Yubico and Microsoft Introduce Passwordless Login • Hacker News Board

Re: Yubico and Microsoft Introduce Passwordless Login

#191

Post by StavrosK » Wed, May 09, 2018, 1:38 PM UTC

not_that_noob wrote: post #188

StavrosK wrote: post #187

Earlier quoted context omitted.

Yes, certainly. And in order to compromise that root credential, you'd have to physically steal the key, and either decap the chip and read the bits somehow, or find a vulnerability that allowed you to read the private keys through USB. Needless to say, this is much, much harder than stealing someone's password.

Credential reissue (lost token) would be a much easier path for an attacker. The weakest point is always the point of compromise. For the smart attacker therefore, they have been handed the whole set of accounts. So yes the original point stands - attackers will find it more lucrative to do account compromise in the Webauthn world.

How would an attack without having the hardware key work?

Re: Yubico and Microsoft Introduce Passwordless Login

#192

Post by freeone3000 » Wed, May 09, 2018, 2:09 PM UTC

r00fus wrote: post #63

tmd83 wrote: post #50

Earlier quoted context omitted.

Not sure reading the article why would I need the computer. The way I read it, you enter the key to any computer and it logs in to the account of the key owner. Am I wrong?

FTA: "Organizations will soon have the option to enable employees and customers to sign in to an Azure AD joined device with no password, by simply using a Security Key to get single sign-on to all Azure AD based applications and services." Emphasis added. Device needs to be paired with Company's AD first. I also imagine that there are options for making e.g. the device unlock only require yubikey, but login to SSO r…

You can pair new devices with a company's active directory.

Re: Yubico and Microsoft Introduce Passwordless Login

#193

Post by emlun » Wed, May 09, 2018, 2:53 PM UTC

asaph wrote: post #189

emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

> Q: Doesn't passwordless mean single factor? Isn't that insecure? > A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" If "something you know" is physically stored on "something you have", doesn't this make "someth…

The PIN is not stored on the key, it's used to unlock the key. Your analysis is correct, but your premise is false.

Re: Yubico and Microsoft Introduce Passwordless Login

#194

Post by krupan » Wed, May 09, 2018, 2:55 PM UTC

toast0 wrote: post #152

krupan wrote: post #95

Earlier quoted context omitted.

"Security from the people directly around you and security from everyone on the internet." Are the people around you not on the internet? They are just a subset of that larger group, aren't they? Sorry if I'm not understanding your point there. And like I said in my edit, I really hope that Yubikey is not the one and only one way to store private keys. I personally would be perfectly happy, for most websites and apps…

The people around you are (probably) on the internet, but let me try to articulate the threats differently. If I'm worried about 'people on the internet' that's threats like brute forcing my weak password, or determining my password on one site (through phishing, password leaks, whatever) and trying it everywhere else and finding I reused it; potentially using malware to slurp up passwords.txt from the desktop where…

Right. So to summarize, with passwords you worry about people near you and everyone on the internet, and with keys you only worry about people near you.

This is a huge improvement!

Re: Yubico and Microsoft Introduce Passwordless Login

#195

Post by emlun » Wed, May 09, 2018, 2:56 PM UTC

Yizahi wrote: post #179

emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

Do you have any information when any major websites will (may?) support U2F in Firefox? Google, FB etc. Is there some issue with Firefox U2F implementation maybe? Thanks.

From what I understand, Firefox doesn't implement the whole U2F spec, and Google and Facebook use some of the features (appID facets) FF left out. However, Firefox, Chrome and Edge all plan to implement the whole Web Authentication API.

Re: Yubico and Microsoft Introduce Passwordless Login

#196

Post by Install_Gentoo » Wed, May 09, 2018, 2:59 PM UTC

Why is this a "new" thing? I have my sisters laptop to do that with linux mint. ???

Re: Yubico and Microsoft Introduce Passwordless Login

#197

Post by not_that_noob » Wed, May 09, 2018, 3:58 PM UTC

StavrosK wrote: post #191

not_that_noob wrote: post #188

Earlier quoted context omitted.

Credential reissue (lost token) would be a much easier path for an attacker. The weakest point is always the point of compromise. For the smart attacker therefore, they have been handed the whole set of accounts. So yes the original point stands - attackers will find it more lucrative to do account compromise in the Webauthn world.

How would an attack without having the hardware key work?

They might call in and say they lost their token, and a competent attacker will usually have all the necessary info. Happens all the time with credit card fraud. Sure, you can notify the target that a credential was reissued, but that happens with credit cards too, and most of the time people don’t pay attention.

About 15% of the user population really cares about security and will take the right precautions. It’s the other 85% that are soft targets that keep attackers in business.

Re: Yubico and Microsoft Introduce Passwordless Login

#198

Post by StavrosK » Wed, May 09, 2018, 4:01 PM UTC

not_that_noob wrote: post #197

StavrosK wrote: post #191

Earlier quoted context omitted.

How would an attack without having the hardware key work?

They might call in and say they lost their token, and a competent attacker will usually have all the necessary info. Happens all the time with credit card fraud. Sure, you can notify the target that a credential was reissued, but that happens with credit cards too, and most of the time people don’t pay attention. About 15% of the user population really cares about security and will take the right precautions. It’s th…

Okay, but how is that the key's fault? This has literally nothing to do with the authentication method, it doesn't give you access to any other site or anything. It's just a social engineering attack on the service, and it's pretty much the only one left because everything else has been obsoleted by the use of hardware tokens for auth.

Re: Yubico and Microsoft Introduce Passwordless Login

#199

Post by danudey » Wed, May 09, 2018, 4:59 PM UTC

polack wrote: post #185

emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

I wasted so much time and energy on implementing U2F for a web application, writing server side lib and making the javascript framework compatible with the horrible js-hack that's available for U2F support. It was all in vein; the browser support is still horrible, no one want to use it and it's not possible to use on mobile. How can you make a security solution that doesn't work on mobile? Making a new "Web Auth" st…

I ran into this with GitHub. I ordered a YubiKey, got it all set up with GitHub, and… never use it. Because it's not supported on mobile or in Safari.

If anything, the web needs technology that allows browsers to present secure third-party auth to web services (e.g. through TouchID, the way that Apple Pay works on Safari and Mobile Safari).

Re: Yubico and Microsoft Introduce Passwordless Login

#200

Post by krupan » Wed, May 09, 2018, 5:06 PM UTC

ggg9990 wrote: post #129

krupan wrote: post #86

The conversation here is blowing my mind. People are actually worried that their yubikey might get lost or stolen when likely most of your passwords are already all over the internet. I got an email from Twitter just a few days ago stating that they'd leaked my password. Twitter! Not Joe's Auto-Body who's website is being run by a high-schooler, but one of the pioneers of internet companies. They messed up. Your pass…

It’s why I told my parents to pick random passwords and write them all down in a notebook that they keep next to their computer. My way, they’re only stealable by their housekeeper or a burglar. If they needed to remember the passwords, they’d be vulnerable to 100 million script kiddies with rainbow tables.

Right. Public key cryptography essentially automates this process that you just described, and makes the security even stronger (because your random "password", AKA private key, stays with you and you only ever share the public key).