Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting a biometric security key right

yubico.com

Post reply on HN
Print view View original

51–60 of 81 posts

Re: Getting a biometric security key right

#51

Post by xaduha »

StavrosK wrote: post #50
iam-TJ wrote: post #23

Earlier quoted context omitted.

Thanks for the link - this is an ideal solution to the problem of forgetting to carry, or mislaying, tokens. I was about to press the Buy button for the McLear payment-enabled ring priced at £89.99 https://mclear.com/product/payment-ring/# but paused for thought after reading the terms and conditions (it's a PrePay Visa account) and finding this gem: "Your McLEAR Product(s) will be valid for 24 months from date of re…

Wait, so the ring just stops working two years later for no reason?

Think of it as a temporary Visa card. It's not under their control.

Re: Getting a biometric security key right

#52

Post by Boulth6 »

OJFord wrote: post #11
paxys wrote: post #6

Earlier quoted context omitted.

Funny enough their own demo (from the parent article) is on a MacBook Air with built-in Touch ID.

Yes but any MacBook Air, not just one you've previously provisioned to recognise your fingerprint. The selling point here isn't 'yet another external fingerprint reader', it's 'portable fingerprint-authenticated OpenPGP smart card'.

The press release mentions only FIDO2. Where did you get the OpenPGP smart card bit?

Re: Getting a biometric security key right

#54

Post by svenpeter »

NiceWayToDoIT wrote: post #46
tiziano88 wrote: post #41

Earlier quoted context omitted.

Just getting the fingerprint of someone else does not allow you to log in as them. The fingerprint is only used as a presence check by the security key, which digitally signs a challenge using its own internal non-exportable key material. So you would have to both steal someone else's security key (note you cannot "clone" it, at least not trivially), and also get their fingerprint, if you wanted to "hack" them.

So, device is password generator, and fingerprint is the username. What happens when you lose or brake your security key, is your PC locked forever, or it will stay that way until they send you replacement? But if they can send you replacement, that means that "the company" (read government services) have sort off master key for your PC (they have fingerprint database) and they can get access to inside hardware depen…

> What happens when you lose or brake your security key, is your PC locked forever, or it will stay that way until they send you replacement?

You register two security keys (which both have a separate private key) and keep one of them somewhere safe. Then if your main one breaks you switch to key 2 to login and register key 3 as your new backup key. This is done for e.g. Google's advanced protection program [1]

> I had a chat with a spokesman from a bank they had similar technology for a credit card, basically what he said is that key factor is time

Yeah, that sounds about right for a bank which will have a much different threat model than a login for a website or my computer.

> But if they can send you replacement, that means that "the company" (read government services) have sort off master key for your PC (they have fingerprint database)

They very likely can't. These devices essentially generate a private key that is never able to leave the security key without major hardware attacks. The fingerprint is also just stored on the device to be able to unlock this secret key. It is never transmitted to the computer or anywhere else and it also isn't used to create the private key.

Essentially this key implements WebAuthn [2] (and similar technologies) and only allows access to the secret key after the fingerprint has been verified.

There could of course be backdoors in the key generation algorithm (think dual ec drbg). Once your threat model includes actors capable of backdooring modern encryption hardware and algorithms they probably have much easier ways of getting to your data though.

[1] https://landing.google.com/advancedprotection/

[2] https://webauthn.io

Re: Getting a biometric security key right

#55

Post by encom »

Ottolay wrote: post #2

The key in the video was flexing from being pressed for the fingerprint. Hopefully that does not cause longevity issues. My USB-A yubikey has proven durable so far, but it only requires a very light touch to activate.

I've had one of the very first Yubikeys on my keychain for about 10 years now, which is a very rough place to be, and it still works fine.

Re: Getting a biometric security key right

#57

Post by michaelt »

Boulth6 wrote: post #52
OJFord wrote: post #11

Earlier quoted context omitted.

Yes but any MacBook Air, not just one you've previously provisioned to recognise your fingerprint. The selling point here isn't 'yet another external fingerprint reader', it's 'portable fingerprint-authenticated OpenPGP smart card'.

The press release mentions only FIDO2. Where did you get the OpenPGP smart card bit?

If they're releasing a fingerprint-scanning version, I'd be surprised if it wasn't available with all the capabilities of the YubiKey 5 (which has OpenPGP support) for people willing to pay.

Re: Getting a biometric security key right

#58

Post by rdslw »

tialaramex wrote: post #39
ecesena wrote: post #35

Earlier quoted context omitted.

You have to distinguish between resident keys and non-resident keys (that I'll just call "normal keys"). Resident keys are stored on the device, so today you can only have a limited number of RKs. This said it's a temp limitation. As usage will increase, devices will allow for more RKs. For example, if I'm not wrong, yubikeys support 25 RKs, solokeys 50. (But the only sites where you can use RKs are basically Microso…

> When you enroll a device in, say, your primary Google account, trying to enroll the same device again produces the same cryptographic key. That's not correct. The keys are random so of course there would be statistically no chance to get the same one. However, if you actually try to do this it simply doesn't work, it says you already enrolled this authenticator, which is true. How does it know? During enrollment th…

side topic: could you elaborate how FIDO1 (not FIDO2) yubikeys do 'ykman fido reset' ?

my question is (in domain of U2F/FIDO1 and non resident keys), what exactly is resetted, and if RP (websites) will provide the same initial data on enrollment, will the second enrollment end in the same keys EVEN after reset? If not, what exactly is storred and resetted on yubikey (again, OLD ones with only U2F)

Re: Getting a biometric security key right

#59

Post by OJFord »

Boulth6 wrote: post #52
OJFord wrote: post #11

Earlier quoted context omitted.

Yes but any MacBook Air, not just one you've previously provisioned to recognise your fingerprint. The selling point here isn't 'yet another external fingerprint reader', it's 'portable fingerprint-authenticated OpenPGP smart card'.

The press release mentions only FIDO2. Where did you get the OpenPGP smart card bit?

I just assumed, but I think you're right that it doesn't. (Though I wouldn't be surprised if it followed, Yubikey's first FIDO key was also just that, but now they all do it.)

My main point though was that it's not a device-specific authentication, or even an external reader for unlocking a secret provisioned onto one or many devices, it is the sole thing needed, so you can walk up to a new device and use it without provisioning it with secrets.

An OpenPGP one would be cool though - replace passphrase with fingerprint.

Re: Getting a biometric security key right

#60

Post by StavrosK »

xaduha wrote: post #51
StavrosK wrote: post #50

Earlier quoted context omitted.

Wait, so the ring just stops working two years later for no reason?

Think of it as a temporary Visa card. It's not under their control.

Oh, so the underlying Visa expires and they have no way to renew the same chip? That sucks.
Post reply on HN