Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard • Hacker News Board

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#291

Post by Arnavion » Thu, May 05, 2022, 6:24 PM UTC

ChikkaChiChi wrote: post #283

Why aren't we doing more to validate the identity of the service we are trying to connect to? CAs don't allow me to establish my own personal web of trust. If I connect once to my bank in a method I deem safe, I should be able to store their credentials in an easy to validate way. That way if I fall for a phishing attack, the browser can CLEARLY indicate to me that I'm encountering a new entity, not one I have an est…

They closest thing to avoiding being phished by a different "secure" entity is that your password manager will refuse to autofill (*) your credentials. But it's true that this is far from sufficient - this kind of autofill is wonky and doesn't work with all pages, so users can get conditioned to working around it by manually copying and pasting from the password manager to the browser, which defeats the protection. Many users prefer to always copy-and-paste anyway, because that avoids having to install the password manager's corresponding browser addon which can seem more secure.

(*): Note that "autofill" only means "automatically populate credentials", not "automatically populate credentials without any user interaction". Clicking the username field, choosing a credential from a dropdown that the password manager populated for you based on which credentials match the website in question, and then having it be applied is also "autofill".

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#292

Post by [deleted] » Thu, May 05, 2022, 6:24 PM UTC

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

[deleted]

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#293

Post by anotheracctfo » Thu, May 05, 2022, 6:30 PM UTC

alberth wrote: post #39

sph wrote: post #27

Earlier quoted context omitted.

Sounds to be like we're replacing the username and the password, i.e. something you know with username and your phone, i.e. something you have . It sounds like it's still a one factor authentication system, but different.

Follow-up dumb questions: - so what happens if you don't have your phone at time of login? - if I enroll on iPhone, is my identity forever tied to Apple or can it be migrated to Android if I ever wanted to change platforms? - Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc that use FIDO login?

Same thing that happened when my work required 2FA for checking email, I simply stopped checking email on my personal phone.

Its not like InfoSec cares if the business functions, that's not their job.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#294

Post by aaaaaaaaata » Thu, May 05, 2022, 6:31 PM UTC

droopyEyelids wrote: post #257

dividedbyzero wrote: post #244

Earlier quoted context omitted.

I believe AWS root accounts don't support more than one key to be added.

I don't think any AWS account allows more than one!

This has been talked about in HN comments almost daily for like a week — does anyone from AWS/Amazon read this forum, or are they too busy performing blood sacrifices trying to recruit graduates?

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#295

Post by Wohlf » Thu, May 05, 2022, 6:31 PM UTC

matheusmoreira wrote: post #275

danuker wrote: post #268

Earlier quoted context omitted.

> Passcodes can therefore be compelled if their existence, possession and authentication are "foregone conclusions," the court said in the August 2020 ruling, determining the 5th Amendment's foregone conclusion exception applied in the case. https://www.reuters.com/business/legal/us-supreme-court-nixe...

What if you forget the password?

Same as if you forget your safe combination, you're charged with contempt of court.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#296

Post by eikenberry » Thu, May 05, 2022, 6:32 PM UTC

traceroute66 wrote: post #158

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

> Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? Why would you need that ? On most services that I use that support FIDO, you can register as many keys as you like. Seems to me that is a much more secure option than to provide a potentially exploitable option of allowing key extraction.

I have 100s of passwords and dozens of TOTP keys in my password manager. Logging into every one of these sites with 2 keys, and having to re-auth with all of them if you lose one of those is unworkable. It only really makes sense for centralized auth solutions like you'd have at work, not for day to day personal things. I want a FIDO key that I can use for day to day things.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#297

Post by aaaaaaaaata » Thu, May 05, 2022, 6:34 PM UTC

xur17 wrote: post #140

throwaway52022 wrote: post #35

I've resisted switching to a hardware key because I know that I'm going to break it, and that seems like a huge pain in the ass. I really want to be able to make a couple of backup keys, or maybe put another way, I want to be able to put the private key on the device myself, I don't necessarily care that the key is generated on the device and never leaves the device. I don't care if that slightly reduces my security…

Has anyone tried a Ledger or Trezor device for something like this? Your FIDO U2F private key is deterministically generated [0] based upon your seed phrase, which you can backup, and restore on other devices. [0] https://www.reddit.com/r/ledgerwallet/comments/udzx1c/ledger...

Any input which (Trezor/Ledger) is least likely to be a honeypot?, and/or a good device?

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#298

Post by sheerun » Thu, May 05, 2022, 6:35 PM UTC

_vdpp wrote: post #280

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

I think the whole point of HSMs is that you can’t back up (read: exfiltrate) the master secrets. Having said that, on certain Yubikeys you can store PGP keys on them, and put the same secret key on several different Yubis. If you’re relying on a hardware key it’s probably a good idea to have a backup key and make sure both are registered with whatever system you’re accessing. LastPass and GitHub at least support addi…

A backup key could have ability to reject original one, problem solved...

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#299

Post by aaaaaaaaata » Thu, May 05, 2022, 6:36 PM UTC

sph wrote: post #27

alberth wrote: post #21

Dumb question: why are biometrics being used to replace the password , shouldn't the biometric replace the username ?

Sounds to be like we're replacing the username and the password, i.e. something you know with username and your phone, i.e. something you have . It sounds like it's still a one factor authentication system, but different.

The "one" factor is a zk proof.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#300

Post by light_cone » Thu, May 05, 2022, 6:37 PM UTC

traceroute66 wrote: post #158

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

> Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? Why would you need that ? On most services that I use that support FIDO, you can register as many keys as you like. Seems to me that is a much more secure option than to provide a potentially exploitable option of allowing key extraction.

First of all, _most_ services is not _all_ services, so you have a use case here.

Also, you could make FIDO keys that support restoring but not backing up. If you could set up a FIDO with custom random seed _as an expert option_, then you could have a secure key, and keeping the seed private would be your expert problem.

I would adopt such a solution, whereas now I don't adopt the proposed solution because I cannot add a new service while having the backup key remaining off-site.

Maybe another solution would be to be to have _absolutely all_ services accept several keys (enforced by protocol), in addition to be able to accept adding an off-site key with only its fingerprint, but without requiring to have it physically.