Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

fidoalliance.org

Post reply on HN
Print view View original

71–80 of 525 posts

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#71

Post by vngzs »

michaelt wrote: post #65
vngzs wrote: post #38

Earlier quoted context omitted.

You just register 2-3 keys. It's not so bad.

Eh, retrieving a key from off-site storage every time you open a new account is a pretty big inconvenience, even for a security enthusiast.

Right. Some core services get this treatment, like email and important online accounts. For others I rely on reset mechanisms tied to those email accounts if I lose the primary key and haven't had the chance to register the secondary. Every few months I'll sync up anything that has been missed.

It's not perfect, but it's a hell of a lot better than TOTP.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#72

Post by vlan0 »

throwaway52022 wrote: post #35

I've resisted switching to a hardware key because I know that I'm going to break it, and that seems like a huge pain in the ass. I really want to be able to make a couple of backup keys, or maybe put another way, I want to be able to put the private key on the device myself, I don't necessarily care that the key is generated on the device and never leaves the device. I don't care if that slightly reduces my security…

>my threat model is me leaving my key in my pants pocket before putting it in the washing machine.

"YubiKey Survives Ten Weeks in a Washing Machine"

I think you'll be safe! :)

https://www.yubico.com/press-releases/yubikey-survives-ten-w...

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#73

Post by deelowe »

CyberRage wrote: post #53
alberth wrote: post #47

Earlier quoted context omitted.

> Bio-metrics are just convenient because they are unique and hard\impossible to replicate. But if your biometric is able to be faked, you can't change it like you can change a typical text based password. There's no "reset your password" equivalent for biometrics.

Oh gosh... your raw bio-metrics are never stored anywhere... The signal from the sensor is used as a "seed" to generate key using robust cryptography Different sensors will output different "data" based on the sensor type.

Let's ignore the part about biometrics being faked since this seems to be a point of contention.

Isn't it a fair argument that secret keys should be mutable by the user? In the future, some unforeseen event COULD occur which compromises or otherwise renders the particular biometric unusable. Now what?

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#74

Post by throwaway52022 »

I don't trust Google or Apple to be my main authentication provider, or to manage syncing my private key. Their customer service is terrible and they are way too arbitrary on locking folks out.

I would trust my bank (well, my credit union.) I can go see them in person if I need to and they take my lawyer seriously, they also take security seriously, they're properly regulated, and ultimately they're my main concern if someone stole my credentials, so I'd like them to be on the hook for protecting my credentials.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#75

Post by Nathanba »

jeroenhd wrote: post #26
TIPSIO wrote: post #14

I’m sure people way smarter than me have this figured out, from the Google post: > When you sign into a website or app on your phone, you will simply unlock your phone — your account won’t need a password anymore. > Instead, your phone will store a FIDO credential called a passkey which is used to unlock your online account. The passkey makes signing in far more secure, as it’s based on public key cryptography and is…

If that kid can get their parent's finger on the fingerprint scanner, sure. The authentication part of the process is moved to the device's security system, so that's fingerprints, passcodes, and facial recognition.

.. but biometrics can be lost too. I could lose my finger, I could have a facial injury. The algorithm could be changed and suddenly I can't log into anything anymore. Or I simply age and my faceId stops working some day. I don't know but biometrics only sound smart initially but it seems very brittle if you think about it. Plus there are plenty of stories of people who were able to unlock somebody else's phone randomly. Just google "unlocked my friends phone via faceid". This all seems like such theater for nothing. I think a simple "own this usb stick = it's proof that you are you" is a very nice 2 factor without any biometrics. Create a usb stick that needs to be unlocked via a passcode to work and voila.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#76

Post by eMGm4D0zgUAVXc7 »

vlan0 wrote: post #72
throwaway52022 wrote: post #35

I've resisted switching to a hardware key because I know that I'm going to break it, and that seems like a huge pain in the ass. I really want to be able to make a couple of backup keys, or maybe put another way, I want to be able to put the private key on the device myself, I don't necessarily care that the key is generated on the device and never leaves the device. I don't care if that slightly reduces my security…

>my threat model is me leaving my key in my pants pocket before putting it in the washing machine. "YubiKey Survives Ten Weeks in a Washing Machine" I think you'll be safe! :) https://www.yubico.com/press-releases/yubikey-survives-ten-w...

Source: The people who sell YubiKeys.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#77

Post by vngzs »

bedast wrote: post #55

The weakest link in security is always going to be humans. Account compromise is is more often a human problem than a technological one (spamming requests, password reuse, simple passwords, (spear) phishing, direct social engineering, etc). If I'm understanding correctly, they're aiming to reduce multi-factor auth back down to a single factor that's "easier" than passwords. Easier to use. Easier to social engineer a…

There's a frequent misconception that hardware keys are no better than, say, a TOTP seed on a secure element of your phone.

The core practical difference between a hardware key and that TOTP code on a secure element is the hardware key, when registered with a domain, is programmed with the domain name in it. Lookalike domains - or anything besides the exact domain you registered the key with - fail to 2FA because they are unregistered. This essentially prevents (spear)phishing attacks from stealing login credentials.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#79

Post by vlan0 »

eMGm4D0zgUAVXc7 wrote: post #76
vlan0 wrote: post #72

Earlier quoted context omitted.

>my threat model is me leaving my key in my pants pocket before putting it in the washing machine. "YubiKey Survives Ten Weeks in a Washing Machine" I think you'll be safe! :) https://www.yubico.com/press-releases/yubikey-survives-ten-w...

Source: The people who sell YubiKeys.

You know what...I have a couple spares. I'll run the experiment myself :)

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#80

Post by theplumber »

bedast wrote: post #55

The weakest link in security is always going to be humans. Account compromise is is more often a human problem than a technological one (spamming requests, password reuse, simple passwords, (spear) phishing, direct social engineering, etc). If I'm understanding correctly, they're aiming to reduce multi-factor auth back down to a single factor that's "easier" than passwords. Easier to use. Easier to social engineer a…

That's why with webauthn humans are not part of the auth scheme anymore. All the auth is negotiated between machines(web browser -> domain name -> hardware key storage).
Post reply on HN