Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico and Microsoft Introduce Passwordless Login

yubico.com

Post reply on HN
Print view View original

161–170 of 218 posts

Re: Yubico and Microsoft Introduce Passwordless Login

#161

Post by consp »

emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

> A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is optional, though, so both the single factor and two factor use cases are possible.

No, since passwordless login is available, the lowest denominator applies: single factor. Despite all your efforts it will most likely be possible to perform a passwordless login even when password is required in a few years (as these things get broken). The something you know is useless, as it can be ignored. And because it can, it will. Either by force, by negligence or by laziness.

Re: Yubico and Microsoft Introduce Passwordless Login

#162

Post by not_that_noob »

zaarn wrote: post #156
not_that_noob wrote: post #151

Earlier quoted context omitted.

That’s really the flaw of single sign-on and Webauthn - that one key now unlocks the kingdom.

I don't see that as a flaw really. It's not different to having a password manager, with proper WebAuthn atleast. What you do is you take this key that unlocks the kingdom. And then you keep it safe. Unlike before there isn't 20 keys that unlock parts of the kingdom that might lead to unlocking other kingdoms via roundabout ways. Your attention for security can be focused on a single key. The average users will be mu…

The flaw stems from the fact that an attacker can thru social engineeung acquire that root crendential (password or biometric or token). Once they have it, they can clean out all your banking, stock and home equity line accounts in one sweep. You as a user may not know that credential is compromised - maybe it was a key logger, maybe it was social engineering the cell phone provider to port your number and then qualify their phone with an sms token. You don’t know when that happened - you just see empty accounts.

With personal password managers, no third party is issuing tokens for access - just you. So it’s unlikley to be chosen for an attack - because it’s too hard for the attacker to acquire the credentials for access without detection.

Re: Yubico and Microsoft Introduce Passwordless Login

#163

Post by Freak_NL »

teknopaul wrote: post #160
emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

Does it identity you as the same person to two different websites? I.e. Is it for building up advertising profiles like google oor facebook logins?

The FIDO U2F and WebAuthN standards explicitly address this issue, because it is a valid concern. No, your key cannot be detected as being the same key on website A and B.

Undoubtedly the same holds true for these Microsoft services.

Re: Yubico and Microsoft Introduce Passwordless Login

#164

Post by Freak_NL »

not_that_noob wrote: post #162
zaarn wrote: post #156

Earlier quoted context omitted.

I don't see that as a flaw really. It's not different to having a password manager, with proper WebAuthn atleast. What you do is you take this key that unlocks the kingdom. And then you keep it safe. Unlike before there isn't 20 keys that unlock parts of the kingdom that might lead to unlocking other kingdoms via roundabout ways. Your attention for security can be focused on a single key. The average users will be mu…

The flaw stems from the fact that an attacker can thru social engineeung acquire that root crendential (password or biometric or token). Once they have it, they can clean out all your banking, stock and home equity line accounts in one sweep. You as a user may not know that credential is compromised - maybe it was a key logger, maybe it was social engineering the cell phone provider to port your number and then quali…

Whether you use a hardware key, or a password manager, in both cases the attacker needs both authentication factors: your password, and the hardware key or password manager.

With a hardware key you gain the advantage of the attackers having to physically gain access to that key.

Re: Yubico and Microsoft Introduce Passwordless Login

#165

Post by Freak_NL »

tialaramex wrote: post #158
joering2 wrote: post #144

Why can't I secure login with a fingerprint? Microsoft could have team up with Logitech like Sony with Erricson, and come up with a standard and put (mildly cheap) finger print reader on each sold keyboard and popularize open source standard for software implementation.

Your fingerprint is not a key, it's an identity. So your design tells every place you sign in this way "I'm joering2". And if course if any of them want to log in somewhere else, they now know to say the same thing, "I'm joering2". I guess this is slightly easier than typing your email address? But it's not a security feature. The FIDO/U2F design is a cryptographic key enshrined as a physical key, so rather than "I'm…

> Your fingerprint is not a key, it's an identity.

Also, you can't revoke fingerprints when they're compromised more than 10 times (20 if you're willing to use your toes too).

Re: Yubico and Microsoft Introduce Passwordless Login

#166

Post by zaarn »

not_that_noob wrote: post #162
zaarn wrote: post #156

Earlier quoted context omitted.

