221–230 of 525 posts
Earlier quoted context omitted.
And where do you store the backup key?
In each one of my PCs and also on my key-ring is how I do it.
That's basically what I'm getting at. Do I need to do significant amounts of extra work to keep an off-site backup in another state?
Earlier quoted context omitted.
First you need to invent a password manager that can be properly used? The one I have runs on my computer and trusts everything else I've ever installed not to have put in a mechanism to observe memory allocated to my browser.
Is that how most credentials are stolen these days?
Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.
Beware that if you do this and lose your primary key, or if it is stolen, then an attacker can impersonate you. Setting up multiple unique keys is probably more useful in general, even if it's more cumbersome.
Earlier quoted context omitted.
Software ("virtual") implementations are already possible in WebAuthn. It's up to the service whether to allow enrollment via a software authenticator; most services will want to allow this, seeing as it's still way more secure than ordinary username/password.
Are there any existing implementations I should be aware of?
Earlier quoted context omitted.
> Oh gosh... your raw bio-metrics are never stored anywhere... right, who would do that... i mean for what purpose...
I mean you don't have to give it away if you think Google is storing databases of fingerprints for the lizard masters to track you down. FIDO simply wants to make authentication stronger, you can use hardware keys that have a key burnt into them which is unique and much harder to brute-force than passwords. Again according to how biometrics are described in whitepapers\industry, we extract features from the fingerpri…
"As a result, the early common belief among the biometrics community of templates irreversibility has been proven wrong. It is now an accepted fact that it is possible to reconstruct from an unprotected template a synthetic sample that matches the bona fide one."
-- Reversing the irreversible: A survey on inverse biometrics
https://www.sciencedirect.com/science/article/pii/S016740481...
Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.
Being able to export/back up/restore master secrets would be nice too.
Earlier quoted context omitted.
I don’t think fingerprint scanners on consumer devices are always great. My daughter has one on her laptop and last week I tried my finger and it worked.
Honestly, biometrics are terrible for authorization. They're more of a username than a password and we shouldn't use them like passwords. The same is truth for facial recognition algorithms, no matter how advanced. They're so damn convenient, though. I trust the fingerprint scanner on my phone and my laptop, but there are definitely bad scanners out there.
FWIW, my daughter's laptop is a Dell.
Earlier quoted context omitted.
By design, ideally not. WebAuthn optionally includes (as a 'SHOULD') a signature counter concept that allows relying parties to be confident that the attestation isn't coming from a previously-cloned version of the authenticator.
The specification states that cloning should merely be included in the service's underlying threat model. E.g. you might well be able to log in from an authenticator that fails the "signature counting" step if it's expected that the authenticator would allow for backing up and restoring its stored credentials.
So their vision of the future is that to do anything online, one MUST have a phone (ahem, portable wiretap)? And they're going to be keeping my secrets for me, for my own good? I'm not sure I'm down with any of that.
My vision of future authentication (shared by colleagues in security) is based in strong hardware credentials and additional layer-7 context about identity, device and location. Basically, more identification of you and your browser using cryptographically-guaranteed and immutable events. It is actually the deprecation of passwords altogether and generally moving the trust boundary away from the control of the user e…
Mass surveillance. You can just say mass surveillance.
Earlier quoted context omitted.
The specification states that cloning should merely be included in the service's underlying threat model. E.g. you might well be able to log in from an authenticator that fails the "signature counting" step if it's expected that the authenticator would allow for backing up and restoring its stored credentials.
I think the point is it's up to the relying party to make the decision; so an uneven user experience is possible.