Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

fidoalliance.org

Post reply on HN
Print view View original

151–160 of 525 posts

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#151

Post by 2OEH8eoCRo0 »

Hamuko wrote: post #137
beefee wrote: post #99

Earlier quoted context omitted.

The services I interact with that support WebAuthn usually only allow you to register one key. Backup and recovery is a confusing puzzle for most of these services.

Tell the services you interact with that they're basically going against the spec. "Relying Parties SHOULD allow and encourage users to register multiple credentials to the same account. Relying Parties SHOULD make use of the excludeCredentials and user.id options to ensure that these different credentials are bound to different authenticators."

Is it a SHOULD vs SHALL issue? Link to full spec?

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#152

Post by avianlyric »

sph wrote: post #27
alberth wrote: post #21

Dumb question: why are biometrics being used to replace the password , shouldn't the biometric replace the username ?

Sounds to be like we're replacing the username and the password, i.e. something you know with username and your phone, i.e. something you have . It sounds like it's still a one factor authentication system, but different.

The expectation is that you also have “something you are” as provided by your devices biometric authentication.

The standard allows for service to demand that the authentication device performs an additional factor authentication. Which is usually either a PIN or biometrics, and your device attests to doing this during authentication.

So then you have two complete factors “something you have” (your phone) and “something you are” (biometrics) or “something you know” (unlock PIN for device).

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#153

Post by rootusrootus »

beefee wrote: post #99
vngzs wrote: post #38

Earlier quoted context omitted.

You just register 2-3 keys. It's not so bad.

The services I interact with that support WebAuthn usually only allow you to register one key. Backup and recovery is a confusing puzzle for most of these services.

I haven't run into any like that, but I'm with you -- if I could only store one webauthn key, I wouldn't use it at all. Too risky.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#154

Post by graton »

vngzs wrote: post #38
throwaway52022 wrote: post #35

I've resisted switching to a hardware key because I know that I'm going to break it, and that seems like a huge pain in the ass. I really want to be able to make a couple of backup keys, or maybe put another way, I want to be able to put the private key on the device myself, I don't necessarily care that the key is generated on the device and never leaves the device. I don't care if that slightly reduces my security…

You just register 2-3 keys. It's not so bad.

That's what I do. I have a nano Yubikey installed in each of my computers. Plus a Yubikey on my keychain. I register all of them with each account.

All of the accounts require username / passowrd and the Yubikey. I'm not willing to not have a password.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#155

Post by Hamuko »

2OEH8eoCRo0 wrote: post #151
Hamuko wrote: post #137

Earlier quoted context omitted.

Tell the services you interact with that they're basically going against the spec. "Relying Parties SHOULD allow and encourage users to register multiple credentials to the same account. Relying Parties SHOULD make use of the excludeCredentials and user.id options to ensure that these different credentials are bound to different authenticators."

Is it a SHOULD vs SHALL issue? Link to full spec?

It's SHOULD as per RFC2119, so basically you need to have a good reason with an understanding of the implications to ignore it.

One of the implications here being that you have zero available authenticators if your main authenticator breaks.

https://www.w3.org/TR/webauthn-2/

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#156

Post by zozbot234 »

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

Is this actually needed? Looks like the online part of this is just WebAuthn, which could be supported by the same tools we use for TOTP. You would "enroll" a visible master secret that you could then back up and optionally store in a hardware security key. The device itself wouldn't need to allow for extracting the secret again, because you backed it up at enrollment.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#157

Post by jupp0r »

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

Yubikey recommends a backup key for that very reason. Most providers allow you to register multiple keys.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#158

Post by traceroute66 »

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

> Are there any FIDO security keys that explicitly support backing up and restoring their master secrets?

Why would you need that ? On most services that I use that support FIDO, you can register as many keys as you like.

Seems to me that is a much more secure option than to provide a potentially exploitable option of allowing key extraction.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#159

Post by _trackno5 »

stjohnswarts wrote: post #124

no thanks. I don't want one account that apple/google/whoever can revoke and ruin my online life. fuck that. I'll take my chances with 2FA and passwords. When it finally gets breached (if you haven't been cancelled!) imagine how much one online cracker will able to do. This also allows them unlimited access to follow you all around and see what you do, where you log in, etc.

> I don't want one account that apple/google/whoever can revoke and ruin my online life

What are you even going on about?

As long as you have access to your FIDO authenticator, you'll still be able to use it regardless of what they do with your account.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#160

Post by avianlyric »

alberth wrote: post #39
sph wrote: post #27

Earlier quoted context omitted.

Sounds to be like we're replacing the username and the password, i.e. something you know with username and your phone, i.e. something you have . It sounds like it's still a one factor authentication system, but different.

Follow-up dumb questions: - so what happens if you don't have your phone at time of login? - if I enroll on iPhone, is my identity forever tied to Apple or can it be migrated to Android if I ever wanted to change platforms? - Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc that use FIDO login?

> - so what happens if you don't have your phone at time of login?

You can’t login. Same as it is with any 2FA system where you don’t have access to the second factor.

> - if I enroll on iPhone, is my identity forever tied to Apple or can it be migrated to Android if I ever wanted to change platforms?

At a minimum services should support multiple authentication devices/tokens. So you can enrol both an iOS device and Android device, or any other FIDO device E.g. YubiKey.

This is already the standard approach for FIDO tokens, and basically a requirement for existing services, because we don’t currently have FIDO token syncing.

I would hope that these syncing services will also allow you to export your private key. But that’s a slightly scary prospect because it would allow the holder of that key to authenticate as you anywhere.

> - Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc that use FIDO login?

Services will still need a credential recovery process. People lose phone etc everyday. I imagine your bank will happy reset your credentials if you turned up in-person holding government identification.

Post reply on HN