I don't see that as a flaw really. It's not different to having a password manager, with proper WebAuthn atleast. What you do is you take this key that unlocks the kingdom. And then you keep it safe. Unlike before there isn't 20 keys that unlock parts of the kingdom that might lead to unlocking other kingdoms via roundabout ways. Your attention for security can be focused on a single key. The average users will be mu…

The flaw stems from the fact that an attacker can thru social engineeung acquire that root crendential (password or biometric or token). Once they have it, they can clean out all your banking, stock and home equity line accounts in one sweep. You as a user may not know that credential is compromised - maybe it was a key logger, maybe it was social engineering the cell phone provider to port your number and then quali…

Social Engineering is difficult problem with a solution quite simple; make the hardware resistant to replay attacks and don't give the user anything they can leak.

Password managers don't protect against this. People have given attackers their entire password vault, all you need is a convincing story about some security audit and you needing to review all their passwords. Users believe this.

The solution there is to take away the things a user can leak (passwords) and replace them with things that can only be stolen (tokens). We can train users to never give away their yubikey. Of course some will still fall for social engineering but for a yubikey/equivalent it's fully acceptable to say "never ever never give to anyone, no matter what they say".

Re: Yubico and Microsoft Introduce Passwordless Login

#167

Post by girvo »

ahelwer wrote: post #135
emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

What's the deal with lost yubikey user workflow? Rely on individual websites to give you a one-time recovery passcode that you then have to input into every website? I can't believe I'm taking UX cues from cryptocurrencies, but what about providing the user with a seed for the yubikey private key they can back-up offline then reinstall in a new yubikey? P.S. just ordered a yubikey security key, excited to add this ad…

I bought two Yubikeys and have one in a safe (mainly so I don’t lose it). This isn’t perfect though, as not all places support multiple keys :(

Re: Yubico and Microsoft Introduce Passwordless Login

#168

Post by ShroudedNight »

crankylinuxuser wrote: post #128
ShroudedNight wrote: post #108

Earlier quoted context omitted.

> Microsoft doesn't allow swapping in and out of authentication plugins like PAM. FWIW, that's not strictly true. See: https://msdn.microsoft.com/en-us/library/windows/desktop/mt1... I don't have enough experience to comment one way or the other about its difficulty.

Well, this certainly surprises me. I know last I looked, there was some discussion about MFA and requiring Azure. In the environment I work in, I'm not able to use services outside a very limited list, or I have to roll my own using established technologies (FedRAMP). So Azure is right out. So was using Amazon Directory Services. I know my colleagues are much more familiar with Windows, whereas I.. (look at username,…

To be fair, the only reason I knew of this at all is because of a brief patronage of a library in Belgium during a trip I took in the summer of '99. The computer systems of said library used a bizarre system of time-limited authentication tokens stored on floppy disks that were used during the Windows log-on process. I was curious how it might have worked.

Re: Yubico and Microsoft Introduce Passwordless Login

#169

Post by rando444 »

airstrike wrote: post #115
rando444 wrote: post #49

Earlier quoted context omitted.

Friends and family can also steal your credit card, but this is not where the majority of credit card theft comes from. Your example of people leaving the key with the laptop is a good example of one of the potential flaws, but just like if your credit card gets lost or stolen, you report it and it becomes unusable. I agree that there is room for 2FA, but this is also surely preferable to the current system.

> Friends and family can also steal your credit card, but this is not where the majority of credit card theft comes from. This is a false equivalence because knowing someone's credit card data only allows you to do one thing which happens to be pretty detectable: using their credit card for yourself. Knowing someone's password allows you to know one or more of their secrets, including many applications that are virtu…

You're making the false equivalence.

There's no reason that using a password/key can't be just as detectable as using a credit card.

Also trying to trace logins application side is rather foolish IMHO, this should always be done at the authority that is granting the authorization.

Re: Yubico and Microsoft Introduce Passwordless Login

#170

Post by emlun »

francislavoie wrote: post #137
emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

Do you have any plans to release server code (I'm mainly concerned about PHP) for CTAP2/WebAuthn support? I really appreciated having access to a reference implementation to handle the data from the client for U2F. CTAP2 looks significantly more complex, and I'm somewhat worried about complexity of implementing it correctly based on the spec.

We have C, Python and Java libraries released right now, all of which are beta WIP as we don't yet have any users who can inform the API designs from real world use cases.

https://github.com/Yubico/libfido2

https://github.com/Yubico/python-fido2/

https://github.com/Yubico/java-webauthn-server

Post reply on HN