111–120 of 122 posts
My spider-senses are tingling: Is this tracking I can't get rid of?
I guess your public key could get associated with your identity. But the pub key is only sent when you register, I believe. So I can't see how this would be used for tracking.
Earlier quoted context omitted.
Unfortunately for the user experience, those tokens typically can’t be cloned even upon initial setup. The practical result of this is that if you intend to keep a second token as a backup, you need to remember to register the backup token individually for each service you use your primary one for. This is unlikely if you keep the backup at home, and it’s downright impractical if you kept it in e.g. a safe deposit bo…
There are other recovery modes that don't require a second token. One common example is a sheet of recovery codes you receive at the enrolling stage that you are prompted to print and store somewhere safely.
It's a bit archaic in a way, but works wonderfully as an accessable and relatively secure backup strategy.
I didn't read the whole thing, but the first few paragraphs make it sound almost exactly like SQRL (ie. no secrets to keep).
If you're interested in something similar that actually works and is very simple, take a look at https://github.com/btcontract/lnurl-rfc/blob/master/spec.md#...
Earlier quoted context omitted.
What's stopping them from doing that now?
My password, pin, whatever, is in my head
This guide focuses on what WebAuthn looks like for the server. What does it look like for the user? As far as I can imagine, it boils down to relying on the possession of a certain piece of hardware instead of knowing a certain password. That is, I have to carry around some kind of USB device and plug it into every computer I want to use. The device holds all my secret keys and does all the magic behind the scenes. B…
The most common use case today is 2FA, where WebAuthn is the standard way to do something U2F defined only for 2FA. In this scenario where it's only a second factor, yes, it relies on you possessing a Security Key, and on the bad guys not possessing it. This matches the threat model, which is typically that bad guys are not your flatmate or your mother they live in another country and will never meet you. WebAuthn (a…
A Google search only turns up HN posts written by you.
Earlier quoted context omitted.
They are stored on hardware tokens. There does not seem to be a way to have privately generated software keys, nothing like putty's pageant or .ssh/authorized_keys. WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem.
There are already open source hardware and software available by the people at SoloKey. Both Nitrokey and SoloKey sell the tokens.
OnlyKey is also open source here are some of the features: - On device PIN - FIDO2 (15 Resident keys) - TOTP (24 accounts) - Static passwords (24 passwords up to 56 char long) - OpenPGP
Earlier quoted context omitted.
The most common use case today is 2FA, where WebAuthn is the standard way to do something U2F defined only for 2FA. In this scenario where it's only a second factor, yes, it relies on you possessing a Security Key, and on the bad guys not possessing it. This matches the threat model, which is typically that bad guys are not your flatmate or your mother they live in another country and will never meet you. WebAuthn (a…
Unfortunately for the user experience, those tokens typically can’t be cloned even upon initial setup. The practical result of this is that if you intend to keep a second token as a backup, you need to remember to register the backup token individually for each service you use your primary one for. This is unlikely if you keep the backup at home, and it’s downright impractical if you kept it in e.g. a safe deposit bo…
https://docs.crp.to/usersguide.html#secure-encrypted-backup-...
Allowing backups is as you mentioned a tradeoff of security vs usability. The greatest risk to your accounts is not always account compromise, it can be losing access to your own accounts. With OnlyKey you can choose to enable this feature or not. Backup requires user physical presence and restore requires the backup file and correct key/passphrase.
Earlier quoted context omitted.
Sell? Bingo! That's what I was talking about.
SoloKeys person here ;) You can implement software authenticators (listening on local USB port), I imagine some password manager people will do so eventually, or have a direct way to hook into requests. Krypton did this for U2F. Hardware keys are for if you want hardware security, obviously they can't be free unless you want someone with a different business model to subsidise them.