Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What I Wish I Knew About U2F and Other Hardware MFA Protocols

goteleport.com

Post reply on HN
Print view View original

31–40 of 95 posts

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#31

Post by catherinemojica »

cronos wrote: post #18
scott00 wrote: post #12

I thought PKCS#11 was exactly what the author wanted: an API for performing arbitrary sign and encrypt operations using a hardware protected key. What doesn't it do?

PKCS#11 is a C API. It does not describe the wire format for talking to the actual hardware. To use PKCS#11 for a particular device, you need a module (shared library) to translate between the C API and the actual hardware. This module is usually vendor-specific. If I develop software with PKCS#11 support, I'm basically asking every user to find a PKCS#11 module from their device vendor and install it in the right pl…

That level of standardization is a feature, not a bug. PKCS#11 lets you use any compliant hardware device with any compliant software package, as long as they both implement the spec. Compliant software packages include: ssh, Java's keytool, the GnuTLS utilities, the openssl utilities, wpa_supplicant, various web browsers, and VPN clients. Nowadays many popular Linux distributions come with p11kit configured out of the box, which lets openssl/GnuTLS autoselect the correct PKCS#11 shared library based on the matching information in the PKCS#11 URI.

While the low level API is complex and the UI often isn't ideal, PKCS#11 has been a godsend for interoperability because it abstracts out the low level hardware interfaces and other implementation details. It lets your application seamlessly access hardware-backed keys whether the keystore is sitting on USB (Yubikey), ISO7816 (smartcard), I2C (TPM), or something else. On the application side, adding PKCS#11 support only takes about a dozen lines of code, after which the app can use hardware backed keys/certs to perform TLS negotiations.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#32

Post by diggernet »

christiansakai wrote: post #8

For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?

I've been troubled by that question too. Especially since I've heard people complain about sites that only allow registering one key. But TacticalCoder just said something really interesting in another part of this conversation:

> you can use the Ledger Nano S with your "seed" (say a 256-bit secret, stored as 24 words you hide), to log in sites using U2F. > Additionally as long as you've got your secret, you can reinitialize your Nano S (or another one) as a new U2F device and there's no need to reset your U2F credentials on the site as the newly initialized device shall work exactly as if it was the old one.

If I read that right, some keys rather than having a hardcoded unique seed, will let you set your own. Which implies you can have multiple functionally-identical backup keys locked up securely somewhere. If true, that significantly reduces key loss anxiety, and increases my interest in hardware MFA.

Anyone know which keys support this (aside from the mentioned Nano S and Trezor)? What's the magic keyword to look for in specs?

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#33

Post by jrockway »

christiansakai wrote: post #8

For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?

You're out of luck, modulo extra keys and a recovery mechanism.

Most services let you register multiple devices. I typically use a Yubikey nano and a regular Yubikey. Then I have a backup on my keyring, but don't have to get it out every time. With WebAuthn becoming more popular, you can also use things like Windows Hello, Face ID, etc. Generally, I try to register all of those methods, and then if one device fails, I still have plenty of backups. But, some services don't let you register multiple devices (AWS comes to mind). In that case, you'll have to make sure you have a backup recovery method. (And those recovery methods obviously reduce the security of your account, SMS is notoriously weak.)

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#34

Post by francislavoie »

shaicoleman wrote: post #29

Does anybody know if there is a U2F software solution that works with mobile phones? Ideally with the following features: * Stores keys securely in the Hardware-backed Keystore * Authentication via fingerprint + periodically via password * Allows to backup the secret key during setup * Supports multiple devices * Open source * Works over Wifi * Works with Linux desktops and Android phones

There's https://krypt.co/

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#35

Post by dan-robertson »

christiansakai wrote: post #8

For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?

A simple method is as follows:

0. This mostly matters for the accounts that need to be particularly secure (eg email, maybe GitHub or Facebook or Twitter depending on how much you care about them). Also accounts for money if they offer this kind of security.

1. Set up a yubikey. Try to only ever use the yubikey for logging in.

2. Set up some account recovery codes, print them out, put them in a safe place (ie somewhere that you don’t live or work, though you could probably also keep copies there. If you have a folder of personal and account information ready in case you die unexpectedly, put it there too)

3. Set up Google Authenticator on an iPhone so you can get in if you don’t have access to your keys. You should treat these more like the recovery codes than the yubikey—be very careful about entering the name of the website and checking the certificate because they won’t protect you from phishing.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#36

Post by powvans »

pvg wrote: post #30
thatnerdyguy wrote: post #27

Earlier quoted context omitted.

That's all well and good, but a few weeks later I have another service I'm going to sign up for... I have to... first go to my safe deposit box to grab my third key? If I don't, then seems like it's a lot of bookkeeping.

You don't need to make it as elaborate as 'safe deposit box' or 'implanted into spouse' and most accounts that matter have other ways of recovery, e.g. an app-based authenticator, one-time recovery codes (a recovery code is something you might want to stick in a safe deposit box). You can just get, say, three hw keys, put one on a keychain another somewhere on your desk and a third in a drawer somewhere.

'implanted into spouse'

What about steganography in tattoos? That would be pretty interesting. Perhaps combining that data with a short code or seed that you memorize.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#37

Post by kjjjjjjjjjjjjjj »

christiansakai wrote: post #8

For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?

You need at least 2 yubikeys. Register both and keep one in a safe hidden place. You can also print out backup codes and keep them in a safe.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#38

Post by skybrian »

christiansakai wrote: post #8

For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?

Yes, you do need a backup way of getting in. Some websites will let you print out some one-time-use codes that you can store in a strongbox. (This is cheaper than buying two Yubikeys.)

You could also get 2 Yubikeys, but might be out of luck if the website doesn't support that.

(Also, some Android phones can act as a hardware key.)

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#39

Post by InvertedRhodium »

christiansakai wrote: post #8

For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?

I use YubiKeys for just about everything, the easiest solution is to simply have multiple keys. I have 3 total, gathering them all together once a year to renew the gpg key isn't a real issue and after the initial setup I don't find myself enrolling new services regularly.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#40

Post by jrockway »

shaicoleman wrote: post #29

Does anybody know if there is a U2F software solution that works with mobile phones? Ideally with the following features: * Stores keys securely in the Hardware-backed Keystore * Authentication via fingerprint + periodically via password * Allows to backup the secret key during setup * Supports multiple devices * Open source * Works over Wifi * Works with Linux desktops and Android phones

U2F is the predecessor to the current standard, WebAuthn. If a web app supports WebAuthn, then that integrates with native keystores (Windows Hello, Face ID, whatever Android has), as well as hardware keys. The site operator has some flexibility to prefer certain methods (platform vs. external) and devices (attestation).

I wrote an authenticating proxy that uses Webauthn: https://github.com/jrockway/jsso2. I don't think you should use it, but you can fire it up locally and try enrolling the various devices. Actually, you can just use Duo's demo: https://webauthn.io/

Post reply on HN