Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arduino FIDO2 Authenticator

en.ovcharov.me

Post reply on HN
Print view View original

61–70 of 90 posts

Re: Arduino FIDO2 Authenticator

#61

Post by jrexilius »

nickik wrote: post #17

Fantastic. I have been thinking that the best possible thing would be an external device with a screen and a key pad input. This seems to be exactly that. You need the screen because the protocol includes the concept of an authenticator with a screen, and that allows you to verify the information even more compared to a yubikey or something like that.

That was my assessment as well a few years back, which drove the project I'm working on now. I embedded both the authentication (TOTP at the time) and content encryption functions directly into the keyboard and added an internal screen. I had been working through all the attack surfaces of trying to do it in the same kernel space as a compromised node and just decided that was the wrong way to go. Demo of the prototype I built is here: http://www.anomie.tech/deck/anigma-keyboard.m4v

Re: Arduino FIDO2 Authenticator

#62

Post by snakeye »

ecesena wrote: post #59
StavrosK wrote: post #4

This is pretty cool, and being able to make a FIDO2 device that I can just keep at home next to the PC is pretty appealing. I already have a Yubikey in my keychain for carrying with me, but the keychain isn't at my desk, so having a second one would be pretty great. It would be amazing if this supported FIDO2 resident mode, it could store thousands of credentials (Yubikeys can only do 25 non-thousand credentials).

Chiming in to mention SoloKeys, it's open source, FIDO2 certified and supports 50 resident keys. @snakeye, please feel free to port over the CTAP implementation to your device (same for the other tokens I'm reading in the thread). We have already 3 products selling with our firmware. https://github.com/solokeys/solo

Thank you! I will definitely take a look at your CTAP implementation!

Re: Arduino FIDO2 Authenticator

#63

Post by jrexilius »

snakeye wrote: post #20
nickik wrote: post #17

Fantastic. I have been thinking that the best possible thing would be an external device with a screen and a key pad input. This seems to be exactly that. You need the screen because the protocol includes the concept of an authenticator with a screen, and that allows you to verify the information even more compared to a yubikey or something like that.

Thank you! :)

I love this project. right approach for the problem. Will pitch in on the code.

Re: Arduino FIDO2 Authenticator

#64

Post by StavrosK »

ecesena wrote: post #59
StavrosK wrote: post #4

This is pretty cool, and being able to make a FIDO2 device that I can just keep at home next to the PC is pretty appealing. I already have a Yubikey in my keychain for carrying with me, but the keychain isn't at my desk, so having a second one would be pretty great. It would be amazing if this supported FIDO2 resident mode, it could store thousands of credentials (Yubikeys can only do 25 non-thousand credentials).

Chiming in to mention SoloKeys, it's open source, FIDO2 certified and supports 50 resident keys. @snakeye, please feel free to port over the CTAP implementation to your device (same for the other tokens I'm reading in the thread). We have already 3 products selling with our firmware. https://github.com/solokeys/solo

I mentioned SoloKeys farther down the thread, I'm really excited about the new version. Is that coming out soon? I know it was supposed to come out in June, but haven't heard anything yet. I actually sent you guys an email a few minutes ago.

Re: Arduino FIDO2 Authenticator

#65

Post by ecesena »

StavrosK wrote: post #64
ecesena wrote: post #59

Earlier quoted context omitted.

Chiming in to mention SoloKeys, it's open source, FIDO2 certified and supports 50 resident keys. @snakeye, please feel free to port over the CTAP implementation to your device (same for the other tokens I'm reading in the thread). We have already 3 products selling with our firmware. https://github.com/solokeys/solo

I mentioned SoloKeys farther down the thread, I'm really excited about the new version. Is that coming out soon? I know it was supposed to come out in June, but haven't heard anything yet. I actually sent you guys an email a few minutes ago.

Currently manufacturing the very first batch: we're waiting for the PCBs to be shipped, then we'll proceed with assembly, testing, etc.

Conservatively I'd say we'll start shipping around Sep/Oct. But for sure there'll be some "limited edition" tokens in circulation before.

Re: Arduino FIDO2 Authenticator

#66

Post by rlpb »

ChrisSD wrote: post #29
gruez wrote: post #21

Earlier quoted context omitted.

