Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico and Microsoft Introduce Passwordless Login

yubico.com

Post reply on HN
Print view View original

181–190 of 218 posts

Re: Yubico and Microsoft Introduce Passwordless Login

#181

Post by StavrosK »

Yizahi wrote: post #179
emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

Do you have any information when any major websites will (may?) support U2F in Firefox? Google, FB etc. Is there some issue with Firefox U2F implementation maybe? Thanks.

Github works fine with U2F in Firefox, I think the problem is just that Google is doing browser detection rather than capability detection. (Of course they do, since they want to underhandedly promote their own browser).

Re: Yubico and Microsoft Introduce Passwordless Login

#182

Post by StavrosK »

emlun wrote: post #170
francislavoie wrote: post #137

Earlier quoted context omitted.

Do you have any plans to release server code (I'm mainly concerned about PHP) for CTAP2/WebAuthn support? I really appreciated having access to a reference implementation to handle the data from the client for U2F. CTAP2 looks significantly more complex, and I'm somewhat worried about complexity of implementing it correctly based on the spec.

We have C, Python and Java libraries released right now, all of which are beta WIP as we don't yet have any users who can inform the API designs from real world use cases. https://github.com/Yubico/libfido2 https://github.com/Yubico/python-fido2/ https://github.com/Yubico/java-webauthn-server

I'm thinking of writing a Django-webauthn library (although I'm not sure if it would just be simpler to fork django-u2f). Would the Python library help at all? It looks like it's for USB communication and not for general helpers around signing/authentication/etc.

Re: Yubico and Microsoft Introduce Passwordless Login

#183

Post by StavrosK »

not_that_noob wrote: post #151
datalog19908 wrote: post #149

Earlier quoted context omitted.

> he new YubiKeys support an on-device PIN that isn't shared with the server Doesn't this PIN become a master password for all the websites at that point?

That’s really the flaw of single sign-on and Webauthn - that one key now unlocks the kingdom.

It's not, you're misunderstanding and spreading misinformation. The "key to the kingdom" is a random asymmetric keypair. The PIN is only there as a second factor to this key to prevent physically stolen keys being used to authenticate. If you enter the PIN wrong five times, the device can just lock itself.

There might be a way to steal the PIN if the user enters it on a compromised machine, but you can't do anything with the PIN. You need the physical device as well.

Re: Yubico and Microsoft Introduce Passwordless Login

#184

Post by blablabla123 »

I wonder if these Hardware key really make things better for the end-user.

When using it even for login, people connect it to their laptops - that's what most people work with after all - and they must make sure they don't forget it there. As well they need to worry nobody steals it, whether it's on your laptop or you become a theft victim on the street. In the latter case the thieves might know what a Yubikey is and ask you for the pin.

Not sure what problem this solves. But I have the impression we're converting a virtual problem into a physical problem. To be honest I prefer to save keys on laptop drives, that's more difficult to steal, especially when using an encrypted disk.

Re: Yubico and Microsoft Introduce Passwordless Login

#185

Post by polack »

emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

I wasted so much time and energy on implementing U2F for a web application, writing server side lib and making the javascript framework compatible with the horrible js-hack that's available for U2F support.

It was all in vein; the browser support is still horrible, no one want to use it and it's not possible to use on mobile. How can you make a security solution that doesn't work on mobile?

Making a new "Web Auth" standard is a huge mistake, and I will not fall into that trap again.

Re: Yubico and Microsoft Introduce Passwordless Login

#186

Post by not_that_noob »

StavrosK wrote: post #183
not_that_noob wrote: post #151

Earlier quoted context omitted.

That’s really the flaw of single sign-on and Webauthn - that one key now unlocks the kingdom.

It's not, you're misunderstanding and spreading misinformation. The "key to the kingdom" is a random asymmetric keypair. The PIN is only there as a second factor to this key to prevent physically stolen keys being used to authenticate. If you enter the PIN wrong five times, the device can just lock itself. There might be a way to steal the PIN if the user enters it on a compromised machine, but you can't do anything…

I think you misunderstand how the CTAP portion of Webauthn works - once the root credential authenticates the user, they no longer have to use passwords for the user’s various accounts. The simple point is that if this credential became compromised for whatever reason, then all associated accounts are by definition compromised.

Re: Yubico and Microsoft Introduce Passwordless Login

#187

Post by StavrosK »

not_that_noob wrote: post #186
StavrosK wrote: post #183

Earlier quoted context omitted.

It's not, you're misunderstanding and spreading misinformation. The "key to the kingdom" is a random asymmetric keypair. The PIN is only there as a second factor to this key to prevent physically stolen keys being used to authenticate. If you enter the PIN wrong five times, the device can just lock itself. There might be a way to steal the PIN if the user enters it on a compromised machine, but you can't do anything…

I think you misunderstand how the CTAP portion of Webauthn works - once the root credential authenticates the user, they no longer have to use passwords for the user’s various accounts. The simple point is that if this credential became compromised for whatever reason, then all associated accounts are by definition compromised.

Yes, certainly. And in order to compromise that root credential, you'd have to physically steal the key, and either decap the chip and read the bits somehow, or find a vulnerability that allowed you to read the private keys through USB.

Needless to say, this is much, much harder than stealing someone's password.

Re: Yubico and Microsoft Introduce Passwordless Login

#188

Post by not_that_noob »

StavrosK wrote: post #187
not_that_noob wrote: post #186

Earlier quoted context omitted.

I think you misunderstand how the CTAP portion of Webauthn works - once the root credential authenticates the user, they no longer have to use passwords for the user’s various accounts. The simple point is that if this credential became compromised for whatever reason, then all associated accounts are by definition compromised.

Yes, certainly. And in order to compromise that root credential, you'd have to physically steal the key, and either decap the chip and read the bits somehow, or find a vulnerability that allowed you to read the private keys through USB. Needless to say, this is much, much harder than stealing someone's password.

Credential reissue (lost token) would be a much easier path for an attacker. The weakest point is always the point of compromise. For the smart attacker therefore, they have been handed the whole set of accounts. So yes the original point stands - attackers will find it more lucrative to do account compromise in the Webauthn world.

Re: Yubico and Microsoft Introduce Passwordless Login

#189

Post by asaph »

emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

> Q: Doesn't passwordless mean single factor? Isn't that insecure?

> A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know"

If "something you know" is physically stored on "something you have", doesn't this make "something you know" completely moot?. Please explain how this doesn't simply reduce to "something you have". In other words, if someone steals your Yubikey, can they login as you without knowing anything additional?

Re: Yubico and Microsoft Introduce Passwordless Login

#190

Post by not_that_noob »

Freak_NL wrote: post #164
not_that_noob wrote: post #162

Earlier quoted context omitted.

The flaw stems from the fact that an attacker can thru social engineeung acquire that root crendential (password or biometric or token). Once they have it, they can clean out all your banking, stock and home equity line accounts in one sweep. You as a user may not know that credential is compromised - maybe it was a key logger, maybe it was social engineering the cell phone provider to port your number and then quali…

Whether you use a hardware key, or a password manager, in both cases the attacker needs both authentication factors: your password, and the hardware key or password manager. With a hardware key you gain the advantage of the attackers having to physically gain access to that key.

This is the misunderstanding attackers can exploit. Credentials need to be reissued because people lose them ocassionally. So that process now becomes a pathway for exploits.
Post reply on HN