This looks like another avenue for enhanced tracking of unique users. Don't give up your multiple passwords.
Yubico and Microsoft Introduce Passwordless Login
141–150 of 218 posts
Re: Yubico and Microsoft Introduce Passwordless Login
#142I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…
Is there word on whether Yubikey 4 models will support FIDO 2? Or do we have to wait for a new model?
Re: Yubico and Microsoft Introduce Passwordless Login
#143I wonder if we’ll get to the point of having two-factor passwordless authentication. Like you need two of the following methods to access a website (u2f/fido2, TOTP, SMS, Recovery codes, tls client certificate, etc.) and forego passwords altogether.
Re: Yubico and Microsoft Introduce Passwordless Login
#144Why can't I secure login with a fingerprint?
Microsoft could have team up with Logitech like Sony with Erricson, and come up with a standard and put (mildly cheap) finger print reader on each sold keyboard and popularize open source standard for software implementation.
Re: Yubico and Microsoft Introduce Passwordless Login
#145My problem is that Microsoft doesn't allow swapping in and out of authentication plugins like PAM. I work primarily in a Windows shop, and I got the other co-workers in Linux because PAM supports seamless multi-factor auth. I would have went Windows, but its too obfuscated or hard to do that. LinOTP works very well. And LinOTP works with a wide variety of tokens. Don't be locked to a single vendor.
You have to write a dll. It's not that big of a deal. That being said, I doubt there's much benefit to it when everything is said and done. (From a windows client perspective.)
"Not that big of a deal." you say? Then why is the documentation how to do this very sparse, and only for Win10? And if it's not a big deal, why is YubiKey making such a big deal?
Well, because in the Windows world, switching in/out authentication subsystems is a arduous task surmountable by primarily Microsoft.
And what would that be good for? Well, simply put would be a nice addition to a Windows Terminal Server. Turn a Windows TS into a proper bastion that requires 2fa. Us Linux admins have that with PAM. Sure would be nice to do the same for Windows. But right now, Windows is grossly deficient.
Re: Yubico and Microsoft Introduce Passwordless Login
#146Why can't I secure login with a fingerprint? Microsoft could have team up with Logitech like Sony with Erricson, and come up with a standard and put (mildly cheap) finger print reader on each sold keyboard and popularize open source standard for software implementation.
[deleted]
Re: Yubico and Microsoft Introduce Passwordless Login
#147Did they improve the stories for recovery ("I lost my device") and revocation ("my device has been stolen")? As far as I knew you had to buy 2 devices to have a chance of recovery, and Fido 1 explicitly said "revocation is something that needs to be resolved by each website that authenticates users", which is just asking for trouble. I would love to have a hardware (or even phone-based) alternative to passwords, with…
Re Google Authenticator, as an alternative have you tried Authy? It offers a far better UX, and if you lose your phone you can easily get everything back without doing a backup/restore before hand. Plus you can run it on as many devices as you require, including desktops.
I may be missing something, but Authy seems to me to break one of the main points of 2FA, which is that password breach doesn't give an attacker access to your accounts. If your Authy credentials are compromised, an attacker has access to all of your seeds and can generate codes.
Re: Yubico and Microsoft Introduce Passwordless Login
#148Correct me if I am wrong, but passwordless login is a single-factor authentication and less secure than MFA. Depending on whenever hardware key is more or less secure than the password, the mass adoption of this could make things LESS secure.
You trust a single factor hardware key to protect your car and your home. How often have you lost those?
Re: Yubico and Microsoft Introduce Passwordless Login
#149I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…
> he new YubiKeys support an on-device PIN that isn't shared with the server
Doesn't this PIN become a master password for all the websites at that point?
Re: Yubico and Microsoft Introduce Passwordless Login
#150I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…
A PIN is really a numeric password. It has all the same flaws - compromise risk (say via social engineering) and the risk of forgetting and needing it reset.
So the ‘passwordless’ option here is either rename the password to PIN or eliminate it to provide single-factor login. The latter is a dream for smart attackers, since there is always some social engineering route they can use to acquire a legit token.