Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting a biometric security key right

yubico.com

Post reply on HN
Print view View original

11–20 of 81 posts

Re: Getting a biometric security key right

#11

Post by OJFord »

paxys wrote: post #6
xaduha wrote: post #4

There are plenty of fingerprint readers on the market, doesn't really excite me because it just makes it 2-in-1. What does excite me? Smart rings like https://store.nfcring.com/products/omni

Funny enough their own demo (from the parent article) is on a MacBook Air with built-in Touch ID.

Yes but any MacBook Air, not just one you've previously provisioned to recognise your fingerprint.

The selling point here isn't 'yet another external fingerprint reader', it's 'portable fingerprint-authenticated OpenPGP smart card'.

Re: Getting a biometric security key right

#12

Post by sturmeh »

dheera wrote: post #5

A true biometric key would allow authentication from any key and not just a registered key, otherwise it just degrades into a possession authentication factor. A true biometric key would allow you to walk around with absolutely nothing, and doing 2FA using only what you know (password) and what you are (your finger). Is that possible with this? Could I e.g. pass 2FA on my accounts on a friend's computer using their k…

The primary purpose of a Yubikey is the physical possession of said device is a mandatory factor of authentication, I don't think adding biometric auth is a good excuse for reducing that factor considerably.

Re: Getting a biometric security key right

#13

Post by ryukafalz »

xaduha wrote: post #4

There are plenty of fingerprint readers on the market, doesn't really excite me because it just makes it 2-in-1. What does excite me? Smart rings like https://store.nfcring.com/products/omni

I have been very tempted to get one of those. Two reasons I haven't yet:

- It's a Type B card, and apparently most devices refuse to operate with Type B cards as FIDO2 authenticators: https://github.com/LedgerHQ/ledger-u2f-javacard/issues/12

- I'd otherwise like to use it as a GPG card, but it's unclear if NFC-only GPG cards work with desktop gnupg. Maybe they do and I'm just missing the documentation for it.

Re: Getting a biometric security key right

#14

Post by Donald »

Ottolay wrote: post #2

The key in the video was flexing from being pressed for the fingerprint. Hopefully that does not cause longevity issues. My USB-A yubikey has proven durable so far, but it only requires a very light touch to activate.

It's more likely to break your usb port if it's like the standard yubikey

Re: Getting a biometric security key right

#15

Post by xaduha »

ryukafalz wrote: post #13
xaduha wrote: post #4

There are plenty of fingerprint readers on the market, doesn't really excite me because it just makes it 2-in-1. What does excite me? Smart rings like https://store.nfcring.com/products/omni

I have been very tempted to get one of those. Two reasons I haven't yet: - It's a Type B card, and apparently most devices refuse to operate with Type B cards as FIDO2 authenticators: https://github.com/LedgerHQ/ledger-u2f-javacard/issues/12 - I'd otherwise like to use it as a GPG card, but it's unclear if NFC-only GPG cards work with desktop gnupg. Maybe they do and I'm just missing the documentation for it.

> it's unclear if NFC-only GPG cards work with desktop gnupg

If you mean this applet

https://developers.yubico.com/ykneo-openpgp/Releases

then it would work just fine, you just need a proper contactless PC/SC reader. I don't have this ring, but I did use a smartcard with the applet to login to a server via the phone with

https://play.google.com/store/apps/details?id=org.sufficient...

Re: Getting a biometric security key right

#16

Post by marcolussetti »

Ottolay wrote: post #2

The key in the video was flexing from being pressed for the fingerprint. Hopefully that does not cause longevity issues. My USB-A yubikey has proven durable so far, but it only requires a very light touch to activate.

I think that's just on first enrollment, you likely can use much lighter touch in normal day to day use.

Re: Getting a biometric security key right

#19

Post by nerdwaller »

sneak wrote: post #18
fastest963 wrote: post #17

What happens if I lose the key, I don't have it on me, or if I'm using a mobile UI? It seems like you need an identifier (email/username/etc) besides the hardware key for this to be practical.

U2F is a second factor, not a primary one.

While this is true, the spirit of the GP is correct. To login you will need both a username/password and the second factor. So losing the key is still relevant. In practice that means people really need to buy (at least) two yubikeys to register with services that allow it. Have one on something that’s always with you (such as keys) and the extra(s) as a backup somewhere secure. Unfortunately this works with most accounts except the big one I want it to... AWS.

Some sites allow you to also register a standard MFA device as a fallback, and further still Google (as an example) allows you to use another device that’s already authenticated to get a one time use code (depending on your account security setup).

Re: Getting a biometric security key right

#20

Post by blibble »

sneak wrote: post #18
fastest963 wrote: post #17

What happens if I lose the key, I don't have it on me, or if I'm using a mobile UI? It seems like you need an identifier (email/username/etc) besides the hardware key for this to be practical.

U2F is a second factor, not a primary one.

FIDO2 (effectively U2Fv2) can be used without a username or password
Post reply on HN