Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A virtual Yubikey device for 2FA/WebAuthN

github.com

Post reply on HN
Print view View original

91–100 of 143 posts

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#91

Post by tzmudzin »

gitgud wrote: post #90
userbinator wrote: post #66

Earlier quoted context omitted.

It's still a second factor, just one that isn't as isolated as separate physical hardware. It's certainly more secure than a single password, while still giving the user absolute control over it. I can see this being very useful for accounts which are effectively throwaway, but they still force you to 2FA. The same is true of TOTP generators.

Is having 2 passwords to login considered 2-factor? Or single-factor because they're both the same type of authentication...

Same factor.

It‘s always based on the

1) something you know,

2) something you have,

3) something you are

categorisation. Multiple use of a single category still counts as one factor.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#92

Post by ranguna »

iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

> There is a way to use a Yubikey to decrypt Linux full-disk encryption. It relies on an abandoned personal GitHub project

Abandoned?

You do know luks supports FIDO, right?

Here's a small guide on how to do it: https://prose.bentopais.pt/setting-up-trezor-on-arch#luks-un...

You'll also find how to use your key to login to the tty, authenticate to sudo commands and much more.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#93

Post by jbverschoor »

tzmudzin wrote: post #91
gitgud wrote: post #90

Earlier quoted context omitted.

Is having 2 passwords to login considered 2-factor? Or single-factor because they're both the same type of authentication...

Same factor. It‘s always based on the 1) something you know, 2) something you have, 3) something you are categorisation. Multiple use of a single category still counts as one factor.

By that, totp isn't a second factor either.. it's something you know. If it's something you have, that would be the same with passwords.. I don't know them..

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#94

Post by tzmudzin »

jbverschoor wrote: post #93
tzmudzin wrote: post #91

Earlier quoted context omitted.

Same factor. It‘s always based on the 1) something you know, 2) something you have, 3) something you are categorisation. Multiple use of a single category still counts as one factor.

By that, totp isn't a second factor either.. it's something you know. If it's something you have, that would be the same with passwords.. I don't know them..

Technically correct, but the short-hand naming may be misleading here. It’s the physical interaction or hardware dependency that makes the difference.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#95

Post by 5d8767c68926 »

Semaphor wrote: post #83
5d8767c68926 wrote: post #82

Earlier quoted context omitted.

The thing that trips me up is the ability to make backups in the event it is lost/stolen. Seemingly not all services allow registering an additional key, and even if they do, the practicalities of juggling redundant fobs would be cumbersome.

> Seemingly not all services allow registering an additional key I’ve only ever encountered that braindead design with AWS, every other place allows multiple keys. And I can’t say I find multiple keys cumbersome, it’s simply the same procedure again: Click add, insert key and tap the button. Just twice instead of once.

Specifically, I want a backup key off-site. Anytime I enroll a new service, I need to retrieve my backup key from storage for the purposes of enrolling. Depending on how/where the backup is stored (bank box, parent's house across the country, etc) that would make the system less workable in practice.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#96

Post by oezi »

yellow_postit wrote: post #69
iudqnolq wrote: post #12

Earlier quoted context omitted.

Sure: Enough support so that my life becomes sufficiently easier or more secure to be worth the cost. I know that's a bit wishy-washy, but for example I think I could replace my memorized 1password password with something longer if I never had to enter it from memory, which would only be the case if I could use the Yubikey on all my devices.

Mobile access is one of the reasons I hope a near term next gen iPhone has USB-C support directly. The lightning / usbc yubikey dongle is just too unwieldy in my experience.

I use Yubikey NFC and tap it to the back of a Pixel. That is a relatively nice interaction.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#97

Post by gryn »

jbverschoor wrote: post #93
tzmudzin wrote: post #91

Earlier quoted context omitted.

Same factor. It‘s always based on the 1) something you know, 2) something you have, 3) something you are categorisation. Multiple use of a single category still counts as one factor.

By that, totp isn't a second factor either.. it's something you know. If it's something you have, that would be the same with passwords.. I don't know them..

something you have: mobile phone or email address (in which you'll receive the code).

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#98

Post by kevincox »

lazka wrote: post #87
d0ublespeak wrote: post #85

I think this is really cool and a smart way to approach this problem. That being said, the physical isolation of the YubiKey is what makes it useful. Having to physically press a button is the real isolating factor, the interaction is physical and not determined by a piece of software.

Imo that it's not phishable and that there is no secret on the target server is even more useful in practice. And both those properties don't require physical isolation.

To nitpick: s/there is no secret on the target server/the target server never sees the secret/

With proper password storage the target server never keeps the password. It course that is difficult to verify. With U2F the secret can't store a secret they can't see.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#99

Post by kevincox »

jbverschoor wrote: post #93
tzmudzin wrote: post #91

Earlier quoted context omitted.

Same factor. It‘s always based on the 1) something you know, 2) something you have, 3) something you are categorisation. Multiple use of a single category still counts as one factor.

By that, totp isn't a second factor either.. it's something you know. If it's something you have, that would be the same with passwords.. I don't know them..

It depends on how you use passwords and TOTP. I think the expectation is that busy people have a generator on their phone so it is know your password and have your phone.

Of course if you are like me and keep your TOTP secret in your password manager than it is basically the same factor as a password.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#100

Post by jeroenhd »

hamandcheese wrote: post #13
iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

> No 2fa device has sufficient support that it could be used to unlock the lockscreen of any of my devices either. Remember, 2fa is your second factor. It’s right there in the acronym. It is there to protect against a bad actor stealing your password. By definition, a second factor won’t improve the ergonomics of logging in.

This is definitely true but honestly I'd love more websites to switch everything around and use a password for the optional second factor.

Many messenger apps already do something like this (using your phone numbers as a first factor and using an optional password for account protection) and IMO the login flow is much easier for services that I don't care about.

Let me register and login with WebAuthn alone and I'll be very happy. You can even use the same logic you're already using for password resets, just re-enroll the FIDO key when someone clicks "I can't log in" and proces access to their email account. Immune to credential stuffing and many other digital attacks that can happen from the other side of the world while you're asleep!

Post reply on HN