What I Wish I Knew About U2F and Other Hardware MFA Protocols
1–10 of 95 posts
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#2I think HSM's are just expensive because of price gouging rather than cost of the device? Like the Yubikey HSM is the same form factor as the Nano FIPS key but over 10x the price.
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#3I think HSM's are just expensive because of price gouging rather than cost of the device? Like the Yubikey HSM is the same form factor as the Nano FIPS key but over 10x the price.
Generally speaking, they're both: 1) higher performance, and 2) held to a much higher standard in terms of certifications they need.
For example, a normal YubiKey is unrated, a YubiKey FIPS is level 2 rated, and a Thales HSM is level 3 rated with all sorts of zeroization hardware.
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#4From TFA:
> Since the U2F device creates and stores asymmetric key pairs, and is able to sign arbitrary “challenges”, can I use it as a general-purpose hardware key store?
You can however do it "the other way round" and use a private key to derive a U2F path. And that same private key can be used for many other applications (or none). For example you can use the Ledger Nano S (originally a cryptocurrencies hardware wallet), which has an HSM, with your "seed" (say a 256-bit secret, stored as 24 words you hide), to log in sites using U2F.
Additionally as long as you've got your secret, you can reinitialize your Nano S (or another one) as a new U2F device and there's no need to reset your U2F credentials on the site as the newly initialized device shall work exactly as if it was the old one.
Fun fact: the CTO of Ledger was part of the group working on the original FIDO specs.
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#5I think HSM's are just expensive because of price gouging rather than cost of the device? Like the Yubikey HSM is the same form factor as the Nano FIPS key but over 10x the price.
Mostly yes. It's a niche product with low demand and relatively high R&D costs, so margins have to offset that.
There's probably also a bit of psychological biases at play, like: "if your HSM is 10x cheaper than everyone else's, it must be crappy and insecure".
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#6I think HSM's are just expensive because of price gouging rather than cost of the device? Like the Yubikey HSM is the same form factor as the Nano FIPS key but over 10x the price.
Generally speaking, they're both: 1) higher performance, and 2) held to a much higher standard in terms of certifications they need. For example, a normal YubiKey is unrated, a YubiKey FIPS is level 2 rated, and a Thales HSM is level 3 rated with all sorts of zeroization hardware.
Interesting, maybe also the development costs too. They sell way less volume of HSMs compared to the standard keys but the HSM's require I'm sure some very rigorous development and testing.
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#7A tomu (https://tomu.im/tomu.html) can be used as a U2F device. Since it’s hackable and the code for U2F is available maybe it can be adapted as the author was asking (do you know of a device...?)
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#8For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device?
How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#9Earlier quoted context omitted.
Generally speaking, they're both: 1) higher performance, and 2) held to a much higher standard in terms of certifications they need. For example, a normal YubiKey is unrated, a YubiKey FIPS is level 2 rated, and a Thales HSM is level 3 rated with all sorts of zeroization hardware.
Interesting, maybe also the development costs too. They sell way less volume of HSMs compared to the standard keys but the HSM's require I'm sure some very rigorous development and testing.
> HSM's require I'm sure some very rigorous development and testing.
I think they mostly require an outside evaluator to do a sort of documentation process that costs somewhere around $500k depending on complexity on a new product, and maybe $50k just for up-versioning.
It's generally hard to get that money back on a product since the market of organizations that need the certification is tiny and then the larger overall market for a security product is also usually small and not so happy to defray those costs.
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#10For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?
Usually people buy a second Yubikey, enrol both and have the second one somewhere safe.
Most services and web sites also give you emergency login codes to print out, though.