Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pressing YubiKeys

bert.org

Post reply on HN
Print view View original

191–200 of 241 posts

Re: Pressing YubiKeys

#191

Post by Dylan16807 »

f0ff wrote: post #148
xkcd-sucks wrote: post #52

Earlier quoted context omitted.

> the purpose of having a YubiKey Compliance?

I'd hazard saying that the purpose of a YubiKey is to provide two factor authentication. A YubiKey acts as an item, posession of which implies identity. When you allow for the YubiKey to be activated without human interaction, it's moved from domain of posession into the domain of knowledge - identifying party needs to know where to knock, not to possess they key. It's no better than appending the URL at the end of y…

It depends on what protects the key. If the problem is being unable to duplicate it, you could protect remote access with a different YubiKey or some other second factor.

And the setup in the article isn't even remote access. If the only way it can be triggered is a local button press, you're golden.

Re: Pressing YubiKeys

#192

Post by ecesena »

blueblisters wrote: post #190
ecesena wrote: post #187

Earlier quoted context omitted.

Security keys protect against phishing, in addition to account takeover. Say you click on a link that looks like Google but it's not. You enter your credentials -> these are now in possession of the attacker. If you have 2FA enabled AND you use a security key, the key digitally signs the hostname of the site you're browsing. This second factor won't be valid on the real google.com site because it was created on the p…

> If you have 2FA enabled AND you use a security key, the key digitally signs the hostname of the site you're browsing. How does this work? Does the browser talk with the key? I thought the key is primarily an input device.

Correct. All browsers now support FIDO2, former U2F, e.g. via USB (or NFC on mobile phones).

Browser and security keys implement one side of the protocol called CTAP (client to authenticator protocol).

Then, browsers expose WebAuthn to web developers that can interact with security keys (create credentials, make assertions = signatures, ...).

Re: Pressing YubiKeys

#194

Post by dathinab »

For the new yubi keys with fido support I would recommend disabling OTP it massively improved the user experience for me., in difference to TOTP OTP has done fundamental problems. And fit reasons not affecting many people OTP is implemented by pretending to be a keyboard which is just anoying in many cases.

But all other operation modes (FIDO,FIDO-U2F,PIV, OpenPGP) do not have that problem.

So when possible I use password manager + FIDO(-U2F), where no it's password manager + TOTP using the yubikey (I plug the USB-c yubikey into my phone accessing the keys TOTP functionality through the authenticator app).

Re: Pressing YubiKeys

#195

Post by Regenschirm »

gouggoug wrote: post #171

The one thing I don't understand with Yubikeys: doesn't leaving them plugged in at all times in your computer (which the form factor highly encourages you to do) completely defeat the purpose?

I have it always pluged in at home only. Which i determine a secure environment.

I have a second one on my keychain.

I would highly recommend to have two keys: one for backup one for daily use.

Re: Pressing YubiKeys

#196

Post by dathinab »

userbinator wrote: post #173
KerryJones wrote: post #136

> If you work in tech, you probably have a YubiKey That is a gross overstatement. As someone who works for a pre-IPO startup and been in the bay in various startups for a number of years, I'd hazard that only 5-10% of the engineers had YubiKey, let alone "work in tech". Whether or not we _should_ is another question.

I've never had a YubiKey, but lots of other places use smart cards (ISO 7816) for secure authentication. I suspect they are far more common than YubiKeys or newer tech, especially in the financial industries.

YubiKeys can pretend to be PIV of OpenPGP smartcard ;=)

But yes in e.g. banking the security systems had been created long before there where really good USB based security keys so it's probably most times actual smartcards.

But then it also turned out that many smartcatd drivers are just REALY bad and complex potentially making your system more vulnerable so I can totally see companies switching away from them.

Re: Pressing YubiKeys

#197

Post by girvo »

dathinab wrote: post #194

For the new yubi keys with fido support I would recommend disabling OTP it massively improved the user experience for me., in difference to TOTP OTP has done fundamental problems. And fit reasons not affecting many people OTP is implemented by pretending to be a keyboard which is just anoying in many cases. But all other operation modes (FIDO,FIDO-U2F,PIV, OpenPGP) do not have that problem. So when possible I use pas…

I use U2F and TOTP, the latter through NFC via my iPhone or computer. U2F through NFC or USB. It’s great!

Re: Pressing YubiKeys

#198

Post by [deleted] »

np1810 wrote: post #36
sxp wrote: post #24

When I was at Google around 2012, the company had a custom 2FA dongle that detected motion rather than touch. An engineer who had remotely ssh'd into their workstation needed to 2FA and realized that they could send an SMS to their phone, cause the phone to vibrate, and trigger a false 2FA event on the dongle. (Or maybe they got their computer to play a loud noise. I forgot the specific details.) Similar to this fake…

More on defeating 2FA, during my internship at Amazon I created a grease monkey script that would store 'n' yubikey codes and paste them automatically whenever browser asked for a yubikey code and this worked flawlessly because afaik yubikeys code have No Expiry ... they just have to be used in order of their generation... I highlighted this issue of No Expiry of yubikey codes but no one took it seriously...

[deleted]

Re: Pressing YubiKeys

#199

Post by thih9 »

> If you work in tech, you probably have a YubiKey

I have worked in tech for 10+ years and I haven’t heard about this product until today.

I guess it’s more likely to own a macbook/ dell / hp / etc than a yubikey.

Still, if someone said “If you work in tech, you probably have a macbook”, they wouldn’t be taken seriously.

Re: Pressing YubiKeys

#200

Post by tialaramex »

blueblisters wrote: post #190
ecesena wrote: post #187

Earlier quoted context omitted.

Security keys protect against phishing, in addition to account takeover. Say you click on a link that looks like Google but it's not. You enter your credentials -> these are now in possession of the attacker. If you have 2FA enabled AND you use a security key, the key digitally signs the hostname of the site you're browsing. This second factor won't be valid on the real google.com site because it was created on the p…

> If you have 2FA enabled AND you use a security key, the key digitally signs the hostname of the site you're browsing. How does this work? Does the browser talk with the key? I thought the key is primarily an input device.

WebAuthn (and its predecessor U2F, you should not roll out new U2F deployments but old ones are slow to upgrade) sits on top of FIDO, which has a protocol CTAP (Client To Authenticator Protocol) for this purpose.

https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-cl...

At the extreme case, when you're asked to sign in with a Security Key you could have an authenticator with dedicated flash storage, screen and fingerprint reader so it can display like:

"Site news.ycombinator.com is prompting you to authenticate as blueblisters [484D2A8BBF] blueblisters@example.com - You last used this credential 16 hours 41 minutes ago. Touch the fingerprint reader to continue"

But in the real world the cheapest options have zero flash, zero display, just a push button and an LED. The LED flashes to indicate that you're being asked to press the button, your pressing it means you signify that you're present. All the data is still sent to them, but they can't display it, you have to trust your browser to validate what was sent.

This means it's unsafe to "press the button" when plugged into a general purpose computer unless prompted by an application you trust with your credentials, like a web browser you're using to sign in to sites

If the authenticator has no storage it can only really act as a Second Factor this way. But a device with storage can replace all steps of logging in if you want. No need to enter a password, an email address, anything, just one tap to get in. Apple is promoting this for the new iOS. A current Yubikey does have storage, and so it can do this, but the storage is very limited, unlike an iPhone with gigabytes of Flash memory.

Post reply on HN