Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

fidoalliance.org

Post reply on HN
Print view View original

211–220 of 525 posts

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#211

Post by vngzs »

teeray wrote: post #192

Does this provide any benefit over a (properly used) password manager? I’d be happy with just: - an “alphabet”, “minlength” and “maxlength” attributes on password fields so password managers generate perfect passwords every time - a well-known URI for password managers to do zero-touch password rotation. - actual elements for login components to close the confused deputy attack for password managers. All these things…

If you're copying passwords out of a password manager and pasting them into password fields, then yes, you're getting a significant improvement to phishing protection with a hardware key. If you're using the password manager's autofill feature, and that autofill feature is bug-free, then you're not getting any additional phishing protection.

Your passwords can still be stolen, however. Any hardware authentication mechanism is going to ensure that no matter how compromised your local machine is, the worst an attacker can do is steal one active session. They can't steal the secret required to initiate any future session.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#213

Post by teeray »

yakak wrote: post #198
teeray wrote: post #192

Does this provide any benefit over a (properly used) password manager? I’d be happy with just: - an “alphabet”, “minlength” and “maxlength” attributes on password fields so password managers generate perfect passwords every time - a well-known URI for password managers to do zero-touch password rotation. - actual elements for login components to close the confused deputy attack for password managers. All these things…

First you need to invent a password manager that can be properly used? The one I have runs on my computer and trusts everything else I've ever installed not to have put in a mechanism to observe memory allocated to my browser.

Is that how most credentials are stolen these days?

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#214

Post by NovemberWhiskey »

mrkramer wrote: post #163

I never understood why TLS Client Authentication[0] is not used more because that way all other standards including FIDO wouldn't be needed. [0] https://blog.cloudflare.com/introducing-tls-client-auth/

Within the DoD, it's ubiquitous. see https://en.wikipedia.org/wiki/Common_Access_Card

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#215

Post by [deleted] »

fmakunbound wrote: post #187

Reading through the threads here: If the HN can't articulate FIDO and differences between it and the now decades old password model to each other, I think regular jack-offs are going to have trouble. People have the mental model that their secret is stored in their gray matter/post-it note/password manager, and now you're telling them it's in their phone, and somewhat related to the phone's security model, or maybe a…

[deleted]

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#216

Post by md_ »

0daystock wrote: post #56
RL_Quine wrote: post #30

Earlier quoted context omitted.

Kind of. Yubikeys intentionally have a very small number of devices signed with one CA key and then they produce a new CA key, so those devices do have a basically unique identifier.

Can you share any more information about that? Is this identifier shared as part of the FIDO2/U2F spec?

I think they're referring to attestation (https://fidoalliance.org/fido-technotes-the-truth-about-atte....), which requires that attestation certificates be shared with a minimum of 100,000 other devices in order to ensure they're not unique IDs.

Maybe the parent misread the spec as saying a _maximum_ of 100,000? Or something?

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#217

Post by bpye »

georgyo wrote: post #59
vngzs wrote: post #38

Earlier quoted context omitted.

You just register 2-3 keys. It's not so bad.

It's actually horrible! Even key rotation is horrible! My yubikey is getting to about 10 years old, and I have replacements for it but find it very difficult to switch. It will eventually fail as an things do and it will be problematic. The problem is that I have several dozen accounts connected to it and I don't know all of them. So either I'm carrying and trying multiple keys at all times or not getting into a site…

I’m going to need to work this out soon. I picked up a pair of new YubiKey 5Cs yesterday with their sale. I’ve been using a YubiKey Neo for years for U2F, TOTP and GPG.

Moving the GPG key is easy - though I might try using the FIDO2 support in SSH instead. However for every TOTP and U2F key I’m going to have to re-enroll the new keys… It feels like there should be a better way.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#218

Post by [deleted] »

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

[deleted]

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#219

Post by nyuszika7h »

alberth wrote: post #39
sph wrote: post #27

Earlier quoted context omitted.

Sounds to be like we're replacing the username and the password, i.e. something you know with username and your phone, i.e. something you have . It sounds like it's still a one factor authentication system, but different.

Follow-up dumb questions: - so what happens if you don't have your phone at time of login? - if I enroll on iPhone, is my identity forever tied to Apple or can it be migrated to Android if I ever wanted to change platforms? - Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc that use FIDO login?

> - Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc that use FIDO login?

You don't need an Apple/Google/Microsoft account to use WebAuthn on another website, it's based on the biometrics on your local device. Syncing that credential across your devices with the same account is just an optional extra feature.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#220

Post by NovemberWhiskey »

jedberg wrote: post #165
mrkramer wrote: post #163

I never understood why TLS Client Authentication[0] is not used more because that way all other standards including FIDO wouldn't be needed. [0] https://blog.cloudflare.com/introducing-tls-client-auth/

It's the classic key distribution problem. You'd have to get client certificates to people securely. It works for corporations because they can send you a device with the client cert pre-loaded.

Firstly, PKI generally doesn't have a key distribution problem because keys never get distributed; they get generated in-place, certificate signing requests are sent to certificate authorities, certificates are signed and returned.

Secondly, in the TOFU model that applies to WebAuthn, you don't even need to have a certificate authority - you can self-sign.

The problem is really, as alluded to another comment, that if you share a single certificate across multiple sites then you are sharing a common tracking id between them (e.g. your certificate fingerprint).

Logout is also a user experience pain point unless the certificates are stored on e.g. a smart card that can be removed.

Post reply on HN