Getting a biometric security key right

> can you point out resident keys in the spec

The WebAuthn specification calls this a "Client-side-resident Public Key Credential Source" or "Resident Credential" for short.

> Is this only for usernameless sites?

It facilitates the "usernameless" flow yes, since the Resident Credential includes everything needed for the authenticator to claim you are some particular user and prove it. But it will still work for other flows.

> How do sites request to use RK’s?

Set the residentKey parameter to "required" during enrollment. Enrolling an authenticator that can't do Resident Credentials should fail in this case.

Sites which want a second factor only should pick "discouraged" which allows the authenticator to remember all the credentials if it wants to (e.g. an iPhone has gigabytes of secure Flash storage so why not) but discourages doing so.

> If there’s multiple usernameless accounts per site how does the user select which RK to use?

Potentially the authenticator has its own UI. But the CTAP2 protocol allows the host to build a UI by asking for all the valid credentials for some particular relying party (ie web site). It goes something like this:

* Host PC-> Security Key "Do you know credentials for ycombinator.com ? We're doing the usernameless thing, so I have no hints just asking"

* Security Key "Yes, here is proof I'm user 48B4C9CDA2 aka hpfr, also, I can prove 6 identities on ycombinator.com including that one"

* Host PC "OK, what's the next identity?"

* Security Key "Here is proof I'm user A29EE0F103 aka tialaramex"

(and so on, iterating through the identities quickly)

From the article, there's a backup PIN.

> No, because that is nonsense. Fingerprints are something different to both usernames and passwords.

In The Netherlands you can be forced to give your fingerprint to unlock your smartphone. You cannot be forced to unlock your smartphone via PIN, or share your password.

> For example you can change both passwords and usernames but you can't change a fingerprint.

Yes, you can. Your fingerprint can be unreadable under circumstances. With sandpaper you can remove it. Certain (physical) labour can damage it. Both of these are temporary. You also, supposedly, have 10 fingers, so in that regard you can switch (e.g. use a less common one, or one which isn't temporarily damaged). Other day I accidentally used a razor to damage my index finger, used an adhesive bandage, and had to add a different finger to my smartphone. I wonder if you can use your toe.

> Also fingerprints are more difficult to discover than usernames.

Inaccurate, and untrue. They're all over the place. This is Bob's phone. I wonder where Bob's fingerprint might be. Might it be... on the phone? "Oh, what a surprise, I didn't expect that!", the forensic analyst exclaimed.

I would argue the following: a PIN or fingerprint should not be used to protect serious data. One could, for example, perfectly fine use a PIN on their smartphone, for authorization of unimportant data. OSes are not yet able to make this distinction though. Moreover, any time you use a password in a public place which isn't one time, a camera can copy the data.

Slight tangent: other day I heard about a creep who stood on the bottom of a stairs, to make pictures below skirts of women. These pictures were then distributed between other creeps. I immediately imagined that being my daughter, and that thought scares the shit out of me. Given the advancements of things like cameras we need to think different with regards to security and privacy.

> If technology does not include some additional biometric property (blood vessel arrangement, unique capacitance?!, unique heat signature that will not change over time?! ...)

The fingerprint technology which is used appears to be from http://fingerprints.com/ . It means the tech is based on an "image" from capacitance, not optics. It also has what is called "liveness" detection - it will be able to differentiate between a dead object and a finger which is alive. So it would not even be enough to cut the finger off.

It is interesting to compare the security of a yubikey+pin vs yubikey+fingerprint. Both provide similar and really good security compared to popular authentication mechanisms like static password, sms, and even authenticator apps.

But a sophisticated attack could still use your credentials if the yubikey was stolen, and the attacker had your fingerprint (plausible with the OPM personal info leak) or had captured your pin (maybe from a keylogger installed on a compromised device you had used).

It seems like the most secure method (albeit impractical) would be to have a "what you know" challenge built into the yubikey, like a pin pad or dial. At that point though, one would probably have to worry about other attacks, like physical intrusion and kidnapping as well.