Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

fidoalliance.org

Post reply on HN
Print view View original

181–190 of 525 posts

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#181

Post by NovemberWhiskey »

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

By design, ideally not. WebAuthn optionally includes (as a 'SHOULD') a signature counter concept that allows relying parties to be confident that the attestation isn't coming from a previously-cloned version of the authenticator.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#182

Post by CyberRage »

stjohnswarts wrote: post #138
CyberRage wrote: post #40

Earlier quoted context omitted.

From a theoretical point of view or practical? Username is simply an ID. Password is how we truly verify who the user is. Bio-metrics are just convenient because they are unique and hard\impossible to replicate.

they aren't impossible to replicate tho

Well it depends on how you define replicate, I'm not aware of a technology that can perfectly recreate someone's face\fingerprint.

a photo\mask isn't perfect and actually in some instances they fail to work vs sensors because of that.

It is more of a question of how robust is the authentication method.(can a photo\mask fool it? which can happen sometime but usually require pretty high quality sample)

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#183

Post by sph »

avianlyric wrote: post #152
sph wrote: post #27

Earlier quoted context omitted.

Sounds to be like we're replacing the username and the password, i.e. something you know with username and your phone, i.e. something you have . It sounds like it's still a one factor authentication system, but different.

The expectation is that you also have “something you are” as provided by your devices biometric authentication. The standard allows for service to demand that the authentication device performs an additional factor authentication. Which is usually either a PIN or biometrics, and your device attests to doing this during authentication. So then you have two complete factors “something you have” (your phone) and “someth…

But I'm responding to GP that said biometrics are a username, not a secret, which I agree. I'm not sure something you are counts as a security factor.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#184

Post by bedast »

j_san wrote: post #58
bedast wrote: post #55

The weakest link in security is always going to be humans. Account compromise is is more often a human problem than a technological one (spamming requests, password reuse, simple passwords, (spear) phishing, direct social engineering, etc). If I'm understanding correctly, they're aiming to reduce multi-factor auth back down to a single factor that's "easier" than passwords. Easier to use. Easier to social engineer a…

But isn't the "thing" about FIDO (or maybe just security keys?) that the domain is also integrated into the challenge the client/key has to solve? So from what I understand a attacker couldn't as easily fish me by pretending e.g. to be Google. With a password or even a TOTP code the attacker could just pose as Google and forward the credentials to the actual site.

You're looking at an exploit from a technological point of view, which I expect this community is likely to do. Think of it from the perspective of the average user. I know for a fact if my mom was told by an attacker "if you see an approval request for your account, just accept it" she would do so. It's taken time to train her not to give anyone her password.

I've read of attackers with valid passwords spamming logins in hopes to trick a user into approving the auth. Whether it's because it woke up the user and they're in a sleep fog, or they're busy and not paying attention.

Microsoft, at some point, changed their login flow so that, by default, when you enter your username, it sends a pin. I receive regular attempts at this. This isn't going to work out for the attacker because they have to get the pin. But if all that's required is a button press, the attacker could just make the login request and wait.

With multi-factor auth, where a password is in use, you have to get past the password before getting to that auth approval. It reduces how much noise the user gets and the chances of success for the attacker.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#185

Post by kayodelycaon »

jupp0r wrote: post #157
aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

Yubikey recommends a backup key for that very reason. Most providers allow you to register multiple keys.

And where do you store the backup key?

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#187

Post by fmakunbound »

Reading through the threads here: If the HN can't articulate FIDO and differences between it and the now decades old password model to each other, I think regular jack-offs are going to have trouble.

People have the mental model that their secret is stored in their gray matter/post-it note/password manager, and now you're telling them it's in their phone, and somewhat related to the phone's security model, or maybe a "yubikey", or behind biometrics, or maybe not, it depends, and Big Co. has copy, of something, and it's synced, and one possibly "migrates" between Big Co. and Big Co. might deliberately/accidentally disable all your websites, or losing your device/yubikey/piece of paper means you're screwed, possibly...

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#188

Post by zozbot234 »

gazby wrote: post #172
aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

Just so you don't feel alone with the replies being of the typical variety, I'm 100% with you. The flaws in the "backup token" approach are rehashed constantly but the world keeps turning as though they're irrelevant. I look forward to hardware tokens reaching a popularity level where we see implementations in software and this conversation can be rendered moot. Shout out to Mozilla and Dan Stiner for their work so f…

Software ("virtual") implementations are already possible in WebAuthn. It's up to the service whether to allow enrollment via a software authenticator; most services will want to allow this, seeing as it's still way more secure than ordinary username/password.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#189

Post by password4321 »

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

There are some software tokens (Wear OS watch, Android phone), but they are purposely not exportable from the Android Keystore.

https://github.com/herrjemand/awesome-webauthn#software-auth...

There was mention of a secure backup proposal, but it doesn't appear to have been touched after being a draft for a year:

https://github.com/Yubico/webauthn-recovery-extension

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#190

Post by zozbot234 »

NovemberWhiskey wrote: post #181
aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

By design, ideally not. WebAuthn optionally includes (as a 'SHOULD') a signature counter concept that allows relying parties to be confident that the attestation isn't coming from a previously-cloned version of the authenticator.

The specification states that cloning should merely be included in the service's underlying threat model. E.g. you might well be able to log in from an authenticator that fails the "signature counting" step if it's expected that the authenticator would allow for backing up and restoring its stored credentials.
Post reply on HN