21–30 of 143 posts
I would be very interested in a virtual Yubikey backed by Touch ID and the Secure Enclave.
This is fantastic. Did you make this, cmdii? Why does it need to persist files locally? I thought that all that's necessary is the key. Is it for resident keys? I'd like a virtual FIDO2 device where I have to type a password/passphrase when I launch it, and it derives a FIDO2 key from the passphrase. That way, I can have my 2FA device with me in my head, and still get all the anti-phishing benefits of WebAuthn. Certa…
Yup, I built this. The file storage is only for the FIDO2/WebAuthN device, which generates large private keys for each credential; the U2F device keys are small enough that they are actually encrypted/stored in the key identifier that is passed in by the client. I’m currently working on trying to expand this out with new features, as most of the work here was actually emulating the USB device which involved a lot of…
I'm not very familiar with FIDO2, but I thought the private keys for each credential were derived from the single key in the device and the website's domain? Is that not the case? Or are you just generating separate credentials per site and keeping those?
If the latter, couldn't you derive all credentials from a single source of randomness and skip the storage?
I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…
Do you use SSH ? Yubikeys are a fabulous way to store SSH keys.
Also bear in mind that aside from a secure storage mechanism, Yubkeys can also be configured to require pin and/or touch.
Therefore no matter what gets onto your computer, the Yubikey won't provide the answer unless touched.
All I want is to be able to use Touch ID for services that only support Yubikey. At my workplace this means Duo - they have Touch ID support, but only in Chrome! In Safari or Firefox Touch ID is not an option which is very annoying. I would be very interested in a virtual Yubikey backed by Touch ID and the Secure Enclave.
Surely Apple have just answered your wishes with the introduction of Passkeys ?
Earlier quoted context omitted.
I think a huge benefit of 2fa, one of the main purposes of it, was for securing accounts with weak passwords. Back in the days before password managers etc. I think these days password managers actually deprecate the need for 2fa
Multiple layers are always better. If your computer or browser is compromised, then your password manager's secrets have been pwned, but with 2FA your accounts are still safe (assuming the 2FA is on a separate device, which it really should be) There's also non-tech users to consider. It's pretty hard to convince users to use a password manager; plenty of people still re-use the same password across sites. It's impos…
Earlier quoted context omitted.
Sure: Enough support so that my life becomes sufficiently easier or more secure to be worth the cost. I know that's a bit wishy-washy, but for example I think I could replace my memorized 1password password with something longer if I never had to enter it from memory, which would only be the case if I could use the Yubikey on all my devices.
I use a yubikey with x509 cert and PIN for local auth to my Mac, and I use it for FIDO2 MFA everywhere that supports it, which includes my email account. That makes my email credentials radically more resistant to phishing, which is huge given that email is part of the recovery story for every other account. If those aren’t enough, I guess yubikeys aren’t the right call for your threat model, which is fine.
All I want is to be able to use Touch ID for services that only support Yubikey. At my workplace this means Duo - they have Touch ID support, but only in Chrome! In Safari or Firefox Touch ID is not an option which is very annoying. I would be very interested in a virtual Yubikey backed by Touch ID and the Secure Enclave.
> I would be very interested in a virtual Yubikey backed by Touch ID and the Secure Enclave. Surely Apple have just answered your wishes with the introduction of Passkeys ?
I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…
> I can't figure out why I'd want a Yubikey. Do you use SSH ? Yubikeys are a fabulous way to store SSH keys. Also bear in mind that aside from a secure storage mechanism, Yubkeys can also be configured to require pin and/or touch. Therefore no matter what gets onto your computer, the Yubikey won't provide the answer unless touched.
Yes, but not for anything where keeping the SSH private key more secure than my AWS/DigitalOcean credentials would be useful. And I store those credentials in 1Password, which doesn't have a sufficiently mature integration with Yubikey on Linux or Android.