekkie wrote: post #7

So my biggest question here is: Is this Azure only? Each announcement about it seems to indicate that I might not be able to use this key with my local account PC. Specifically, I have one use case computer where I have no screen, and getting through Windows login without it can be troublesome. I'd love to use this key to unlock it instead, but it's an offline machine. I had this plan with Yubikey for Windows Hello,…

Unfortunately it only works with Azure (at the minimum AD federation with Azure if you have some on-prem)

You can use other identity providers for Azure AD. Shibboleth is supported, F5 and Ping are certified, there are others. If you use a different LDAP system than AD you can also sync your identities to Azure AD. OpenLDAP or one of the commercial vendors. It might be a little more elbow grease, but it works.

Re: Yubico and Microsoft Introduce Passwordless Login

#126

Post by youdontknowtho »

crankylinuxuser wrote: post #81

My problem is that Microsoft doesn't allow swapping in and out of authentication plugins like PAM. I work primarily in a Windows shop, and I got the other co-workers in Linux because PAM supports seamless multi-factor auth. I would have went Windows, but its too obfuscated or hard to do that. LinOTP works very well. And LinOTP works with a wide variety of tokens. Don't be locked to a single vendor.

You have to write a dll. It's not that big of a deal. That being said, I doubt there's much benefit to it when everything is said and done. (From a windows client perspective.)

Re: Yubico and Microsoft Introduce Passwordless Login

#127

Post by emlun »

I'd like to try to answer some common questions I see here:

- Q: Doesn't passwordless mean single factor? Isn't that insecure?

A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is optional, though, so both the single factor and two factor use cases are possible.

- Q: Is this Azure/Windows/AD only?

A: This post highlights the partnership with Microsoft and the integration with their products, but FIDO2 is not Microsoft-only (and Yubico will not be the only key vendor). CTAP2, once finished, will be published as an open standard like U2F, and the accompanying Web Authentication API [1] (WIP) is an OS-agnostic W3C standard enabling the same features in browsers.

[1]: https://www.w3.org/TR/webauthn/

- Q: Will I need a new YubiKey?

A: For passwordless (PIN) login, yes. However, existing YubiKeys with U2F support will be usable as a 2nd factor in Web Authentication, and sites that currently use U2F can upgrade to using the Web Authentication API without needing their users to re-enroll their keys.

Full disclosure: I'm a Yubico engineer and one of the editors of the Web Authentication spec.

Re: Yubico and Microsoft Introduce Passwordless Login

#128

Post by crankylinuxuser »

ShroudedNight wrote: post #108
crankylinuxuser wrote: post #81

My problem is that Microsoft doesn't allow swapping in and out of authentication plugins like PAM. I work primarily in a Windows shop, and I got the other co-workers in Linux because PAM supports seamless multi-factor auth. I would have went Windows, but its too obfuscated or hard to do that. LinOTP works very well. And LinOTP works with a wide variety of tokens. Don't be locked to a single vendor.

> Microsoft doesn't allow swapping in and out of authentication plugins like PAM. FWIW, that's not strictly true. See: https://msdn.microsoft.com/en-us/library/windows/desktop/mt1... I don't have enough experience to comment one way or the other about its difficulty.

Well, this certainly surprises me. I know last I looked, there was some discussion about MFA and requiring Azure.

In the environment I work in, I'm not able to use services outside a very limited list, or I have to roll my own using established technologies (FedRAMP). So Azure is right out. So was using Amazon Directory Services.

I know my colleagues are much more familiar with Windows, whereas I.. (look at username, relevant!). My solution, after assessing that Windows couldn't do 2 (or 3) factor, and it was stuck at login/password and some firewall blocking IP's, I knew what I had to do. And that meant Linux for the bastions, and LinOTP and appropriate config options to make it work.

I was kind, and didn't inflict a AAA stack of "kerb, ldap, radius, and shib" on the Windows admins :) Well, that and I didn't want to be the sole maintainer of that system.

Re: Yubico and Microsoft Introduce Passwordless Login

#129

Post by ggg9990 »

krupan wrote: post #86

The conversation here is blowing my mind. People are actually worried that their yubikey might get lost or stolen when likely most of your passwords are already all over the internet. I got an email from Twitter just a few days ago stating that they'd leaked my password. Twitter! Not Joe's Auto-Body who's website is being run by a high-schooler, but one of the pioneers of internet companies. They messed up. Your pass…

It’s why I told my parents to pick random passwords and write them all down in a notebook that they keep next to their computer. My way, they’re only stealable by their housekeeper or a burglar. If they needed to remember the passwords, they’d be vulnerable to 100 million script kiddies with rainbow tables.

Re: Yubico and Microsoft Introduce Passwordless Login

#130

Post by lerie82 »

krupan wrote: post #86

The conversation here is blowing my mind. People are actually worried that their yubikey might get lost or stolen when likely most of your passwords are already all over the internet. I got an email from Twitter just a few days ago stating that they'd leaked my password. Twitter! Not Joe's Auto-Body who's website is being run by a high-schooler, but one of the pioneers of internet companies. They messed up. Your pass…

you think twitter is a pioneer of internet companies? it took them 12 years to turn a profit.
Post reply on HN