Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting a biometric security key right

yubico.com

Post reply on HN
Print view View original

21–30 of 81 posts

Re: Getting a biometric security key right

#21

Post by [deleted] »

sturmeh wrote: post #12
dheera wrote: post #5

A true biometric key would allow authentication from any key and not just a registered key, otherwise it just degrades into a possession authentication factor. A true biometric key would allow you to walk around with absolutely nothing, and doing 2FA using only what you know (password) and what you are (your finger). Is that possible with this? Could I e.g. pass 2FA on my accounts on a friend's computer using their k…

The primary purpose of a Yubikey is the physical possession of said device is a mandatory factor of authentication, I don't think adding biometric auth is a good excuse for reducing that factor considerably.

[deleted]

Re: Getting a biometric security key right

#22

Post by ecesena »

fastest963 wrote: post #17

What happens if I lose the key, I don't have it on me, or if I'm using a mobile UI? It seems like you need an identifier (email/username/etc) besides the hardware key for this to be practical.

FIDO2 supports password-less and username-less authentication, both as a single factor, i.e. no passwords.

Password-less is like 2FA but without the first factor. You type in your username, next you use the security key.

Username-less is done via resident keys, that can also store the username at registration. The whole experience is just authenticating with the security key.

If you use FIDO without a password (not as 2FA, but as single factor), you want to enable client-side protection like a PIN or biometric. These keys are introducing the biometric option so you can just tap, without entering a PIN.

Edit: oh, this works already today, you can test it on Microsoft accounts, e.g. outlook.com

Re: Getting a biometric security key right

#23

Post by iam-TJ »

xaduha wrote: post #4

There are plenty of fingerprint readers on the market, doesn't really excite me because it just makes it 2-in-1. What does excite me? Smart rings like https://store.nfcring.com/products/omni

Thanks for the link - this is an ideal solution to the problem of forgetting to carry, or mislaying, tokens.

I was about to press the Buy button for the McLear payment-enabled ring priced at £89.99

https://mclear.com/product/payment-ring/#

but paused for thought after reading the terms and conditions (it's a PrePay Visa account) and finding this gem:

"Your McLEAR Product(s) will be valid for 24 months from date of registration, after which your Product(s) will no longer be able to make contactless payments or have any funds available into your Account."

and less severe but annoying opt-out not opt-in:

"You can tell us if you don’t want to receive any marketing materials from us in accordance with the GDPR 2018, by emailing dpo@mclear.com."

https://mclear.com/about/ring-terms-conditions/

Re: Getting a biometric security key right

#24

Post by xaduha »

iam-TJ wrote: post #23
xaduha wrote: post #4

There are plenty of fingerprint readers on the market, doesn't really excite me because it just makes it 2-in-1. What does excite me? Smart rings like https://store.nfcring.com/products/omni

Thanks for the link - this is an ideal solution to the problem of forgetting to carry, or mislaying, tokens. I was about to press the Buy button for the McLear payment-enabled ring priced at £89.99 https://mclear.com/product/payment-ring/# but paused for thought after reading the terms and conditions (it's a PrePay Visa account) and finding this gem: "Your McLEAR Product(s) will be valid for 24 months from date of re…

Well I wasn't linking the payment ring, but rather a smartcard in a ring formfactor. As for payments, you can go this daring route

https://www.instructables.com/RFID-NFC-Tap-and-Go-Ring-for-C...

Re: Getting a biometric security key right

#25

Post by hpfr »

ecesena wrote: post #22
fastest963 wrote: post #17

What happens if I lose the key, I don't have it on me, or if I'm using a mobile UI? It seems like you need an identifier (email/username/etc) besides the hardware key for this to be practical.

FIDO2 supports password-less and username-less authentication, both as a single factor, i.e. no passwords. Password-less is like 2FA but without the first factor. You type in your username, next you use the security key. Username-less is done via resident keys, that can also store the username at registration. The whole experience is just authenticating with the security key. If you use FIDO without a password (not a…

If you have two, say, Microsoft accounts, can you use the same FIDO2-capable authenticator for both, and can Microsoft correlate the accounts by authenticator? I know keys are unique per-site, but are they per-account?

edit: The spec[1] is vague on this, but it looked like a Relying Party can't correlate accounts directly via some kind of identifier for the authenticator. It looks like individual key pairs are generated on the authenticator for each account and linked to the unique userEntity.ID given by the Relying Party. However, Mozilla warns you [2] when sites ask for additional information about your authenticator. I tested this with Yubico's demo [3]. Unfortunately, it looks like the field attestationObject.attStmt.x5c identifies the authenticator. Firefox prompts you when sites ask for the extended information and removes this field if you check a box. That's nice, I guess, but it still seems not so great. If you were to forget and use a user agent that didn't prompt you to anonymize this, the Relying Party would get the attStmt in the response and theoretically could store and correlate accounts. Interested to hear more about the reasoning behind this.

edit 2: It looks like this field is necessary as a second factor when using passwordless login? On Yubico's playground [4], checking "Enable passwordless login with this key" and then checking Firefox's "Anonymize anyway" box results in no request made to the key. Without enabling passwordless login, the request still works after anonymizing.

To be honest, it seems like sites should allow passwordless login without the x5c field. I don't see how an attacker couldn't come up with the x5c field if they could crack the key pair. Is my reasoning right here?

