Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

yubico.com

Post reply on HN
Print view View original

161–170 of 187 posts

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#161

Post by tialaramex »

mercutio2 wrote: post #117
tialaramex wrote: post #92

Earlier quoted context omitted.

You don't need $50 products. You especially don't need two of them. Yubico already make a Security Key that isn't also a PGP key store, a TOTP authenticator, bagel toaster and whatever else for about $20. And there are cheaper vendors if price is the main concern.

Why do you say you don’t need two? The argument seems pretty straightforward: if you don’t trust SMS, you need to disable all backup authentication. If you’ve disabled backup, you surely don’t your physical device to be a single point of failure?

My point was that your backup "emergency" token doesn't need all the fancy features of the 5 series.

It's the backup option, it's the reserve, it didn't have to be the best possible thing, just enough to get you back into the game after you lose the main token somehow.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#162

Post by watersb »

mtgx wrote: post #122
georgyo wrote: post #5

Earlier quoted context omitted.

Also the highest ECC is still p384 and does not support p521. However it is still really nice that it support rsa 4096 over NFC now.

I'd rather they support X25519 and X448 anyway.

Maybe their FIPS-140 certification prioritized the NIST curves? (speculation)

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#163

Post by rikkus »

pps43 wrote: post #51
bluGill wrote: post #46

Earlier quoted context omitted.

it is a different level of security. The comic is fully correct, but you should still use a secret. That is why there are 3 different types of authentication. The first is something you have - a card or key. The second is something you know - a password. The third is something you are - a fingerprint. Each provides protection against a different attack and is vulnerable to different attacks. The more important the se…

Calling a fingerprint "something you are" is a stretch. You are leaving fingerprints everywhere, they can be lifted from any smooth surface you touched (or even high-resolution photo) and then used to open biometric locks.

The fingerprint belongs to you. Calling it 'something you are' is conveying this, without claim to it being somehow difficult to clone or entirely unique. Mother's maiden name is similar in this regard.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#164

Post by ecesena »

Boulth wrote: post #134
ecesena wrote: post #106

Earlier quoted context omitted.

It's a few months away, but we'll have usb-c + nfc in Solo (open source security key supporting FIDO2). We'll launch the Kickstarter next week: https://solokeys.com

Very nice. Does it support FIDO2 only or are there other applets (e.g. OpenPGP)?

We're starting FIDO2/U2F only, but we'll have the possibility to upgrade the firmware. PGP/SSH are the top feature requests, so we'll add them right after the Kickstarter -- unless the community builds them first.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#165

Post by ecesena »

edgan wrote: post #140
ecesena wrote: post #107

Earlier quoted context omitted.

Just replied in another thread: it's a few months away, but we'll have usb-c + nfc in Solo (open source security key supporting FIDO2). We'll launch the Kickstarter next week: https://solokeys.com

Will it have all the features of a Yubikey? I have two YubiKeys right now. One with NFC and one USB-C. I would love to just have one, and open source is a plus. I also use the NFC one for 2FA code storage. I then can use my laptop or phone to retrieve a code.

Not at the beginning. We're starting FIDO2/U2F only, but we'll have the possibility to upgrade the firmware. PGP/SSH are the top feature requests, TOTP we'll have to look into it, if the way yubikeys are doing it is open, we're happy to be compatible.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#166

Post by ecesena »

LyndsySimon wrote: post #158
ecesena wrote: post #107

Earlier quoted context omitted.

Just replied in another thread: it's a few months away, but we'll have usb-c + nfc in Solo (open source security key supporting FIDO2). We'll launch the Kickstarter next week: https://solokeys.com

Interesting. This solves about half of my problems. I use four devices regularly: a Windows desktop with USB, an MBP with USB-C, a 6th Gen iPad (Lightning), and an iPhone X (Lightning + NFC). What I'd really like to see is a small device that lets me use USB, USB-C, Lightning, or NFC with the same token without a handful of dongles to deal with. I get how difficult that is, but I've yet to see anything that supports…

As of today most people seem to want a hole to attach it to a keyring. So it's kind of hard to have even usb-a on one side and usb-c on the other side. Let alone lightning.

If you want to give it a try, we'll open source the hardware soon under CC BY-SA. It'd be great to see what you come up with.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#167

Post by mahesh_rm »

ecesena wrote: post #164
Boulth wrote: post #134

Earlier quoted context omitted.

Very nice. Does it support FIDO2 only or are there other applets (e.g. OpenPGP)?

We're starting FIDO2/U2F only, but we'll have the possibility to upgrade the firmware. PGP/SSH are the top feature requests, so we'll add them right after the Kickstarter -- unless the community builds them first.

Ciao Emanuele, just dropped a linkedin connection request. I am working on a product that would benefit from solo, would love to pick your mind sometime in near future.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#168

Post by sbr464 »

lrvick wrote: post #116
sbr464 wrote: post #99

Earlier quoted context omitted.

LastPass Enterprise supports Duo, which then allows you to use FIDO/UTF there if you enable in the DUO admin panel.

SMS as a 2FA method can't be disabled for Duo administrators. Sim takeover or GSM sniffing attacks can take over the whole account. Mentioned this to their support many times. They don't care.

Interesting, didn’t know that

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#169

Post by cflee »

GoMonad wrote: post #50
cflee wrote: post #16

Technical Manual at https://support.yubico.com/support/solutions/articles/150000... : > Like FIDO U2F, the FIDO2 standard offers the same high level of security, as it is based on public key cryptography. In addition to providing unphishable two-factor authentication, the FIDO2 application on the YubiKey allows for the storage of resident credentials. As the resident credentials can store the username and other data,…

My understanding is that for udf / fido2 authentication, keys are not stored but rather regenerated with an HMAC https://developers.yubico.com/U2F/Protocol_details/Key_gener... I'm curious what these resident keys are for.

They continue doing the key wrapping with HMAC for U2F. Resident keys are for the "passwordless" authentication method under FIDO2.

U2F requires that the server must know exactly which keyHandles to request, based on the username (and probably password) that is supplied earlier by the user, so that the token can take the keyHandle and derive the key.

In FIDO2 "passwordless" mode, there's no username or other identifier presented, so it's just a generic request for credential from the server -- the authenticator has to independently figure out which key to present based only on the origin/domain, and maybe even present a list of stored keys (probably effectively a list of accounts?) to the user for selection. So it'd need some local/resident storage of various bits like the origin, maybe a user-chosen account name, and the actual credential, since it can no longer rely on the server to do store all these bits.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#170

Post by GoMonad »

lvh wrote: post #159
GoMonad wrote: post #104

Earlier quoted context omitted.

If I'm understand correctly, the resident keys can be used in the case of a non-ECDH scheme and otherwise they wouldn't be used? How flexible is the FIDO2 specification on crypto schemes?

I don't understand what you're saying. Which resident keys? WebAuthn adds a number of crypto schemes -- to wit, I think they add RSA. You can certainly deterministically generate RSA keys but it's a lot more of a pain in the neck than x = HMAC(k, "u2f" + custom); P = xG :)

In the parent comment link to the technical manual it mentions 25 resident keys can be stored.

It is now starting to make sense to me why. As jiveturkey pointed out, it allows usernames to be stored. And, as you're pointing out, it's useful for RSA or maybe other crypto. Thanks.

Post reply on HN