That's surprisingly cheap, less than $10 for a token. Any downsides?

No FIDO2 so it won't work with everything. No NFC.

According to https://hypersecu.com/tmp/downloads/files/datasheets/HSTE-NB... it does support FIDO2.

Re: Arduino FIDO2 Authenticator

#67

Post by flipbrad »

ChrisSD wrote: post #29
gruez wrote: post #21

Earlier quoted context omitted.

That's surprisingly cheap, less than $10 for a token. Any downsides?

No FIDO2 so it won't work with everything. No NFC.

Looks like they have a FIDO2 "Pro" version coming soon: https://www.amazon.co.uk/HYPERFIDO-MINI-FIDO2-HOTP-Security/...

Re: Arduino FIDO2 Authenticator

#68

Post by StavrosK »

ecesena wrote: post #65
StavrosK wrote: post #64

Earlier quoted context omitted.

I mentioned SoloKeys farther down the thread, I'm really excited about the new version. Is that coming out soon? I know it was supposed to come out in June, but haven't heard anything yet. I actually sent you guys an email a few minutes ago.

Currently manufacturing the very first batch: we're waiting for the PCBs to be shipped, then we'll proceed with assembly, testing, etc. Conservatively I'd say we'll start shipping around Sep/Oct. But for sure there'll be some "limited edition" tokens in circulation before.

That's good news, thanks! Do you know how many resident keys you're going to end up storing? I'm really suffering with the Yubikey's 25, I'm going to write a post on SSH auth with FIDO2 and would like to be able to recommend SoloKeys.

Re: Arduino FIDO2 Authenticator

#69

Post by tialaramex »

gruez wrote: post #44
ChrisSD wrote: post #29

Earlier quoted context omitted.

No FIDO2 so it won't work with everything. No NFC.

What are some use cases where you must use FIDO2? A sibling comment mentioned SSH authentication, but what about websites?

FIDO2 enables resident keys. With resident keys the web site can have a flow where you just go "It's me" (maybe you enter a PIN, or touch a fingerprint sensor, Apple just announced they're doing this with FaceID) and you're signed in. Without a resident key, there's a back and forth where you give a username, then maybe a password, and then your authenticator comes in to provide a second factor.

This is because the FIDO2 device actually has (finite) slots to remember e.g. credentials for funky-jokes.example so when you're at funky-jokes.example a WebAuthn API call can ask for those credentials and sign you in. No username, no password, you've presented all the credentials needed in one step. Whereas when keys are not resident the authenticator is relying on the web site to know (from your username) its ID, without being told the ID it can't do the authentication dance, so you will need to enter a username/ email address.

Resident keys are clearly a great idea in a phone (iPhone, Pixel, whatever) because it's not like gigabytes of flash storage will be exhausted storing credentials for the dozens or even thousands of sites you have credentials for.

It's less obviously a great idea for a Yubikey or cheap USB Security Key that maybe only has space for a dozen credentials. Maybe it makes sense to use it for that one web site you sign into every day, or to replace the main SSH key you use but if a Yubikey has 25 slots it doesn't make much sense for one to be "bush-jokes.example" which you last visited ten years ago...

Re: Arduino FIDO2 Authenticator

#70

Post by ecesena »

StavrosK wrote: post #68
ecesena wrote: post #65

Earlier quoted context omitted.

Currently manufacturing the very first batch: we're waiting for the PCBs to be shipped, then we'll proceed with assembly, testing, etc. Conservatively I'd say we'll start shipping around Sep/Oct. But for sure there'll be some "limited edition" tokens in circulation before.

That's good news, thanks! Do you know how many resident keys you're going to end up storing? I'm really suffering with the Yubikey's 25, I'm going to write a post on SSH auth with FIDO2 and would like to be able to recommend SoloKeys.

With the current Solo we have 256kB of flash so we sort of arbitrarily reserved space for 50 RKs, but you can prob tweak the firmware if you need.

With the next gen of Solo we have 2MB of flash, so assume virtually unlimited RKs, at least given the number of sites that currently support them.

(note: double checking w/ the team for correctness)

Post reply on HN