1: https://www.w3.org/TR/webauthn-1

2: https://support.mozilla.org/en-US/kb/privacy-web-authenticat...

3: https://demo.yubico.com/webauthn-technical

4: https://demo.yubico.com/playground

Re: Getting a biometric security key right

#26

Post by iam-TJ »

xaduha wrote: post #24
iam-TJ wrote: post #23

Earlier quoted context omitted.

Thanks for the link - this is an ideal solution to the problem of forgetting to carry, or mislaying, tokens. I was about to press the Buy button for the McLear payment-enabled ring priced at £89.99 https://mclear.com/product/payment-ring/# but paused for thought after reading the terms and conditions (it's a PrePay Visa account) and finding this gem: "Your McLEAR Product(s) will be valid for 24 months from date of re…

Well I wasn't linking the payment ring, but rather a smartcard in a ring formfactor. As for payments, you can go this daring route https://www.instructables.com/RFID-NFC-Tap-and-Go-Ring-for-C...

I realised that, but I was side-tracked by the novelty of the payment ring.

That 'daring route' looks like an ideal project for our maker-space -thanks!

Re: Getting a biometric security key right

#27

Post by vel0city »

Ottolay wrote: post #2

The key in the video was flexing from being pressed for the fingerprint. Hopefully that does not cause longevity issues. My USB-A yubikey has proven durable so far, but it only requires a very light touch to activate.

At least for the USB-A versions, the flexing is almost by design. Since it doesn't have the full housing around the USB-A connector, it tends to have a bit of motion in the port. Its not even that the device is flexing, its pushing on the pins on the USB port more or less as it moves. I can't speak for the USB-C version, as I don't have one and I don't suppose it has that same thing going on.

Re: Getting a biometric security key right

#28

Post by jabroni_salad »

fastest963 wrote: post #17

What happens if I lose the key, I don't have it on me, or if I'm using a mobile UI? It seems like you need an identifier (email/username/etc) besides the hardware key for this to be practical.

I currently use a yubikey for as much as I can, so here is what I have:

1) My yubikey has NFC and works fine with my phone. Even that webauthn website demo works in a mobile browser via NFC.

2) For TOTP secrets, I enroll them in both my yubikey and in the Aegis android app. I mainly use these with the Yubico Authenticator software for windows or linux, but I can pull out my phone if I need to.

3) For any account that is using U2F, I have a second backup key (the blue security key) that I also enroll for that account.

Re: Getting a biometric security key right

#29

Post by ryukafalz »

xaduha wrote: post #15
ryukafalz wrote: post #13

Earlier quoted context omitted.

I have been very tempted to get one of those. Two reasons I haven't yet: - It's a Type B card, and apparently most devices refuse to operate with Type B cards as FIDO2 authenticators: https://github.com/LedgerHQ/ledger-u2f-javacard/issues/12 - I'd otherwise like to use it as a GPG card, but it's unclear if NFC-only GPG cards work with desktop gnupg. Maybe they do and I'm just missing the documentation for it.

> it's unclear if NFC-only GPG cards work with desktop gnupg If you mean this applet https://developers.yubico.com/ykneo-openpgp/Releases then it would work just fine, you just need a proper contactless PC/SC reader. I don't have this ring, but I did use a smartcard with the applet to login to a server via the phone with https://play.google.com/store/apps/details?id=org.sufficient...

How does gnupg interact with contactless cards? I know for a contact smartcard if I try to perform an operation with the card not present, I get a prompt to insert the card, and then I get a prompt to enter the PIN when inserting the card and continuing. A contactless card in a ring form-factor is unlikely to be on the reader for long, though... is gnupg aware of contactless readers and will it e.g. ask for your PIN without the card being present and then prompt you to tap the card?

I'm aware that's what Android apps like OpenKeychain do, but I haven't been able to find much information on how gnupg/pinentry/etc behave with contactless cards.

Re: Getting a biometric security key right

#30

Post by xaduha »

ryukafalz wrote: post #29
xaduha wrote: post #15

Earlier quoted context omitted.

> it's unclear if NFC-only GPG cards work with desktop gnupg If you mean this applet https://developers.yubico.com/ykneo-openpgp/Releases then it would work just fine, you just need a proper contactless PC/SC reader. I don't have this ring, but I did use a smartcard with the applet to login to a server via the phone with https://play.google.com/store/apps/details?id=org.sufficient...

How does gnupg interact with contactless cards? I know for a contact smartcard if I try to perform an operation with the card not present, I get a prompt to insert the card, and then I get a prompt to enter the PIN when inserting the card and continuing. A contactless card in a ring form-factor is unlikely to be on the reader for long, though... is gnupg aware of contactless readers and will it e.g. ask for your PIN…

If you have experience with contact cards, then it's all the same as far as end applications are concerned, it's abstracted away.

> is gnupg aware of contactless readers and will it e.g. ask for your PIN without the card being present and then prompt you to tap the card?

No, it will behave as if there's no card/ring if you don't have it around the reader. Software polish is a weak point, e.g things like `ssh-add -s /usr/lib/opensc-pkcs11.so` can be used to 'cache' the PIN for a session as far as `ssh -A` connection is concerned, but that's not exactly the height of usability.

Post reply on HN