Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arduino FIDO2 Authenticator

en.ovcharov.me

Post reply on HN
Print view View original

81–90 of 90 posts

Re: Arduino FIDO2 Authenticator

#81

Post by tialaramex »

donmcronald wrote: post #80
tialaramex wrote: post #69

Earlier quoted context omitted.

FIDO2 enables resident keys. With resident keys the web site can have a flow where you just go "It's me" (maybe you enter a PIN, or touch a fingerprint sensor, Apple just announced they're doing this with FaceID) and you're signed in. Without a resident key, there's a back and forth where you give a username, then maybe a password, and then your authenticator comes in to provide a second factor. This is because the F…

That sounds worse to me. I don't like the idea of having my identity tied to a device. What if I lose it? My favorite setup right now is to keep my username / password in a password manager that I sync to multiple places to ensure it doesn't get lost. Then I use a YubiKey with FIDO / U2F on sites I consider important. I have a main and a spare YubiKey and both get added to my profile (except AWS who only support one…

All the FIDO2 capable devices I'm aware of are intended to be used with some external factor. For a Yubico Security Key 2 that's a PIN (unlike your passwords the PIN isn't sent anywhere, it's verified by the device) and some other devices use a fingerprint. Platform authenticators are going to do all sorts of stuff, like Apple's FaceID.

So if you lose it the credentials are now essentially worthless (anybody who found it or stole it presumably doesn't have your PIN / fingerprints / face) and you should revoke them from sites where they were trusted.

Nothing prevents you from enrolling multiple FIDO2 resident key devices for a site, the site would store all the relevant credentials and you could use any of them to log in. I expect Apple's implementation notes for that demo last week tell implementers to allow multiple enrolment because some of Apple's best customers own an iPhone and an iPad and a MacBook Pro and expect to use all three.

But sure, you can use the second-factor-only FIDO behaviour on a FIDO2 key just fine, it's just that FIDO2 resident keys can offer a nicer user journey while still being secure.

Re: Arduino FIDO2 Authenticator

#82

Post by gnufx »

ecesena wrote: post #59
StavrosK wrote: post #4

This is pretty cool, and being able to make a FIDO2 device that I can just keep at home next to the PC is pretty appealing. I already have a Yubikey in my keychain for carrying with me, but the keychain isn't at my desk, so having a second one would be pretty great. It would be amazing if this supported FIDO2 resident mode, it could store thousands of credentials (Yubikeys can only do 25 non-thousand credentials).

Chiming in to mention SoloKeys, it's open source, FIDO2 certified and supports 50 resident keys. @snakeye, please feel free to port over the CTAP implementation to your device (same for the other tokens I'm reading in the thread). We have already 3 products selling with our firmware. https://github.com/solokeys/solo

Is Somu the same as the current Solo? (Not that I've had much opportunity to exhaust it...) I don't remember seeing that documented, or if the processor/storage is the same.

On the topic of the implementation, is there any estimate for arrival of the PGP support?

Re: Arduino FIDO2 Authenticator

#83

Post by gnufx »

alias_neo wrote: post #45
TrueDuality wrote: post #30

> But, wait, is it difficult to find a charger or power bank with Micro USB nowadays? It's definitely trending that way IME...

I understood the point the article was trying to make here, but, actually, it's become almost a nightmare to find a Micro USB cable in my home, so I had to answer "yes". Every time one breaks or gets tatty I bin it and don't replace, because, really, the only thing I need it for is my PS4 controller and the baby monitor. I've burned through a decade or so worth of them thrown in boxes and drawers. It gets really hard…

I have a neat cable with an attached micro/C adapter, and is A-to-C unless you un-nest the micro end.

Re: Arduino FIDO2 Authenticator

#84

Post by neuralzen »

tialaramex wrote: post #81
donmcronald wrote: post #80

Earlier quoted context omitted.

That sounds worse to me. I don't like the idea of having my identity tied to a device. What if I lose it? My favorite setup right now is to keep my username / password in a password manager that I sync to multiple places to ensure it doesn't get lost. Then I use a YubiKey with FIDO / U2F on sites I consider important. I have a main and a spare YubiKey and both get added to my profile (except AWS who only support one…

All the FIDO2 capable devices I'm aware of are intended to be used with some external factor. For a Yubico Security Key 2 that's a PIN (unlike your passwords the PIN isn't sent anywhere, it's verified by the device) and some other devices use a fingerprint. Platform authenticators are going to do all sorts of stuff, like Apple's FaceID. So if you lose it the credentials are now essentially worthless (anybody who foun…

The thing to be wary of here is knowing which platform should be used, on a given site. These devices are to establish strict lines of trust, but not all those who use them are technically proficient, so a MitM that downgrades the authenticator from "platform" to "cross-platform" (or roaming) can alter the registration process such that what should have had a biometric tie now just has a PIN (or no PIN depending). This attack depends on how the vendor is managing AAGUIDs and Attestment Certificates, but a lot simply don't.

