Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico and Microsoft Introduce Passwordless Login

yubico.com

Post reply on HN
Print view View original

171–180 of 218 posts

Re: Yubico and Microsoft Introduce Passwordless Login

#171

Post by emlun »

not_that_noob wrote: post #150
emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

A PIN is really a numeric password. It has all the same flaws - compromise risk (say via social engineering) and the risk of forgetting and needing it reset. So the ‘passwordless’ option here is either rename the password to PIN or eliminate it to provide single-factor login. The latter is a dream for smart attackers, since there is always some social engineering route they can use to acquire a legit token.

You would have been right if not for the important keyword "on-device". The PIN does not risk being exposed by server breaches, because it's never on the server. Yes, it can be extracted via clever con artistry, but that's true for _any_ "something you know" factor including conventional passwords. The whole point of multiple factors is that they have _different_ sets of weaknesses.

Also: unlike a shared secret like a password you share _everywhere_ (and let's face it, most people do), an on-device PIN can be changed in a single place should it ever be compromised.

Re: Yubico and Microsoft Introduce Passwordless Login

#172

Post by emlun »

ahelwer wrote: post #135
emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

What's the deal with lost yubikey user workflow? Rely on individual websites to give you a one-time recovery passcode that you then have to input into every website? I can't believe I'm taking UX cues from cryptocurrencies, but what about providing the user with a seed for the yubikey private key they can back-up offline then reinstall in a new yubikey? P.S. just ordered a yubikey security key, excited to add this ad…

It's still a largely unsolved problem, unfortunately. Enabling private key backup comes with a suite of nasty problems like what it means for device attestation and how to guarantee that a key hasn't been cloned in transit. Our best recommendation right now is to have a backup key, but it still means you have to register it everywhere in advance and then go to each site to revoke the lost key.

At least Web Authentication platform credentials should let you have multiple authenticators without having to buy an extra YubiKey.

Re: Yubico and Microsoft Introduce Passwordless Login

#173

Post by emlun »

parent5446 wrote: post #142
emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

Is there word on whether Yubikey 4 models will support FIDO 2? Or do we have to wait for a new model?

They will not support FIDO2, but they do support U2F which is compatible with a subset of the FIDO2 features. Specifically, they don't support PIN or username-less login, but they CAN be used as 2nd factors (emphasis on the 2) in addition to conventional username+password login.

Re: Yubico and Microsoft Introduce Passwordless Login

#174

Post by emlun »

datalog19908 wrote: post #149
emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

> he new YubiKeys support an on-device PIN that isn't shared with the server Doesn't this PIN become a master password for all the websites at that point?

In a sense, yes, but the keyword is "on-device". It's not shared with the server, so it can't be remotely intercepted - but it _can_ be changed in a single place (the YubiKey) should it ever be compromised.

Re: Yubico and Microsoft Introduce Passwordless Login

#175

Post by aepiepaey »

It's too bad sshd never got support for U2F. Seems like the discussions just petered out.

Maybe the introduction of FIDO2 will spark some interest in that again? https://bugzilla.mindrot.org/show_bug.cgi?id=2319

Yes, sure, you could use pam-u2f, but that will never be as seamless as having it supported upstream in ssh.

Or you could use the OTP mode instead, but that has other disadvantages (you have to depend on yubico's servers or run your own KSM+validation servers).

Re: Yubico and Microsoft Introduce Passwordless Login

#176

Post by emlun »

teknopaul wrote: post #160
emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

Does it identity you as the same person to two different websites? I.e. Is it for building up advertising profiles like google oor facebook logins?

What Freak_NL said. No, there is no globally correlatable identity, and it won't be possible to either create or authenticate credentials silently. Browsers will show confirmation popups and YubiKeys will start blinking to prompt for touch confirmation.

Re: Yubico and Microsoft Introduce Passwordless Login

#178

Post by emlun »

consp wrote: post #161
emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

> A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is optional, though, so both the single factor and two factor use cases are possible. No, since passwordless login is available, th…

Maybe I misspoke - by "optional" I meant "optionally required". The server can require the use of a PIN - and although the PIN verification is done client-side, the authenticator (YubiKey) sets a bit in the signed response to indicate whether PIN was used. The server can then verify the authenticity of the bit if it trusts the authenticator's attestation certificate.

It's also allowed for authenticators to always require PIN even if the server doesn't, but the current YubiKey obeys the server's preference.

But yes, there will of course be bugs. But that is also true for password logins, so I don't see it as a particularly convincing argument.

Re: Yubico and Microsoft Introduce Passwordless Login

#179

Post by Yizahi »

emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

Do you have any information when any major websites will (may?) support U2F in Firefox? Google, FB etc. Is there some issue with Firefox U2F implementation maybe? Thanks.

Re: Yubico and Microsoft Introduce Passwordless Login

#180

Post by emlun »

tialaramex wrote: post #158
joering2 wrote: post #144

Why can't I secure login with a fingerprint? Microsoft could have team up with Logitech like Sony with Erricson, and come up with a standard and put (mildly cheap) finger print reader on each sold keyboard and popularize open source standard for software implementation.

Your fingerprint is not a key, it's an identity. So your design tells every place you sign in this way "I'm joering2". And if course if any of them want to log in somewhere else, they now know to say the same thing, "I'm joering2". I guess this is slightly easier than typing your email address? But it's not a security feature. The FIDO/U2F design is a cryptographic key enshrined as a physical key, so rather than "I'm…

This.

Though I'd like to add that FIDO2 does support fingerprints and other biometrics as an additional authentication factor - it all goes under the same abstract "user verification" umbrella as PIN does. The important distinction is that the PIN or fingerprint is never shared with the server - it's only used to unlock the private key - so it's much more difficult to steal.

Post reply on HN