Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A virtual Yubikey device for 2FA/WebAuthN

github.com

Post reply on HN
Print view View original

31–40 of 143 posts

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#31

Post by hamandcheese »

iudqnolq wrote: post #20
hamandcheese wrote: post #13

Earlier quoted context omitted.

> No 2fa device has sufficient support that it could be used to unlock the lockscreen of any of my devices either. Remember, 2fa is your second factor. It’s right there in the acronym. It is there to protect against a bad actor stealing your password. By definition, a second factor won’t improve the ergonomics of logging in.

Not quite. A second factor would allow me to reduce the complexity of my password while retaining the same level of security. Without that the only benefit of a Yubikey over a strong password saved in a password manager is phishing protection, which I'm not willing to pay that amount of money for.

Not just phishing - you could lose your password via malware, or if services store passwords in clear text and get hacked.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#32

Post by askvictor »

iudqnolq wrote: post #26
askvictor wrote: post #14

Earlier quoted context omitted.

Multiple layers are always better. If your computer or browser is compromised, then your password manager's secrets have been pwned, but with 2FA your accounts are still safe (assuming the 2FA is on a separate device, which it really should be) There's also non-tech users to consider. It's pretty hard to convince users to use a password manager; plenty of people still re-use the same password across sites. It's impos…

Your first example is interesting, but it's much more limited than you describe. The attacker can't use your credentials to authenticate their own session, but they have complete control over the authenticated session on your laptop. I can't think of an account I have where that would be meaningfully less bad.

The attacker has access to all of your authenticated sessions on your compromised laptop. They don't have access to any un-authenticated accounts which have 2FA enabled.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#33

Post by toomuchtodo »

hamandcheese wrote: post #28
traceroute66 wrote: post #25

Earlier quoted context omitted.

> I would be very interested in a virtual Yubikey backed by Touch ID and the Secure Enclave. Surely Apple have just answered your wishes with the introduction of Passkeys ?

If it requires developer action to support, then no. I want Touch ID to mimic exactly a USB Yubikey so that it works even when developers have no interest in updating their software (I.e. Duo)

Dev action should be minimal. If the site supports hardware factors (Yubikey), it should support Passkey.

https://news.ycombinator.com/item?id=31299230

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#34

Post by iudqnolq »

hamandcheese wrote: post #31
iudqnolq wrote: post #20

Earlier quoted context omitted.

Not quite. A second factor would allow me to reduce the complexity of my password while retaining the same level of security. Without that the only benefit of a Yubikey over a strong password saved in a password manager is phishing protection, which I'm not willing to pay that amount of money for.

Not just phishing - you could lose your password via malware, or if services store passwords in clear text and get hacked.

I use different passwords for every service.

Malware on a device where I'm logged into the service can use that authenticated session to access all the things I want protected.

If the service is hacked, the hacker probably has direct access to everything the password was protecting.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#35

Post by bb88 »

warent wrote: post #4
iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

I think a huge benefit of 2fa, one of the main purposes of it, was for securing accounts with weak passwords. Back in the days before password managers etc. I think these days password managers actually deprecate the need for 2fa

Passwords are an antipattern. Password managers are just a crutch to make it less painful.

Password recovery is often done through the phone via SMS (health care/banking) when a 2FA hardware key would be safer. And since you're implementing 2FA, just remove the password, and ask the user to use the 2FA key.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#36

Post by ivanhoe »

This sort of defeats the idea of 2FA, doesn't it? If it's implemented as a software service on the same device, it's (well theoretically at least) hackable at the same time as the device itself. The 2 factors from 2FA are both accessible to an attacker at the same time, so you effectively have just a single factor auth.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#37

Post by cmdli »

askvictor wrote: post #24

Wouldn't this reduce security considerably, for the scenario where the computer is compromised?

Author here. The credentials are encrypted on-disk with a passphrase, so it wouldn't be trivial extract them, but yes it would be somewhat less secure than a hardware device. I would consider it similar in security to a local password manager. (Note: this software is in beta so I wouldn't yet use it for significant security operations)

Personally, part of the motivation for creating this was to find a middle ground between the most-secure hardware keys and the least-secure password options for authentication. I would argue that requiring users to have hardware is one of the main reasons we only see YubiKeys as a second factor, even though they benefits outside of being based in hardware (namely the lack of phishable passwords).

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#38

Post by bb88 »

askvictor wrote: post #32
iudqnolq wrote: post #26

Earlier quoted context omitted.

Your first example is interesting, but it's much more limited than you describe. The attacker can't use your credentials to authenticate their own session, but they have complete control over the authenticated session on your laptop. I can't think of an account I have where that would be meaningfully less bad.

The attacker has access to all of your authenticated sessions on your compromised laptop. They don't have access to any un-authenticated accounts which have 2FA enabled.

Further because 2FA is simpler, a session can time out in a shorter amount of time.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#39

Post by LelouBil »

iudqnolq wrote: post #29
traceroute66 wrote: post #23

Earlier quoted context omitted.

> I can't figure out why I'd want a Yubikey. Do you use SSH ? Yubikeys are a fabulous way to store SSH keys. Also bear in mind that aside from a secure storage mechanism, Yubkeys can also be configured to require pin and/or touch. Therefore no matter what gets onto your computer, the Yubikey won't provide the answer unless touched.

> Do you use SSH Yes, but not for anything where keeping the SSH private key more secure than my AWS/DigitalOcean credentials would be useful. And I store those credentials in 1Password, which doesn't have a sufficiently mature integration with Yubikey on Linux or Android.

Use Bitwarden, it's a great password manager and it works with yubikey.

You can also self host it fully.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#40

Post by cmdli »

stavros wrote: post #22
cmdli wrote: post #15

Earlier quoted context omitted.

Yup, I built this. The file storage is only for the FIDO2/WebAuthN device, which generates large private keys for each credential; the U2F device keys are small enough that they are actually encrypted/stored in the key identifier that is passed in by the client. I’m currently working on trying to expand this out with new features, as most of the work here was actually emulating the USB device which involved a lot of…

Very nice work! This is one step closer to a password manager that doesn't actually need to store any passwords, just one key. I'm not very familiar with FIDO2, but I thought the private keys for each credential were derived from the single key in the device and the website's domain? Is that not the case? Or are you just generating separate credentials per site and keeping those? If the latter, couldn't you derive al…

Each credential has its own private key which is signed by the device's private key for certification. I am uncertain if the FIDO2 spec says how those private keys need to be generated; right now they are generated randomly but they could easily be generated from a single secret/key, much like you suggest.
Post reply on HN