Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard • Hacker News Board

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#251

Post by MrStonedOne » Thu, May 05, 2022, 5:29 PM UTC

traceroute66 wrote: post #158

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

> Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? Why would you need that ? On most services that I use that support FIDO, you can register as many keys as you like. Seems to me that is a much more secure option than to provide a potentially exploitable option of allowing key extraction.

No post body was provided.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#252

Post by lnxg33k1 » Thu, May 05, 2022, 5:32 PM UTC

austinbv wrote: post #242

The problem with any key based auth or biometric auth is a user can be compelled by LEO to hand over private keys or open a biometric lock. Passwords are protected by the 5th amendment.

I think the main problem I’m never buying into Fido keys anymore is that mine point blank stopped working and I had to sweat to get back in website that supported it, hopefully back then not many, but if identity is the responsibility of a close piece of hardware if it breaks you’re out

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#253

Post by Rafert » Thu, May 05, 2022, 5:34 PM UTC

austinbv wrote: post #242

The problem with any key based auth or biometric auth is a user can be compelled by LEO to hand over private keys or open a biometric lock. Passwords are protected by the 5th amendment.

The actual exchange with the server is using public key cryptography. How you unlock the key material locally could be a number of ways: PIN, password, fingerprint scan, voice recognition, etc

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#254

Post by howinteresting » Thu, May 05, 2022, 5:35 PM UTC

graton wrote: post #191

kayodelycaon wrote: post #185

Earlier quoted context omitted.

And where do you store the backup key?

In each one of my PCs and also on my key-ring is how I do it.

Sounds miserable compared to using a password manager.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#255

Post by dane-pgp » Thu, May 05, 2022, 5:36 PM UTC

md_ wrote: post #216

0daystock wrote: post #56

Earlier quoted context omitted.

Can you share any more information about that? Is this identifier shared as part of the FIDO2/U2F spec?

I think they're referring to attestation ( https://fidoalliance.org/fido-technotes-the-truth-about-atte... .), which requires that attestation certificates be shared with a minimum of 100,000 other devices in order to ensure they're not unique IDs. Maybe the parent misread the spec as saying a _maximum_ of 100,000? Or something?

The point being, the FIDO Alliance reserves the right to blacklist any device that an attacker manages to extract the secret keys from, which has the consequence that 99,999 other people have their devices bricked.

Also, the Alliance could decide to blacklist a manufacturer just because they haven't implemented some new policy (like requiring a DNA scan of the user) so you better make sure that you buy a device from one of the "too big to fail" providers.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#256

Post by snarf21 » Thu, May 05, 2022, 5:36 PM UTC

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

I wish FIDO was built into the phones (enclave) requiring a biometric and passcode. For 99% of users this would be superior to email/password and get rid of a lot of hacks/phishing. It doesn't require extra hardware to buy and simply requires a minor protocol update to have the challenge on a laptop/desktop show as a QR-code (or could be sent via BT). The mobile sends the response out of band to a destination set at creation.

For users with a greater threat model (worry about enclave being hacked), they can use physical FIDO keys.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#257

Post by droopyEyelids » Thu, May 05, 2022, 5:36 PM UTC

dividedbyzero wrote: post #244

rootusrootus wrote: post #153

Earlier quoted context omitted.

I haven't run into any like that, but I'm with you -- if I could only store one webauthn key, I wouldn't use it at all. Too risky.

I believe AWS root accounts don't support more than one key to be added.

I don't think any AWS account allows more than one!

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#258

Post by daenz » Thu, May 05, 2022, 5:37 PM UTC

It would be nice for Amazon to commit as well. AWS has support for only a single Yubikey, which is mostly useless, unless you don't care about being locked out of your account if you lose that one key.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#259

Post by devwastaken » Thu, May 05, 2022, 5:37 PM UTC

austinbv wrote: post #242

The problem with any key based auth or biometric auth is a user can be compelled by LEO to hand over private keys or open a biometric lock. Passwords are protected by the 5th amendment.

You can be compelled by the court to divulge passwords. It's one of those areas of interpretation of law and there's precedent against it as can be searched for.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#260

Post by rad88 » Thu, May 05, 2022, 5:37 PM UTC

austinbv wrote: post #242

The problem with any key based auth or biometric auth is a user can be compelled by LEO to hand over private keys or open a biometric lock. Passwords are protected by the 5th amendment.

The litigation on that matter is ongoing. What you said is not true right now. If you try to fight an order for your password, you'll wind up in court and probably lose, and then have to chose whether to act in contempt.