Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

fidoalliance.org

Post reply on HN
Print view View original

431–440 of 525 posts

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#431

Post by lxgr »

tialaramex wrote: post #384
lxgr wrote: post #317

Earlier quoted context omitted.

Cryptographically speaking it's signing a challenge, not encrypting a value (which would be a public key operation), but generally speaking yes, that's the idea of it! One of the things FIDO adds beyond a protocol for "plain" hardware-generated and stored keys is the idea of attestation, i.e. authenticators being able to express statements like "keys can never leave this authenticator" or "this key requires PIN or fi…

However, you should not require attestation for public services. If you let Jim sign up with his dog's name as a password, but then refuse to let Sarah sign in because her FIDO device wouldn't provide "attestation" you're crazy. Attestation probably isn't the correct choice for almost anybody, but the cases where it could at least make sense are if you're an employer checking employee authenticators, if you gave ever…

Sure, don't require attestation for services where 2FA is completely optional.

But for sensitive systems/services, why not make use of the advanced capabilities that hardware authenticators offer? I'm using one in a corporate environment, and in my view it makes a lot of sense.

I'd also not be upset if my bank would let me bypass the mandatory "account restricted, call customer support" dance every time I initiate a transfer over $10 between my own accounts using only a "trusted" authenticator brand... And banks typically care a lot about security properties like "this authenticator does not allow extracting private keys".

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#432

Post by PostThisTooFast »

Ajedi32 wrote: post #352

This is huge! It sounds like they're finally going implement cross-device synced credentials; a move I've been advocating now for the last two and a half years[1]. Widespread support for this feature is, in my opinion, the last thing needed to make WebAuthn viable as a complete replacement for passwords on the web. The white paper is here: https://media.fidoalliance.org/wp-content/uploads/2022/03/Ho... Seems like the…

No post body was provided.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#433

Post by db65edfc7996 »

throwaway52022 wrote: post #35

I've resisted switching to a hardware key because I know that I'm going to break it, and that seems like a huge pain in the ass. I really want to be able to make a couple of backup keys, or maybe put another way, I want to be able to put the private key on the device myself, I don't necessarily care that the key is generated on the device and never leaves the device. I don't care if that slightly reduces my security…

Hear hear. I already have enough to worry about besides this little magical security wand failing/getting lost. I require a bullet proof method-of-last-resort mechanism in place for the inevitable day when the fob is no longer available.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#434

Post by t-3 »

tpush wrote: post #383
mjevans wrote: post #310

Earlier quoted context omitted.

I do NOT want to use my phone. It cannot be considered to be a secure device given the 'network' baseband control chipset will never be owned by the phone's buyer and has full access to the device.

The baseband CPU doesn't have full access on any decent phone.

Got a list of decent phones?

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#435

Post by blep_ »

dwaite wrote: post #348
aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

The vendors here are proposing a platform synchronization method such that these are both backed up as well as shared across devices within a particular platform account. There likely is a hardware key that supports export and import of keys (even if that winds up being a fork of say the Solo key firmware). However, as an end-user one doesn't want to accidentally forget to export keys for a while, nor do they want to…

FIDO, at least, doesn't store per-site keys on the device. You only have to back up and restore the master key, which doesn't change and so doesn't need to be scheduled.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#436

Post by blep_ »

lrvick wrote: post #420
michaelt wrote: post #65

Earlier quoted context omitted.

Eh, retrieving a key from off-site storage every time you open a new account is a pretty big inconvenience, even for a security enthusiast.

You can use devices like Ledger that support BIP39 backup allowing you to create duplicate devices any time from a 24 word random seed. Now your one time backup covers all current and future services.

You've recommended "devices like Ledger" many times in this thread.

Are there things that support this that aren't cryptocurrency wallets?

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#437

Post by la6472 »

drdaeman wrote: post #271
la6472 wrote: post #247

Earlier quoted context omitted.

Why do we need another AuthN protocol? We should extend OIDC as needed instead of again trying to reinvent the wheel.

In WebAuthn you're actually in possession of your own identity (or, to be more precise, your identity is established between you and website). In OpenID, OAuth and OpenID Connect the paradigm is completely different, where your identity is provided by someone else.

Yes I get that but I think OIDC could be extended to cover that too whereas the Authenticator or iDP is the local face scanner kr other biometric and then the rest ie exchange of token etc stays the same. That way there won’t be two completely separate path and that will defeat the purpose of SSO. And it looks like there are already some implementation of this https://www.bioid.com/facial-recognition-app/

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#438

Post by la6472 »

Ajedi32 wrote: post #352

This is huge! It sounds like they're finally going implement cross-device synced credentials; a move I've been advocating now for the last two and a half years[1]. Widespread support for this feature is, in my opinion, the last thing needed to make WebAuthn viable as a complete replacement for passwords on the web. The white paper is here: https://media.fidoalliance.org/wp-content/uploads/2022/03/Ho... Seems like the…

I get that but I think OIDC could be extended to cover that too whereas the Authenticator or iDP is the local face scanner kr other biometric and then the rest ie exchange of token etc stays the same. That way there won’t be two completely separate path and that will defeat the purpose of SSO ie OIDC websites will authenticate with google or Facebook but FIDO enabled websites will work with face recognition. And it looks like there are already some implementation of this OIDC enabled face recognition https://www.bioid.com/facial-recognition-app/

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#439

Post by zozbot234 »

lxgr wrote: post #430
zozbot234 wrote: post #367

Earlier quoted context omitted.

This does not solve the backup issue. It's effectively using the phone or computer as a whole as a hardware key, which introduces multiple failure modes compared to external hardware keys while also adding to privacy concerns. It might have some extremely niche use for some use of on-prem devices in enterprise settings where the inability to sever the authentication element from the actual hardware might be convenien…

The backup issue is solved by using an external authenticator for initial provisioning of new devices. In a compliant implementation, you can add a new external authenticator from an existing trusted device, and a new trusted device from an existing external authenticator. > while also adding to privacy concerns. What concerns are you thinking about here? > TPMs are essentially a misfeature given the existence of sma…

> In a compliant implementation, you can add a new external authenticator from an existing trusted device, and a new trusted device from an existing external authenticator.

You can kinda sorta do this with WebAuthn if the service you're enrolling into allows for multiple authenticators (the spec recommends this, but some services don't allow more than one). But then you have to repeat that enrollment step with all devices, for every new service you sign up to. Which is practically useless because an actual backup is supposed to be stored in a safe place that might be hard to get to.

> TPMs are essentially built-in smartcards

The question is why anyone sensible would want to have a smartcard built into their computing device. The only uses I can think for it are nefarious, i.e. allowing outside services to track the user and violate their privacy.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#440

Post by makeitdouble »

Ajedi32 wrote: post #352

This is huge! It sounds like they're finally going implement cross-device synced credentials; a move I've been advocating now for the last two and a half years[1]. Widespread support for this feature is, in my opinion, the last thing needed to make WebAuthn viable as a complete replacement for passwords on the web. The white paper is here: https://media.fidoalliance.org/wp-content/uploads/2022/03/Ho... Seems like the…

I went through the white paper, yet still don’t completely understand how it is supposed to work cross device, granted I’m new to Fido.

Let’s say I have the same key synched between my laptop, smartphone and tablet. When I wake up in the morning, will there be a ceremony of unlocking my phone (standard non Fido way I guess?) then unlock my tablet from my phone, then the laptop from one of unlocked devices ? With some more costly backup process in case I only physically have one of the device I guess ?

Post reply on HN