401–410 of 525 posts
Earlier quoted context omitted.
I haven't run into any like that, but I'm with you -- if I could only store one webauthn key, I wouldn't use it at all. Too risky.
I believe AWS root accounts don't support more than one key to be added.
Earlier quoted context omitted.
> Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? Why would you need that ? On most services that I use that support FIDO, you can register as many keys as you like. Seems to me that is a much more secure option than to provide a potentially exploitable option of allowing key extraction.
I have 100s of passwords and dozens of TOTP keys in my password manager. Logging into every one of these sites with 2 keys, and having to re-auth with all of them if you lose one of those is unworkable. It only really makes sense for centralized auth solutions like you'd have at work, not for day to day personal things. I want a FIDO key that I can use for day to day things.
Now go enroll 100 sites in it and then lose or destroy the device.
Enter the 24 word backup to a new device and access to your 100 sites is restored.
Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.
Ideally there would be a way to create "tickets" or something from an authenticator in advance and then use them for registration without physical access to the device. Then I could have 100 tickets from my backup on my master, keep the physical backup in a secure offsite location, and enroll new services using master + backup-tickets. When I run out of tickets, generate 100 more. Being able to export/back up/restore…
Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.
Yubikey recommends a backup key for that very reason. Most providers allow you to register multiple keys.
Earlier quoted context omitted.
The ability to have a backup does not imply any ability to exfiltrate the master secrets. It is enough to have a means to wipe out any information contained in the device, including any master secret. At that point, there should be a means to enter a new master secret in the blank device, before proceeding to use it normally. If a device provides this feature and it does not contain any other secret information intro…
> If a device provides this feature and it does not contain any other secret information introduced in it by the manufacturer, then it allows the owner to have any kind of backup that is desired. Precisely. The Ledger Nano S (and probably the Nano X too) allows to do exactly what you describe, the very way you describe it (three wrong PINs, on purpose or not, and the device resets itself to factory default and, as yo…
https://osxdaily.com/2021/05/27/set-iphone-erase-automatical...
Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.
There are some software tokens (Wear OS watch, Android phone), but they are purposely not exportable from the Android Keystore. https://github.com/herrjemand/awesome-webauthn#software-auth... There was mention of a secure backup proposal, but it doesn't appear to have been touched after being a draft for a year: https://github.com/Yubico/webauthn-recovery-extension
Earlier quoted context omitted.
I think the whole point of HSMs is that you can’t back up (read: exfiltrate) the master secrets. Having said that, on certain Yubikeys you can store PGP keys on them, and put the same secret key on several different Yubis. If you’re relying on a hardware key it’s probably a good idea to have a backup key and make sure both are registered with whatever system you’re accessing. LastPass and GitHub at least support addi…
For HSM with FIPS140 Level 3 certification the master key can only enter and leave in encrypted form. Backup/restore and cloning is possible, but there are mechanisms like hardware and firmware validation to ensure only the same type device and certified venfor software can make use of it.
Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.
I wish FIDO was built into the phones (enclave) requiring a biometric and passcode. For 99% of users this would be superior to email/password and get rid of a lot of hacks/phishing. It doesn't require extra hardware to buy and simply requires a minor protocol update to have the challenge on a laptop/desktop show as a QR-code (or could be sent via BT). The mobile sends the response out of band to a destination set at…