Isn't WebAuthn backwards-compatible with FIDO 1? I was under the impression that it was (based on some of the things I read in the WebAuthn spec).
Yes, it. In fact most browser currently still implement U2F.
YubiKey 5 Series with New NFC and FIDO2 Passwordless Features
101–110 of 187 posts
Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features
#102Honest question, what happens when you lose one of these ?
Yubikey has a lot of features (applets) built-in so the answer is "it depends on what you use". U2F? You need to have a second one or backup codes. OpenPGP? You probably have your subkeys backed up somewhere so you just order a new Yubikey and put your subkeys there. The same goes to PIV (X.509 certs). If you have some keys generated on the card, you need to provision your new Yubikey from the beginning.
How do you enroll a new U2F key to all the websites at once?
Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features
#103I'm a LastPass user using Yubikey nanos for both my work and home PCs. But I would like to purchase a Windows 2-in-1 that only has a single USB-C port used for charging and thus a nano wouldn't really work out well. Since Yubikeys, including these latest 5 series, do not support bluetooth, most Windows laptops don't support NFC, and LastPass does not support FIDO/U2F (so Google's Titan bluetooth won't work), is my on…
LastPass Enterprise supports Duo, which then allows you to use FIDO/UTF there if you enable in the DUO admin panel.
I tried the Duo integration and I’m not a fan. It didn’t let me set up more than one key and it wasn’t as easy to use as Google’s Smart Key app/Chrome integration. I disliked Duo integration so much it had me searching for alternatives to LastPass though everyone else uses Duo too.
Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features
#104Earlier quoted context omitted.
My understanding is that for udf / fido2 authentication, keys are not stored but rather regenerated with an HMAC https://developers.yubico.com/U2F/Protocol_details/Key_gener... I'm curious what these resident keys are for.
The spec doesn't insist on it, but that's how Yubico devices do it, yes. It's the straightforward thing to do when your scheme eventually relies on ECDH and there's an obvious and performant way to go from a base secret to a specific-use secret (via a KDF, here HMAC) to a public key (via scalarmult). It'd be less straightforward if your key generation is expensive and complicated.
If I'm understand correctly, the resident keys can be used in the case of a non-ECDH scheme and otherwise they wouldn't be used? How flexible is the FIDO2 specification on crypto schemes?
Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features
#105I think the YK5's biggest problem is that the YK Neo and 4, which have been out for years, were already so good. Unless you really care about NFC at the same time as RSA-4096, I'm not sure I see a big impetus to upgrade. Hopefully the USB-C line won't be plagued with supply issues. WebAuthn is mostly boring and I think that's mostly a good thing. I'm glad that there's a way to evolve the spec. Some of the changes are…
> you really care about NFC at the same time as RSA-4096
It is exactly my case. Also my dongle is already old and its body has abrasion marks due to heavy usage. So, it's a great reason for upgrade and I think I'm not alone in it. Looking forward for available shipping in my country.
Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features
#106I have an iPhone and a Macbook. It's frustrating that I have to choose between USB-C support for the Macbook, and NFC support for the phone. It's odd that they don't make a USB-C version with NFC.
It's a few months away, but we'll have usb-c + nfc in Solo (open source security key supporting FIDO2). We'll launch the Kickstarter next week: https://solokeys.com
Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features
#107It is annoying you have to choose between USB-C and NFC. I was really hoping I could have both in a new device. I have a 4C and think it is great - the only downside is the lack of NFC and that only a subset of sites support it, but more are implementing it as time goes on. I'll probably pick up a 5 as one to store on a keyring for mostly NFC use.
Just replied in another thread: it's a few months away, but we'll have usb-c + nfc in Solo (open source security key supporting FIDO2). We'll launch the Kickstarter next week: https://solokeys.com
Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features
#108Honest question, what happens when you lose one of these ?
I keep 3 keys active. One is on my keychain, one lives in a locked file cabinet in my home and I have one at my parents house on the other side of the country.
I primarily use them for u2f and totp, though I want to deep dive into ssh via OpenPgp one of these days. When I want to add a new site, I: 1. Set it up on my keychain key. 2. If at home, set it up on my backup. If not, print out the totp secret on paper and when I get home, add it. 3. Call my parents and ask them to plug the 3rd key into a windows box I can Remote Desktop into and set up either totp or u2f via Remote Desktop. Once done, I ask them to unplug it (it’s attached to the desktop pc case with a lanyard).
I find the “key at parents house” to be really helpful, as if I’m traveling and lose/destroy my keys, I can just call them and ask them to plug it in and then I’m back in business.
Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features
#109Earlier quoted context omitted.
The fact that if someone steaks the key they can impersonate you anywhere. U2F doesn't support pin authentication, as far as I know.
It's not built into the protocol, sure, but the device can do whatever it wants before it decides to sign something. You need to unlock my phone and SEP before Krypton signs anything, for example. But you still raise a good point: I suppose it's a good thing that we can do that with cheaper devices and safe, browser-provided UX for PIN entry. (I would suggest that a single physical device that takes a PIN before it d…
I completely agree with everything you said, but a U2F token that takes a PIN would be hard in the sense that it would be hard to make it cross-platform (unless the PIN pad were on the actual device or something).
Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features
#110Earlier quoted context omitted.
Yubikey has a lot of features (applets) built-in so the answer is "it depends on what you use". U2F? You need to have a second one or backup codes. OpenPGP? You probably have your subkeys backed up somewhere so you just order a new Yubikey and put your subkeys there. The same goes to PIV (X.509 certs). If you have some keys generated on the card, you need to provision your new Yubikey from the beginning.
How do you enroll a new U2F key to all the websites at once?
It's not possible, unfortunately. So you'll have to do it one by one.