The article complains about the spec and "design by committee" but I think the WebAuthn standard is great. I read through it and it gave me all the information I needed to create a secure implementation that works with all browsers and devices. From zero, I can now FaceID into my personal Grafana instance, which is great. Zero complaints at all, and there are plenty of libraries floating around for people that don't want to read the spec and just want passwordless cross-device logins for their web app.
What I Wish I Knew About U2F and Other Hardware MFA Protocols
41–50 of 95 posts
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#42For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?
Buy 3 keys. Register all of them to your account. Then register all of them to your spouses account too. Put one on your keychain. Put one on your spouses keychain. Put one in a safe place. By enrolling my spouse and cross registering all keys, both of us are safe. We might loose our keychain, but we will always find each other, even when we are traveling. This works for Google and GitHub, but not every service allow…
[deleted]
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#43Earlier quoted context omitted.
You don't need to make it as elaborate as 'safe deposit box' or 'implanted into spouse' and most accounts that matter have other ways of recovery, e.g. an app-based authenticator, one-time recovery codes (a recovery code is something you might want to stick in a safe deposit box). You can just get, say, three hw keys, put one on a keychain another somewhere on your desk and a third in a drawer somewhere.
'implanted into spouse' What about steganography in tattoos? That would be pretty interesting. Perhaps combining that data with a short code or seed that you memorize.
Periodically generated seeds, encoded on actual seeds that you and your partner eat for breakfast.
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#44Earlier quoted context omitted.
'implanted into spouse' What about steganography in tattoos? That would be pretty interesting. Perhaps combining that data with a short code or seed that you memorize.
Periodically generated seeds, encoded on actual seeds that you and your partner eat for breakfast.
I love it.
The tech exists. My neighbor works for a company that does encoding of data on packaging. Goal is that every cereal box on the grocery aisle can be individually tracked.
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#45Earlier quoted context omitted.
Generally speaking, they're both: 1) higher performance, and 2) held to a much higher standard in terms of certifications they need. For example, a normal YubiKey is unrated, a YubiKey FIPS is level 2 rated, and a Thales HSM is level 3 rated with all sorts of zeroization hardware.
Interesting, maybe also the development costs too. They sell way less volume of HSMs compared to the standard keys but the HSM's require I'm sure some very rigorous development and testing.
I evaluated and purchased a few Thales HSMs. At the time the difference between the FIPS and standard/dev editions was a bunch of cash and the spaces within the device were filled with epoxy and would erase if tampered with.
Software was the same, hardware looked the same. The crypto module is validated only with the $$ hardware.
Sometimes the non FIPS devices will have other algorithms not on the FIPS list.
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#46Does anybody know if there is a U2F software solution that works with mobile phones? Ideally with the following features: * Stores keys securely in the Hardware-backed Keystore * Authentication via fingerprint + periodically via password * Allows to backup the secret key during setup * Supports multiple devices * Open source * Works over Wifi * Works with Linux desktops and Android phones
There's https://krypt.co/
That's almost what I was looking for.
I wonder how long before Akamai kills it.
Main downside is that it doesn't support multiple devices
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#47For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?
I've been troubled by that question too. Especially since I've heard people complain about sites that only allow registering one key. But TacticalCoder just said something really interesting in another part of this conversation: > you can use the Ledger Nano S with your "seed" (say a 256-bit secret, stored as 24 words you hide), to log in sites using U2F. > Additionally as long as you've got your secret, you can rein…
https://www.yubico.com/support/download/yubikey-personalizat...
you can do a lot with a yubikey but idk if you can actually change the U2F secret
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#48Earlier quoted context omitted.
Buy 3 keys. Register all of them to your account. Then register all of them to your spouses account too. Put one on your keychain. Put one on your spouses keychain. Put one in a safe place. By enrolling my spouse and cross registering all keys, both of us are safe. We might loose our keychain, but we will always find each other, even when we are traveling. This works for Google and GitHub, but not every service allow…
Doesn't that mean that stealing any of the 3 yubikeys means full permanent compromise of all your and your spouse's account? I think a good with system should include some sort of revocation, like a master key you can keep in a safe to revoke other devices.
The 2 in U2F stands for second factor, these devices are useless on their own.
Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols
#49Earlier quoted context omitted.
Buy 3 keys. Register all of them to your account. Then register all of them to your spouses account too. Put one on your keychain. Put one on your spouses keychain. Put one in a safe place. By enrolling my spouse and cross registering all keys, both of us are safe. We might loose our keychain, but we will always find each other, even when we are traveling. This works for Google and GitHub, but not every service allow…
That's all well and good, but a few weeks later I have another service I'm going to sign up for... I have to... first go to my safe deposit box to grab my third key? If I don't, then seems like it's a lot of bookkeeping.
Needless to say, I don't use these devices on my home depot account. I use them for Google, Github, Dropbox, I don't actually remember anything else. My DNS registrar doesn't support it :P
I also don't use my personal key for work stuff and recovering my work key is my sysadmins problem :)
That said, when I had admin accounts at work, we used TOTP with a similar scheme: when we registered important (admin) accounts we shared the second factor (the QR code) between 2 people and sometimes I printed the QR code itself. This works for AWS, gsuite, github, etc. I still receive calls from old colleges for TOTP codes occasionally :)