Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arduino FIDO2 Authenticator

en.ovcharov.me

Post reply on HN
Print view View original

71–80 of 90 posts

Re: Arduino FIDO2 Authenticator

#71

Post by StavrosK »

ecesena wrote: post #70
StavrosK wrote: post #68

Earlier quoted context omitted.

That's good news, thanks! Do you know how many resident keys you're going to end up storing? I'm really suffering with the Yubikey's 25, I'm going to write a post on SSH auth with FIDO2 and would like to be able to recommend SoloKeys.

With the current Solo we have 256kB of flash so we sort of arbitrarily reserved space for 50 RKs, but you can prob tweak the firmware if you need. With the next gen of Solo we have 2MB of flash, so assume virtually unlimited RKs, at least given the number of sites that currently support them. (note: double checking w/ the team for correctness)

That's really exciting, thanks. I'm kind of banking on FIDO2 RK becoming the standard on the web, so I really want a key that can support thousands of sites. I might be customizing the firmware (AFAIK it's in Rust), and I'm really hoping I can get one of the preview devices to help testing.

Re: Arduino FIDO2 Authenticator

#72

Post by mikecoles »

StavrosK wrote: post #4

This is pretty cool, and being able to make a FIDO2 device that I can just keep at home next to the PC is pretty appealing. I already have a Yubikey in my keychain for carrying with me, but the keychain isn't at my desk, so having a second one would be pretty great. It would be amazing if this supported FIDO2 resident mode, it could store thousands of credentials (Yubikeys can only do 25 non-thousand credentials).

Would the Krypton Authenticator be of any help to you?

It works through an app on your phone.

https://krypt.co/

Re: Arduino FIDO2 Authenticator

#73

Post by StavrosK »

mikecoles wrote: post #72
StavrosK wrote: post #4

This is pretty cool, and being able to make a FIDO2 device that I can just keep at home next to the PC is pretty appealing. I already have a Yubikey in my keychain for carrying with me, but the keychain isn't at my desk, so having a second one would be pretty great. It would be amazing if this supported FIDO2 resident mode, it could store thousands of credentials (Yubikeys can only do 25 non-thousand credentials).

Would the Krypton Authenticator be of any help to you? It works through an app on your phone. https://krypt.co/

I had used this for a while, the problem I had was that I change phones much more often than I change hardware keys, so I had to change every key on every site every year or so, which was too tedious.

Re: Arduino FIDO2 Authenticator

#74

Post by ChrisSD »

rlpb wrote: post #66
ChrisSD wrote: post #29

Earlier quoted context omitted.

No FIDO2 so it won't work with everything. No NFC.

According to https://hypersecu.com/tmp/downloads/files/datasheets/HSTE-NB... it does support FIDO2.

That's the PRO version. As flipbrad said, it doesn't appear to be available yet. At least I can't find how to purchase one.

Re: Arduino FIDO2 Authenticator

#75

Post by arcticbull »

alias_neo wrote: post #43
snakeye wrote: post #37

Earlier quoted context omitted.

It is encrypted with MITM protection. That's why I do not believe in severe security issues in BLE. There can be problems with particular implementations, but in general it should not be less secure that typing password on a keyboard.

Your keyboard very likely isn't using BLE (Bluetooth Low-Energy). The issue appears specific to BLE which behaves differently than Bluetooth X (4.0, 4.1, 5.0, etc) "proper" and has a different security profile.

Just so we're on the same page, "Bluetooth X" was discontinued at 3.0 -- it's now named "Classic Bluetooth."

Bluetooth 4.0 (4.1, 4.2, 5.0, 5.1) are almost exclusively the artist formerly known as Bluetooth LE. LE is a totally different standard than classic Bluetooth, and was developed by Nokia ("Wibree") and dropped on the desk of the SIG with a big thud. Nokia told the SIG this was Bluetooth now, and they adopted it as "LE" and it forms the core of all version of Bluetooth 4.0 and later.

4.0 and later specs include "LE", "Classic" and "High-Speed". It's very unlikely developers are building for Classic mode anymore, that protocol is an utter nightmare. I don't know anyone building High-Speed devices.

I'd be surprised if a new keyboard opted for anything other than LE. That's just the kind of embedded system it was designed for.

Re: Arduino FIDO2 Authenticator

#76

Post by alias_neo »

arcticbull wrote: post #75
alias_neo wrote: post #43

Earlier quoted context omitted.

Your keyboard very likely isn't using BLE (Bluetooth Low-Energy). The issue appears specific to BLE which behaves differently than Bluetooth X (4.0, 4.1, 5.0, etc) "proper" and has a different security profile.

