Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FIDO Alliance

fidoalliance.org

Post reply on HN
Print view View original

31–40 of 57 posts

Re: FIDO Alliance

#31

Post by jaredhanson »

Zamicol wrote: post #28

FIDO does some dirty things: >FIDO requires an attestation private key, which must be shared between a batch of at least 100,000 security keys. Using a DIY or cli app solution (application running on the host) will likely mean you'll be generating that private key yourself, this makes you identifiable across registrations. >Some sites (Cloudflare) may reject the use of attestation keys which are not found on the Fido…

Attestation is an option in the FIDO ecosystem, and it is up to each website whether or not attestation is needed. Attestation is often required in enterprise settings. While consumer adoption of WebAuthn is incredibly low, the introduction of passkeys and multi-device credentials looks poised to change that.

For consumer scenarios, attestation is often not a requirement. In that case, FIDO offers the "none" and "self" attestation modes. None conveys no attestation. Self attestation involves a per-website key pair. Either of these modes are privacy and DIY friendly.

Re: FIDO Alliance

#32

Post by dyml »

Zamicol wrote: post #28

FIDO does some dirty things: >FIDO requires an attestation private key, which must be shared between a batch of at least 100,000 security keys. Using a DIY or cli app solution (application running on the host) will likely mean you'll be generating that private key yourself, this makes you identifiable across registrations. >Some sites (Cloudflare) may reject the use of attestation keys which are not found on the Fido…

Please note that verifying Metadata is optional for a RP (site owner) and very few sites need it. Without metadata information the privacy is improved.

Disclosure: We built an open source library and an API that makes it easy to add WebAuthn/Fido to your existing web app. It’s available at for those who want to take a look. https://www.passwordless.dev/

There is also a more configurable demo page for the library where you can turn metadata on/off (the api is default off)

Re: FIDO Alliance

#33

Post by magicalhippo »

eikenberry wrote: post #30
magicalhippo wrote: post #25

Earlier quoted context omitted.

> store it somewhere safe That's what I meant. How exactly would one safely store this secret? How would you prevent an adversary from extracting the secret from the storage?

Various strategies that trade off security vs. convenience. Most secure is probably something simple like printing it out and putting that in a fire-proof safe. But there are lots of options. For the non-tech parents or some such, a nice pass-phrase would probably work well as the secret.

How do you get this pass-phrase from paper onto the yubikey without an adversary getting hold of it?

I'm not trying to be pedantic here, I'm just failing to see how this can be realistically implemented without significantly lowing the overall security. But this is also not my domain, so I'd like to learn.

Re: FIDO Alliance

#35

Post by dyml »

TacticalCoder wrote: post #21

What is really great with FIDO is that, if you're using a proper device the device also tells the user that he's authenticating to a site he previously registered on. So the user cannot be tricked into registering his key to, say, g00gle (with two zeroes) when he thinks he's actually authenticating with an already onboarded key. A friend has got a U2F device (forgot its name) which has six buttons that serves to ente…

Yes, fido2 defeats allot of the attack vectors for phishing attacks and is great.

While physical devices probably will mostly be used for enterprises and us nerds, “platform Authenticators (e.g passkeys) offer much of the same security without the physical device

Re: FIDO Alliance

#36

Post by tjoff »

jaredhanson wrote: post #31
Zamicol wrote: post #28

FIDO does some dirty things: >FIDO requires an attestation private key, which must be shared between a batch of at least 100,000 security keys. Using a DIY or cli app solution (application running on the host) will likely mean you'll be generating that private key yourself, this makes you identifiable across registrations. >Some sites (Cloudflare) may reject the use of attestation keys which are not found on the Fido…

Attestation is an option in the FIDO ecosystem, and it is up to each website whether or not attestation is needed. Attestation is often required in enterprise settings. While consumer adoption of WebAuthn is incredibly low, the introduction of passkeys and multi-device credentials looks poised to change that. For consumer scenarios, attestation is often not a requirement. In that case, FIDO offers the "none" and "sel…

Well, cloudfare seems to be doing it to combat bots.

We actually managed to invent something even worse than passwords. Incredible.

Re: FIDO Alliance

#37

Post by postalrat »

db65edfc7996 wrote: post #22
drdaeman wrote: post #5

Earlier quoted context omitted.

The only real problem with passwords is that humans are extremely bad at those without an aid of a password manager (when they’re no longer words but turn into pre-shared tokens). There are more, of course, but not as important. So people invented OpenID and OAuth and stuff, but all those things are fundamentally flawed because users were no longer a source of their “own” identifies. Their identities became provided…

>The only real problem with passwords is that humans are extremely bad at those without an aid of a password manager (when they’re no longer words but turn into pre-shared tokens) Human are also bad at not losing/breaking their magical security totem. I need to know that I can easily backup codes to any of these hardware tokens for if/when one is lost. Ultimate security be damned.

Whats wrong with authenticating multiple tokens and backing up the physical tokens?

I'd rather know that each token is unique and not wonder how many copies of the token exist.

Re: FIDO Alliance

#38

Post by Rafert »

akersten wrote: post #2

Hmm, seminars and "certified professional" exams. I don't recall needing those in order to understand or implement username/password auth. I keep hearing this is simpler and more secure, but I really doubt explaining this to my aging parents is going to be a fun afternoon. Can we just leave well enough alone? Was never a fan of centralizing my identity in the first place.

You don't need those either, perhaps https://github.com/herrjemand/awesome-webauthn is more to your liking than the website of a standards organization.

Re: FIDO Alliance

#39

Post by ChadNauseam »

akira2501 wrote: post #26
eulers_secret wrote: post #7

Earlier quoted context omitted.

I've had so many of my non-tech relatives get hacked. Folks who don't live/breath/shit tech just kind of suck at p/w management. This is a huge improvement for them. BUT, I absolutely think we should continue to demand the right to interact with services on our own terms: Even accepting the compromise of "less security" (debatable if you know what you're doing). I think the only way forward is a Free/Libre implementa…

> just kind of suck at p/w management. The risk/reward ratio doesn't justify it in their lives. It's also a pernicious ratio because there is almost no way to increase the "reward" portion, just decrease "risk." In my experience, solutions balanced on this type of ratio always fail to solve the fundamental problem. Which is why we have to have commercials that tell people "medicare will _never_ call you. If anyone ca…

> So, I'm assuming we can now look forward to "no one will ever call and ask for information from your key, if they do, hang up!"

There's usually no way to take your key off your device, so don't worry about that :P

Re: FIDO Alliance

#40

Post by woliveirajr »

Apple, Microsoft and Google together to improve how you login to sites without password. And they will store your "secret" so that you don't need to type it. And you'll be able to recover from any device that is already authenticated.

At the same time, every week we see a "Tell HN: how I lost all access to my email/site/account because of {reason}", where {reason} is some stupid thing that the AI flagged.

Seems that we'll able to lose access to the whole digital world if just one company makes some mistake. Yes, they will.

Post reply on HN