Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A virtual Yubikey device for 2FA/WebAuthN

github.com

Post reply on HN
Print view View original

81–90 of 143 posts

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#81

Post by computerfriend »

pabs3 wrote: post #71
jrm4 wrote: post #64

So, curious. Anyone here do what I do, a simple encrypted Linux volume + "oathtool" powered script? Yeah, I know, same device, blah blah. I'm still pretty comfortable with it and I just don't like having this stuff on my phone, which perpetually feels less safe.

I do something similar with pass, pass-otp and browserpass. Looking forward to using virtual-fido because I do not want non-free hardware keys. https://github.com/browserpass/ https://github.com/tadfisher/pass-otp https://www.passwordstore.org/

Are you familiar with https://solokeys.com/?

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#82

Post by 5d8767c68926 »

iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

The thing that trips me up is the ability to make backups in the event it is lost/stolen. Seemingly not all services allow registering an additional key, and even if they do, the practicalities of juggling redundant fobs would be cumbersome.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#83

Post by Semaphor »

5d8767c68926 wrote: post #82
iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

The thing that trips me up is the ability to make backups in the event it is lost/stolen. Seemingly not all services allow registering an additional key, and even if they do, the practicalities of juggling redundant fobs would be cumbersome.

> Seemingly not all services allow registering an additional key

I’ve only ever encountered that braindead design with AWS, every other place allows multiple keys.

And I can’t say I find multiple keys cumbersome, it’s simply the same procedure again: Click add, insert key and tap the button. Just twice instead of once.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#84

Post by vertis »

Anunayj wrote: post #63
ivanhoe wrote: post #36

This sort of defeats the idea of 2FA, doesn't it? If it's implemented as a software service on the same device, it's (well theoretically at least) hackable at the same time as the device itself. The 2 factors from 2FA are both accessible to an attacker at the same time, so you effectively have just a single factor auth.

I'm a little confused here, but I thought 2fa was a combination of something I know (A password) and something I have (A authenticator). So a attacker getting access to your computer is same as them getting access to your authenticator? Or do you mean that this leaves the secrets vulnerable to spyware and stuff? Cause in that case as the other comment says, one could use the TPM.

A good example here is 1Password, which stores passwords and also allows storing TOTP.

Which means the something I know is stored in the same places as something I have. Granted it is protected by encryption, and another password, but it definitely increases the attack surface.

If the computer is compromised it becomes much more possible to get access to both of these items than if it was a security key, physical authenticator or even on a different device.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#85

Post by d0ublespeak »

I think this is really cool and a smart way to approach this problem. That being said, the physical isolation of the YubiKey is what makes it useful. Having to physically press a button is the real isolating factor, the interaction is physical and not determined by a piece of software.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#86

Post by vertis »

iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

I've found the Yubikey to be an incredibly easy way to do 2FA. I use a usb-c nano version and it pretty much never leaves my mac (and the mac never leaves me). I've found it faster to do 2FA on a large number of tech websites. Just touch the key and you're done.

I know 1Password can fill TOTP for you, but I like having my security spread across 1Password and Yubikey. In the unlikely event 1Password gets compromised they still need physical access to my computer.

I don't log onto the mac with Yubikey and it has full-disk encryption turned on, so I'm pretty happy with the attack surface.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#87

Post by lazka »

d0ublespeak wrote: post #85

I think this is really cool and a smart way to approach this problem. That being said, the physical isolation of the YubiKey is what makes it useful. Having to physically press a button is the real isolating factor, the interaction is physical and not determined by a piece of software.

Imo that it's not phishable and that there is no secret on the target server is even more useful in practice. And both those properties don't require physical isolation.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#88

Post by loulouxiv »

taubek wrote: post #80
nick__m wrote: post #54

Earlier quoted context omitted.

I use 1Password and 2 Yubikey. Both yubikeys are configured to enter the same impossible to memorize password on a press to unlock 1Password, hid mode is supported by every device with a USB ports. I also use them as an otp second factor when a site requires it. Finally, they are configured with a x509 certificate that I use as my ssh keys. I generate one key per devices that way the secret never leaves it and I requ…

How do you configure Yubikey to enter password for unlocking 1password? Is this a Yubikey feature or 1password feature? Does this also work with mobile devices (phones)?

That is the hid mode parent is mentionning. With ykman you can configure the Yubikey to simulate being a USB keyboard (Human Interface Device) and then "type" a static password. The default setting is to type a Yubico specific OTP that can be checked by calling an API. The issue with the static password is that anybody getting near the yubikey with a device having a USB port can steal the password in seconds.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#89

Post by tzmudzin »

yellow_postit wrote: post #69
iudqnolq wrote: post #12

Earlier quoted context omitted.

Sure: Enough support so that my life becomes sufficiently easier or more secure to be worth the cost. I know that's a bit wishy-washy, but for example I think I could replace my memorized 1password password with something longer if I never had to enter it from memory, which would only be the case if I could use the Yubikey on all my devices.

Mobile access is one of the reasons I hope a near term next gen iPhone has USB-C support directly. The lightning / usbc yubikey dongle is just too unwieldy in my experience.

NFC-capable dongles work great for this.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#90

Post by gitgud »

userbinator wrote: post #66
ivanhoe wrote: post #36

This sort of defeats the idea of 2FA, doesn't it? If it's implemented as a software service on the same device, it's (well theoretically at least) hackable at the same time as the device itself. The 2 factors from 2FA are both accessible to an attacker at the same time, so you effectively have just a single factor auth.

It's still a second factor, just one that isn't as isolated as separate physical hardware. It's certainly more secure than a single password, while still giving the user absolute control over it. I can see this being very useful for accounts which are effectively throwaway, but they still force you to 2FA. The same is true of TOTP generators.

Is having 2 passwords to login considered 2-factor? Or single-factor because they're both the same type of authentication...
Post reply on HN