Show HN: A virtual Yubikey device for 2FA/WebAuthN • Hacker News Board

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#11

Post by stavros » Sat, Sep 17, 2022, 10:54 PM UTC

This is fantastic. Did you make this, cmdii? Why does it need to persist files locally? I thought that all that's necessary is the key. Is it for resident keys?

I'd like a virtual FIDO2 device where I have to type a password/passphrase when I launch it, and it derives a FIDO2 key from the passphrase. That way, I can have my 2FA device with me in my head, and still get all the anti-phishing benefits of WebAuthn.

Certainly, it's much easier for the passphrase to be stolen/keylogged, but it's a nice option to have.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#12

Post by iudqnolq » Sat, Sep 17, 2022, 10:56 PM UTC

ivanhoe wrote: post #6

iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

Can you define what do you mean by sufficient support?

Sure: Enough support so that my life becomes sufficiently easier or more secure to be worth the cost.

I know that's a bit wishy-washy, but for example I think I could replace my memorized 1password password with something longer if I never had to enter it from memory, which would only be the case if I could use the Yubikey on all my devices.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#13

Post by hamandcheese » Sat, Sep 17, 2022, 10:57 PM UTC

iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

> No 2fa device has sufficient support that it could be used to unlock the lockscreen of any of my devices either.

Remember, 2fa is your second factor. It’s right there in the acronym. It is there to protect against a bad actor stealing your password.

By definition, a second factor won’t improve the ergonomics of logging in.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#14

Post by askvictor » Sat, Sep 17, 2022, 10:58 PM UTC

warent wrote: post #4

iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

I think a huge benefit of 2fa, one of the main purposes of it, was for securing accounts with weak passwords. Back in the days before password managers etc. I think these days password managers actually deprecate the need for 2fa

Multiple layers are always better. If your computer or browser is compromised, then your password manager's secrets have been pwned, but with 2FA your accounts are still safe (assuming the 2FA is on a separate device, which it really should be)

There's also non-tech users to consider. It's pretty hard to convince users to use a password manager; plenty of people still re-use the same password across sites. It's impossible to prevent that. But it is possible to enforce 2FA for _your_ site.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#15

Post by cmdli » Sat, Sep 17, 2022, 10:59 PM UTC

stavros wrote: post #11

This is fantastic. Did you make this, cmdii? Why does it need to persist files locally? I thought that all that's necessary is the key. Is it for resident keys? I'd like a virtual FIDO2 device where I have to type a password/passphrase when I launch it, and it derives a FIDO2 key from the passphrase. That way, I can have my 2FA device with me in my head, and still get all the anti-phishing benefits of WebAuthn. Certa…

Yup, I built this. The file storage is only for the FIDO2/WebAuthN device, which generates large private keys for each credential; the U2F device keys are small enough that they are actually encrypted/stored in the key identifier that is passed in by the client.

I’m currently working on trying to expand this out with new features, as most of the work here was actually emulating the USB device which involved a lot of different layers of protocols.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#16

Post by dilyevsky » Sat, Sep 17, 2022, 10:59 PM UTC

warent wrote: post #4

iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

I think a huge benefit of 2fa, one of the main purposes of it, was for securing accounts with weak passwords. Back in the days before password managers etc. I think these days password managers actually deprecate the need for 2fa

Wrong - mfa is to prevent credentials stuffing mostly

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#17

Post by convolvatron » Sat, Sep 17, 2022, 10:59 PM UTC

dspillett wrote: post #10

lddemi wrote: post #3

Fun demo but who is this really for? Is there a requirement for these devices anywhere aside from corporate security?

> Fun demo but who is this really for? Would being able to create virtual devices like this be more useful for testing authentication flows, compared to having physical test devices?

this might help w/ adoption. it would be _really nice_ to use FIDO, but I don't want to restrict my usability to people willing to carry a key around. as a compromise I think having a weaker key is better than having paths where pki is disabled

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#18

Post by iudqnolq » Sat, Sep 17, 2022, 10:59 PM UTC

TrueGeek wrote: post #8

warent wrote: post #4

Earlier quoted context omitted.

I think a huge benefit of 2fa, one of the main purposes of it, was for securing accounts with weak passwords. Back in the days before password managers etc. I think these days password managers actually deprecate the need for 2fa

Every now and then you hear about a leak at some company that was storing passwords in clear text. Thanks to password managers this only affects that one site, but it still makes me thankful for 2FA.

I don't understand the threat model there. Wouldn't nearly all hacks that lead to plain text passwords also allow the hacker to access all the login-protected data, making a more secure login process pointless?

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#19

Post by akerl_ » Sat, Sep 17, 2022, 11:01 PM UTC

iudqnolq wrote: post #12

ivanhoe wrote: post #6

Earlier quoted context omitted.

Can you define what do you mean by sufficient support?

Sure: Enough support so that my life becomes sufficiently easier or more secure to be worth the cost. I know that's a bit wishy-washy, but for example I think I could replace my memorized 1password password with something longer if I never had to enter it from memory, which would only be the case if I could use the Yubikey on all my devices.

I use a yubikey with x509 cert and PIN for local auth to my Mac, and I use it for FIDO2 MFA everywhere that supports it, which includes my email account. That makes my email credentials radically more resistant to phishing, which is huge given that email is part of the recovery story for every other account.

If those aren’t enough, I guess yubikeys aren’t the right call for your threat model, which is fine.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#20

Post by iudqnolq » Sat, Sep 17, 2022, 11:02 PM UTC

hamandcheese wrote: post #13

iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

> No 2fa device has sufficient support that it could be used to unlock the lockscreen of any of my devices either. Remember, 2fa is your second factor. It’s right there in the acronym. It is there to protect against a bad actor stealing your password. By definition, a second factor won’t improve the ergonomics of logging in.

Not quite. A second factor would allow me to reduce the complexity of my password while retaining the same level of security.

Without that the only benefit of a Yubikey over a strong password saved in a password manager is phishing protection, which I'm not willing to pay that amount of money for.