Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What I Wish I Knew About U2F and Other Hardware MFA Protocols

goteleport.com

Post reply on HN
Print view View original

71–80 of 95 posts

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#71

Post by mnahkies »

dan-robertson wrote: post #35
christiansakai wrote: post #8

For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?

A simple method is as follows: 0. This mostly matters for the accounts that need to be particularly secure (eg email, maybe GitHub or Facebook or Twitter depending on how much you care about them). Also accounts for money if they offer this kind of security. 1. Set up a yubikey. Try to only ever use the yubikey for logging in. 2. Set up some account recovery codes, print them out, put them in a safe place (ie somewhe…

> Also accounts for money if they offer this kind of security

This is something that astonishes me. So many financial institutions still have:

- (low) max length limits on passwords

- restrictions like no special chars in passwords, or exactly this many numbers etc

- over reliance on a pin where a password would be more suitable

- no 2fa, or at best SMS based 2fa

- ridiculous security questions as if someone's favourite colour etc is drawn from a large pool of values

As a developer I can guess that most of these restrictions are probably stemmed from a mountain of tech debt, but I would've expected this to be a priority for such companies. It makes me wonder if they are bound to follow some outdated regulations or something preventing them from doing better

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#72

Post by Freak_NL »

christiansakai wrote: post #8

For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?

This is not a bad question, but it is one that keeps getting asked on this topic. I really think standards like WebAuthn should more explicitly provide an appendix about account recovery, even if that is out of scope of the technical standard.

As others have pointed out, account recovery should always be provided in some form. A common way seems to be the use of a one-time password that can be used to regain access.

What I'd really like is a clear best practice for this for developers to implement though. It doesn't help if your authentication method is strong when the recovery option has glaring security holes in it. It now looks like every site that uses WebAuthn just rolls its own recovery solution.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#73

Post by [deleted] »

mnahkies wrote: post #71
dan-robertson wrote: post #35

Earlier quoted context omitted.

A simple method is as follows: 0. This mostly matters for the accounts that need to be particularly secure (eg email, maybe GitHub or Facebook or Twitter depending on how much you care about them). Also accounts for money if they offer this kind of security. 1. Set up a yubikey. Try to only ever use the yubikey for logging in. 2. Set up some account recovery codes, print them out, put them in a safe place (ie somewhe…

> Also accounts for money if they offer this kind of security This is something that astonishes me. So many financial institutions still have: - (low) max length limits on passwords - restrictions like no special chars in passwords, or exactly this many numbers etc - over reliance on a pin where a password would be more suitable - no 2fa, or at best SMS based 2fa - ridiculous security questions as if someone's favour…

[deleted]

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#74

Post by ranma42 »

TacticalCoder wrote: post #4

From TFA: > Since the U2F device creates and stores asymmetric key pairs, and is able to sign arbitrary “challenges”, can I use it as a general-purpose hardware key store? You can however do it "the other way round" and use a private key to derive a U2F path. And that same private key can be used for many other applications (or none). For example you can use the Ledger Nano S (originally a cryptocurrencies hardware w…

> you can reinitialize your Nano S as a new U2F device

According to the yubico explanation linked from article, U2F includes cloning protection (an authentication counter, which the site should check has increased vs. its last known value), so that might not actually work if the site you are authenticating against is well-implemented (Unless the Nano S also lets you back up the counter value).

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#75

Post by mPReDiToR »

christiansakai wrote: post #8

For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?

I tried YubiKey and SoloKey (OSS).

I've settled on OnlyKey (https://crp.to) because it's OSS and you can back it up and restore. Backup can be GPG encrypted.

24 slots, programmable to store URL, U/N, P/W, 2FA, with the ability to click the address bar in a browser, hit a key on the OnlyKey and watch as it types it all in without any other interaction.

It stores MANY types of auth.

Not affiliated, but a very happy user.

It's a device you'll learn more about as you use it, but YubiKey functionality is achieved in a couple of minutes.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#76

Post by [deleted] »

taeric wrote: post #69

My biggest gripe with a security key right now is that there is no clear way to build the habit of using it. Basically every site will offer to "never ask from this device again" and then I have a key that I haven't used in a long time. Which, yes, I can use nothing but incognito windows, but that is too extreme and a single time I forget breaks it. Why can't I set it so that I need to use the key once a week?

[deleted]

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#77

Post by OJFord »

Arnavion wrote: post #68
thomashabets2 wrote: post #25

> TPMs are soldered onto motherboards so they are not portable. Like U2F, they also don’t let you sign arbitrary data. Incorrect! You can use TPM chips to RSA sign arbitrary data, and use that to authenticate SSH: https://blog.habets.se/2013/11/How-TPM-protected-SSH-keys-wo... Even under Windows: https://blog.habets.se/2016/10/Windows-SSH-client-with-TPM.h... The secret is using TSS_HASH_OTHER as the hash algorithm,…

I also don't know why the author thinks HSMs cost "hundreds to tens of thousands of dollars". In the first place, TPMs are a subcategory of HSMs and don't cost that much. In the second place, HSMs like the Microchip ATECC608B cost <$1 for the bare board.

OP says devices, so I read rack-mount gear that you buy when you can't use (or trust) AWS KMS, not chips.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#78

Post by OJFord »

bsder wrote: post #59
TacticalCoder wrote: post #4

From TFA: > Since the U2F device creates and stores asymmetric key pairs, and is able to sign arbitrary “challenges”, can I use it as a general-purpose hardware key store? You can however do it "the other way round" and use a private key to derive a U2F path. And that same private key can be used for many other applications (or none). For example you can use the Ledger Nano S (originally a cryptocurrencies hardware w…

> Additionally as long as you've got your secret, you can reinitialize your Nano S (or another one) as a new U2F device and there's no need to reset your U2F credentials on the site as the newly initialized device shall work exactly as if it was the old one. But isn't it the whole point that these devices never let you have the secret?

The device GP is talking about is a cryptocurrency 'hardware wallet', so no.

You may have thought (as I did at first) they meant a Yubikey; there is after all also a model called 'Nano', but not, I think, 'Nano S'.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#79

Post by noinsight »

OJFord wrote: post #77
Arnavion wrote: post #68

Earlier quoted context omitted.

I also don't know why the author thinks HSMs cost "hundreds to tens of thousands of dollars". In the first place, TPMs are a subcategory of HSMs and don't cost that much. In the second place, HSMs like the Microchip ATECC608B cost <$1 for the bare board.

OP says devices , so I read rack-mount gear that you buy when you can't use (or trust) AWS KMS, not chips.

Even then, you can buy a Yubico YubiHSM device for 650€.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#80

Post by asalahli »

noinsight wrote: post #79
OJFord wrote: post #77

Earlier quoted context omitted.

OP says devices , so I read rack-mount gear that you buy when you can't use (or trust) AWS KMS, not chips.

Even then, you can buy a Yubico YubiHSM device for 650€.

Well, that is hundreds of dollars, isn't it? :)
Post reply on HN