Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A virtual Yubikey device for 2FA/WebAuthN

github.com

Post reply on HN
Print view View original

41–50 of 143 posts

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#41

Post by jklfhfyhjlo »

iudqnolq wrote: post #27
akerl_ wrote: post #19

Earlier quoted context omitted.

I use a yubikey with x509 cert and PIN for local auth to my Mac, and I use it for FIDO2 MFA everywhere that supports it, which includes my email account. That makes my email credentials radically more resistant to phishing, which is huge given that email is part of the recovery story for every other account. If those aren’t enough, I guess yubikeys aren’t the right call for your threat model, which is fine.

I'd love to have that setup. The only problem is insufficiently mature support for the devices I use, Linux and Android. As I mentioned in an edit Yubikey local auth on Linux relies on a personal GitHub project abandoned years ago.

Bah, everything the GP described works perfectly in Linux. Yubikey local auth isn't just one Yubikey specific project. The Yubikey implements a fuckload of open protocols, the vast majority of which work perfectly in Linux.

Want local authentication? pam_u2f, pam_gpg, pam_x509 are all maintained.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#42

Post by gruez »

ivanhoe wrote: post #36

This sort of defeats the idea of 2FA, doesn't it? If it's implemented as a software service on the same device, it's (well theoretically at least) hackable at the same time as the device itself. The 2 factors from 2FA are both accessible to an attacker at the same time, so you effectively have just a single factor auth.

It does, but there's actually a way to do this (ie. u2f without having to buy another device) in a safe way, by using the TPM available on most computers: https://github.com/psanford/tpm-fido

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#43

Post by jabbany »

askvictor wrote: post #24

Wouldn't this reduce security considerably, for the scenario where the computer is compromised?

If the computer is compromised you're screwed either way. Even though WebAuthN can't be easily MITM'd like TOTP codes, someone compromising your computer could just use the UI to lie to you.

I think the main reduction in security is just that the virtual 2FA device is "cloneable" vs a hardware FIDO2 token where IIRC you can't extract the internal secret. So you're getting TOTP levels of 2FA (which also uses a cloneable initialization secret) thru a FIDO2-ish UX which seems like a reasonable thing to want.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#44

Post by bb88 »

iudqnolq wrote: post #18
TrueGeek wrote: post #8

Earlier quoted context omitted.

Every now and then you hear about a leak at some company that was storing passwords in clear text. Thanks to password managers this only affects that one site, but it still makes me thankful for 2FA.

I don't understand the threat model there. Wouldn't nearly all hacks that lead to plain text passwords also allow the hacker to access all the login-protected data, making a more secure login process pointless?

Not necessarily. It's common practice for a hacker to break into a site, grab the passwords, then sell them or release them on the dark web.

The methods they used to break into the site are often considered "trade secrets".

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#45

Post by akerl_ »

iudqnolq wrote: post #27
akerl_ wrote: post #19

Earlier quoted context omitted.

I use a yubikey with x509 cert and PIN for local auth to my Mac, and I use it for FIDO2 MFA everywhere that supports it, which includes my email account. That makes my email credentials radically more resistant to phishing, which is huge given that email is part of the recovery story for every other account. If those aren’t enough, I guess yubikeys aren’t the right call for your threat model, which is fine.

I'd love to have that setup. The only problem is insufficiently mature support for the devices I use, Linux and Android. As I mentioned in an edit Yubikey local auth on Linux relies on a personal GitHub project abandoned years ago.

The other person who replied to this seems to have gotten up on the wrong side of the bed, but the core of their suggestion is one I’d likewise recommend. I’m doing the yubikey local auth using the yubikey’s PIV applet, which holds standard x509 certs that can be used via pkcs11.

You should be able to set up PAM to use them in that way, without needing any yubikey-specific hijinks. Something like https://discourse.ubuntu.com/t/smart-card-authentication/260...

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#46

Post by wyager »

iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

I use it for github, cloudflare, login.gov, etc.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#47

Post by cube2222 »

gruez wrote: post #42
ivanhoe wrote: post #36

This sort of defeats the idea of 2FA, doesn't it? If it's implemented as a software service on the same device, it's (well theoretically at least) hackable at the same time as the device itself. The 2 factors from 2FA are both accessible to an attacker at the same time, so you effectively have just a single factor auth.

It does, but there's actually a way to do this (ie. u2f without having to buy another device) in a safe way, by using the TPM available on most computers: https://github.com/psanford/tpm-fido

This is actually built-in to Safari on newer Macs.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#48

Post by themagician »

iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

I love the Yubikey even if it only locks down a few important accounts. For me, that's Google Accounts and Microsoft Accounts. These are the accounts I worry about this most because they are linked to so many other things.

I wish 1Password offered a high security, security key ONLY mode.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#49

Post by stavros »

cmdli wrote: post #40
stavros wrote: post #22

Earlier quoted context omitted.

Very nice work! This is one step closer to a password manager that doesn't actually need to store any passwords, just one key. I'm not very familiar with FIDO2, but I thought the private keys for each credential were derived from the single key in the device and the website's domain? Is that not the case? Or are you just generating separate credentials per site and keeping those? If the latter, couldn't you derive al…

Each credential has its own private key which is signed by the device's private key for certification. I am uncertain if the FIDO2 spec says how those private keys need to be generated; right now they are generated randomly but they could easily be generated from a single secret/key, much like you suggest.

Ah, right. Yeah, as far as I know, Yubikeys and other devices derive them from a single random value that each device comes with. This is due to the lack of storage space in the devices, as most of them aren't even writable at all.

If you want to switch to deriving keys this way, you could save the storage space and make the program almost stateless. You'd still need the initial random bits, and those could be stored somewhere (they can probably be just 256 bits or so) or come from the user in the form of a passphrase.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#50

Post by psanford »

Nice! I'm the author of tpm-fido[1] which is similar to this but with some different goals. It looks like you've implemented ctap2, which has been on my todo list for tpm-fido (we currently use the ctap1 which works fine but doesn't support newer features used for passkeys/passwordless logins). Great to see other independent implementations!

The question is often asked: isn't this less secure than a physical key or touch-id? The answer is yes, but only marginally. If you have no other access to a FIDO authenticator, using a soft authenticator will still be much better than using SMS,TOTP, or Push. Phishing is the most likely way 2fa will fail you, and this is still phishing resistant.

But passkeys are real and you can essentially use them today! The Android/Chrome integration is already quite good. The Chrome/iOS interaction works but is less smooth right now. That's going to get worked out quite quickly so if you have the option to use passkeys you should!

[1]: https://github.com/psanford/tpm-fido

Post reply on HN