Re: Arduino FIDO2 Authenticator

#86

Post by rlpb »

ChrisSD wrote: post #74
rlpb wrote: post #66

Earlier quoted context omitted.

According to https://hypersecu.com/tmp/downloads/files/datasheets/HSTE-NB... it does support FIDO2.

That's the PRO version. As flipbrad said, it doesn't appear to be available yet. At least I can't find how to purchase one.

There are some available here (in the UK): https://www.amazon.co.uk/gp/product/B0813YWZB2

Re: Arduino FIDO2 Authenticator

#87

Post by tialaramex »

neuralzen wrote: post #84
tialaramex wrote: post #81

Earlier quoted context omitted.

All the FIDO2 capable devices I'm aware of are intended to be used with some external factor. For a Yubico Security Key 2 that's a PIN (unlike your passwords the PIN isn't sent anywhere, it's verified by the device) and some other devices use a fingerprint. Platform authenticators are going to do all sorts of stuff, like Apple's FaceID. So if you lose it the credentials are now essentially worthless (anybody who foun…

The thing to be wary of here is knowing which platform should be used, on a given site. These devices are to establish strict lines of trust, but not all those who use them are technically proficient, so a MitM that downgrades the authenticator from "platform" to "cross-platform" (or roaming) can alter the registration process such that what should have had a biometric tie now just has a PIN (or no PIN depending). Th…

This seems like a pretty complicated attack with relatively low value, but maybe I don't understand something important. So let me run it back by my understanding.

You're proposing a TLS MitM (maybe plausible in a corporate environment that has this configured anyway) which downgrades the authenticator enrolment to have less protections, and then passing the resulting credentials to the real backend which will assume it has two factors without checking?

And later you steal the device so you can now use it without an additional factor because it wasn't enrolled using multi-factor anyway.

This would work as an element of the over-complicated schemes in an Oceans movie, but it doesn't feel very plausible in the real world. The skill sets to "Steal someone's iPhone" and "Obtain fraudulent Web PKI certs" don't overlap very much and this attack doesn't scale so it would need to be targeted.

Re: Arduino FIDO2 Authenticator

#88

Post by ta17711771 »

StavrosK wrote: post #41
alias_neo wrote: post #40

Earlier quoted context omitted.

Can I do this with a Yubikey? Last time I tried there were a few, more complex commands than this. Could I use a udev rule to add my SSH keys as the device is plugged so I don't have to run anything? I think I was using PIV last time.

Yes you can, SSH 8.3ish uses FIDO2 and doesn't do anything Yubikey-specific. That means you don't have to bother with all the agent stuff, and it works with any dirt-cheap FIDO2 key. EDIT: I'm going to post a writeup tomorrow detailing how to do this, because it's wonderful and super secure.

Have Nitro keys on the way. Looking forward to your writeup, mate.

Re: Arduino FIDO2 Authenticator

#89

Post by donmcronald »

tialaramex wrote: post #81
donmcronald wrote: post #80

Earlier quoted context omitted.

That sounds worse to me. I don't like the idea of having my identity tied to a device. What if I lose it? My favorite setup right now is to keep my username / password in a password manager that I sync to multiple places to ensure it doesn't get lost. Then I use a YubiKey with FIDO / U2F on sites I consider important. I have a main and a spare YubiKey and both get added to my profile (except AWS who only support one…

All the FIDO2 capable devices I'm aware of are intended to be used with some external factor. For a Yubico Security Key 2 that's a PIN (unlike your passwords the PIN isn't sent anywhere, it's verified by the device) and some other devices use a fingerprint. Platform authenticators are going to do all sorts of stuff, like Apple's FaceID. So if you lose it the credentials are now essentially worthless (anybody who foun…

I didn't explain it really well. I wasn't too worried about it being stolen. I was worried about having a single device, so losing it means losing all the identity info. I guess it's no different than now where I enroll 2 keys everywhere.

Re: Arduino FIDO2 Authenticator

#90

Post by StavrosK »

ta17711771 wrote: post #88
StavrosK wrote: post #41

Earlier quoted context omitted.

Yes you can, SSH 8.3ish uses FIDO2 and doesn't do anything Yubikey-specific. That means you don't have to bother with all the agent stuff, and it works with any dirt-cheap FIDO2 key. EDIT: I'm going to post a writeup tomorrow detailing how to do this, because it's wonderful and super secure.

Have Nitro keys on the way. Looking forward to your writeup, mate.

It is here! https://news.ycombinator.com/item?id=23689499
Post reply on HN