Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What I Wish I Knew About U2F and Other Hardware MFA Protocols

goteleport.com

Post reply on HN
Print view View original

11–20 of 95 posts

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#11

Post by busterarm »

Tomte wrote: post #10
christiansakai wrote: post #8

For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?

Usually people buy a second Yubikey, enrol both and have the second one somewhere safe. Most services and web sites also give you emergency login codes to print out, though.

This is the thing to do.

But I would suggest SoloKeys instead.

I use these to log into my Linux systems, in combination with a password. pam_u2f was pretty easy to setup.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#13

Post by exporectomy »

Tomte wrote: post #10
christiansakai wrote: post #8

For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?

Usually people buy a second Yubikey, enrol both and have the second one somewhere safe. Most services and web sites also give you emergency login codes to print out, though.

For services where no admin can get your access back, like most websites, a 3rd factor should be a compulsory part of 2FA. There's a balance between keeping hackers out and keeping yourself out. The more factors you require, the more optional factors you should also require users to have, not just optional codes but "you must write these codes down, we'll check later to make sure you did" or something like that.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#14

Post by sly010 »

christiansakai wrote: post #8

For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?

Buy 3 keys. Register all of them to your account. Then register all of them to your spouses account too. Put one on your keychain. Put one on your spouses keychain. Put one in a safe place.

By enrolling my spouse and cross registering all keys, both of us are safe. We might loose our keychain, but we will always find each other, even when we are traveling.

This works for Google and GitHub, but not every service allows for multiple keys. But this should be a no-brainer imho.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#15

Post by BoppreH »

sly010 wrote: post #14
christiansakai wrote: post #8

For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?

Buy 3 keys. Register all of them to your account. Then register all of them to your spouses account too. Put one on your keychain. Put one on your spouses keychain. Put one in a safe place. By enrolling my spouse and cross registering all keys, both of us are safe. We might loose our keychain, but we will always find each other, even when we are traveling. This works for Google and GitHub, but not every service allow…

Doesn't that mean that stealing any of the 3 yubikeys means full permanent compromise of all your and your spouse's account?

I think a good with system should include some sort of revocation, like a master key you can keep in a safe to revoke other devices.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#16

Post by 1MachineElf »

BoppreH wrote: post #15
sly010 wrote: post #14

Earlier quoted context omitted.

Buy 3 keys. Register all of them to your account. Then register all of them to your spouses account too. Put one on your keychain. Put one on your spouses keychain. Put one in a safe place. By enrolling my spouse and cross registering all keys, both of us are safe. We might loose our keychain, but we will always find each other, even when we are traveling. This works for Google and GitHub, but not every service allow…

Doesn't that mean that stealing any of the 3 yubikeys means full permanent compromise of all your and your spouse's account? I think a good with system should include some sort of revocation, like a master key you can keep in a safe to revoke other devices.

No, it does not mean that. At least in my experience, every service where I have multiple YubiKeys registered still requires my username and password. Without those, someone who stole the YubiKey would not be able to login to my accounts.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#17

Post by krrrh »

TacticalCoder wrote: post #4

From TFA: > Since the U2F device creates and stores asymmetric key pairs, and is able to sign arbitrary “challenges”, can I use it as a general-purpose hardware key store? You can however do it "the other way round" and use a private key to derive a U2F path. And that same private key can be used for many other applications (or none). For example you can use the Ledger Nano S (originally a cryptocurrencies hardware w…

Trezors work the same way and I have one that I set up as a backup factor (I still find Authy desktop/mobile the most convenient). It’s very nice to have a paper backup.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#18

Post by cronos »

scott00 wrote: post #12

I thought PKCS#11 was exactly what the author wanted: an API for performing arbitrary sign and encrypt operations using a hardware protected key. What doesn't it do?

PKCS#11 is a C API. It does not describe the wire format for talking to the actual hardware.

To use PKCS#11 for a particular device, you need a module (shared library) to translate between the C API and the actual hardware. This module is usually vendor-specific.

If I develop software with PKCS#11 support, I'm basically asking every user to find a PKCS#11 module from their device vendor and install it in the right place.

With U2F at least the hardware wire format is standardized: https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fid...

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#19

Post by cronos »

BoppreH wrote: post #15
sly010 wrote: post #14

Earlier quoted context omitted.

Buy 3 keys. Register all of them to your account. Then register all of them to your spouses account too. Put one on your keychain. Put one on your spouses keychain. Put one in a safe place. By enrolling my spouse and cross registering all keys, both of us are safe. We might loose our keychain, but we will always find each other, even when we are traveling. This works for Google and GitHub, but not every service allow…

Doesn't that mean that stealing any of the 3 yubikeys means full permanent compromise of all your and your spouse's account? I think a good with system should include some sort of revocation, like a master key you can keep in a safe to revoke other devices.

You can un-register any of the keys when you're logged in. So if you lose one key, log in using the others and remove it. No need for a master key.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#20

Post by BoppreH »

cronos wrote: post #19
BoppreH wrote: post #15

Earlier quoted context omitted.

Doesn't that mean that stealing any of the 3 yubikeys means full permanent compromise of all your and your spouse's account? I think a good with system should include some sort of revocation, like a master key you can keep in a safe to revoke other devices.

You can un-register any of the keys when you're logged in. So if you lose one key, log in using the others and remove it. No need for a master key.

Your idea works well for recovery.

But I'm thinking of a revocation scenario, where a key is stolen. In that case the attacker can just remove your keys first.

Post reply on HN