Just so we're on the same page, "Bluetooth X" was discontinued at 3.0 -- it's now named "Classic Bluetooth." Bluetooth 4.0 (4.1, 4.2, 5.0, 5.1) are almost exclusively the artist formerly known as Bluetooth LE. LE is a totally different standard than classic Bluetooth, and was developed by Nokia ("Wibree") and dropped on the desk of the SIG with a big thud. Nokia told the SIG this was Bluetooth now, and they adopted i…

Thanks for the clarification. That's interesting, I had wondered why I always "felt" Bluetooth had gotten slower lately, but thought it was just me!

Perhaps you can clarify whether I was barking up the wrong tree in my original comment; My understanding is that keyboards, HID devices in general, are usually using something like "Classic mode" or perhaps even actual classic Bluetooth (particularly cheaper/older hardware)

The security keys like the are using the "modern" type, which is a different "spec". I don't know if it's using something like like (G)ATT, but it's not the same spec/tech?

Re: Arduino FIDO2 Authenticator

#77

Post by arcticbull »

alias_neo wrote: post #76
arcticbull wrote: post #75

Earlier quoted context omitted.

Just so we're on the same page, "Bluetooth X" was discontinued at 3.0 -- it's now named "Classic Bluetooth." Bluetooth 4.0 (4.1, 4.2, 5.0, 5.1) are almost exclusively the artist formerly known as Bluetooth LE. LE is a totally different standard than classic Bluetooth, and was developed by Nokia ("Wibree") and dropped on the desk of the SIG with a big thud. Nokia told the SIG this was Bluetooth now, and they adopted i…

Thanks for the clarification. That's interesting, I had wondered why I always "felt" Bluetooth had gotten slower lately, but thought it was just me! Perhaps you can clarify whether I was barking up the wrong tree in my original comment; My understanding is that keyboards, HID devices in general, are usually using something like "Classic mode" or perhaps even actual classic Bluetooth (particularly cheaper/older hardwa…

I'm not sure where the industry is at these days, to be honest. So as far as I know all LE devices use the GATT profile (though I wonder about headphones). The LE spec includes HOGP (HID over GATT Profile) which defines a set of services and characteristics for LE HID devices. [1]

Older devices almost certainly use a Classic Bluetooth HID profile, but newer devices like the Apple Magic Keyboard are LE HOGP devices. It uses much less energy so IMO a battery-powered HID device would be pretty nutty to implement using Classic Bluetooth in this day and age.

Interestingly there's no concept of "pairing" in LE devices, just "bonding" (where previously derived keys are persisted and re-used as an optimization). All LE peripherals operate in promiscuous mode by default and vendors have to implement their own pairing system -- or piggyback off bonding.

[1] Warning PDF link: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c...

Re: Arduino FIDO2 Authenticator

#78

Post by seppin »

StavrosK wrote: post #4

This is pretty cool, and being able to make a FIDO2 device that I can just keep at home next to the PC is pretty appealing. I already have a Yubikey in my keychain for carrying with me, but the keychain isn't at my desk, so having a second one would be pretty great. It would be amazing if this supported FIDO2 resident mode, it could store thousands of credentials (Yubikeys can only do 25 non-thousand credentials).

What is the case against using a bluetooth-linked 2fa from your phone the way Google Advanced Security does?

Re: Arduino FIDO2 Authenticator

#79

Post by seppin »

brian_herman wrote: post #11

Be careful with the bluetooth implementation. https://www.theverge.com/2019/5/15/18625028/google-titan-sec... https://nakedsecurity.sophos.com/2019/05/17/google-recalls-t... edit: formatting

What about Google's use of "Smart Lock" via bluetooth to secure each sign on attempt with Google Advanced Protection?

Re: Arduino FIDO2 Authenticator

#80

Post by donmcronald »

tialaramex wrote: post #69
gruez wrote: post #44

Earlier quoted context omitted.

What are some use cases where you must use FIDO2? A sibling comment mentioned SSH authentication, but what about websites?

FIDO2 enables resident keys. With resident keys the web site can have a flow where you just go "It's me" (maybe you enter a PIN, or touch a fingerprint sensor, Apple just announced they're doing this with FaceID) and you're signed in. Without a resident key, there's a back and forth where you give a username, then maybe a password, and then your authenticator comes in to provide a second factor. This is because the F…

That sounds worse to me. I don't like the idea of having my identity tied to a device. What if I lose it? My favorite setup right now is to keep my username / password in a password manager that I sync to multiple places to ensure it doesn't get lost. Then I use a YubiKey with FIDO / U2F on sites I consider important. I have a main and a spare YubiKey and both get added to my profile (except AWS who only support one key).
Post reply on HN