Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A virtual Yubikey device for 2FA/WebAuthN

github.com

Post reply on HN
Print view View original

101–110 of 143 posts

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#101

Post by taubek »

loulouxiv wrote: post #88
taubek wrote: post #80

Earlier quoted context omitted.

How do you configure Yubikey to enter password for unlocking 1password? Is this a Yubikey feature or 1password feature? Does this also work with mobile devices (phones)?

That is the hid mode parent is mentionning. With ykman you can configure the Yubikey to simulate being a USB keyboard (Human Interface Device) and then "type" a static password. The default setting is to type a Yubico specific OTP that can be checked by calling an API. The issue with the static password is that anybody getting near the yubikey with a device having a USB port can steal the password in seconds.

Thank you for explanation! I wasn't aware of this feature.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#102

Post by alrlroipsp »

gruez wrote: post #59
mjg59 wrote: post #57

Earlier quoted context omitted.

Unfortunately without additional hardware support it's hard to tie TPM FIDO to physical user presence, which means compromising the system doesn't give you access to the secrets but does let you sign as many challenges as you want without user involvement.

Realistically speaking if your machine is compromised it's effectively game over. If you're signing into services on a daily basis an attacker wouldn't have to wait long to piggy back off a legitimate request. The chances that you catch the compromise before that happens is slim.

Exactly. This is why 2FA is being discussed, and this software breaking 2FA.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#103

Post by [deleted] »

iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

[deleted]

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#104

Post by sig-io »

loulouxiv wrote: post #88
taubek wrote: post #80

Earlier quoted context omitted.

How do you configure Yubikey to enter password for unlocking 1password? Is this a Yubikey feature or 1password feature? Does this also work with mobile devices (phones)?

That is the hid mode parent is mentionning. With ykman you can configure the Yubikey to simulate being a USB keyboard (Human Interface Device) and then "type" a static password. The default setting is to type a Yubico specific OTP that can be checked by calling an API. The issue with the static password is that anybody getting near the yubikey with a device having a USB port can steal the password in seconds.

And any accidental button-press while in a chat-app or website will leak your password. I've seen many yubikey otp's accidentally pasted into irc, if you set it to password, you just posted that. I'd never recommend using that mode.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#105

Post by oneplane »

jbverschoor wrote: post #93
tzmudzin wrote: post #91

Earlier quoted context omitted.

Same factor. It‘s always based on the 1) something you know, 2) something you have, 3) something you are categorisation. Multiple use of a single category still counts as one factor.

By that, totp isn't a second factor either.. it's something you know. If it's something you have, that would be the same with passwords.. I don't know them..

TOTP is a second factor because you can't store it in your mind (and therefore it's not something you know, but something you have to have). You could defeat that using this virtual FIDO project or by storing the secret in readable format in a password manager that itself can be unlocked with your knowledge, but if we're just trying to find ways to use factors in a way that makes them useless, you can also just store them in a pastebin, it's free and all you need on any computer is to just visit your paste url!

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#106

Post by talkingtab »

This is my problem with fido/yubikey's and WebAuthN, etc. Somehow Fido and Yubikey have become intermixed and conflated. Like kleenex - one brand of facial tissue has become the common name for something that is or should be a commodity product. The top picks for me when I search for "yubikey" on amazon are all ~$55 USD. When I search for "fido2" the top picks are ~$24 USD.

This article is about Yubikeys. Or is it. The project itself is "virtual-fido".

I am sure that it is in Yubico's best interest to promote Yubikeys. And for the enterprise this is probably good. But in my opinion it is a barrier to the adoption of fido. Which is unfortunate.

I wonder if there is a way to use an iPhone or Android as a Yubikey. Oops, I mean Fido device. Anyone have an idea of how to do that? It seems like getting this to run on an Android would be significantly more functional (no extra device) and cheaper.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#107

Post by sbdncuvh »

talkingtab wrote: post #106

This is my problem with fido/yubikey's and WebAuthN, etc. Somehow Fido and Yubikey have become intermixed and conflated. Like kleenex - one brand of facial tissue has become the common name for something that is or should be a commodity product. The top picks for me when I search for "yubikey" on amazon are all ~$55 USD. When I search for "fido2" the top picks are ~$24 USD. This article is about Yubikeys. Or is it. T…

You could start by saying smartphone, but that was probably intentional.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#108

Post by UncleEntity »

talkingtab wrote: post #106

This is my problem with fido/yubikey's and WebAuthN, etc. Somehow Fido and Yubikey have become intermixed and conflated. Like kleenex - one brand of facial tissue has become the common name for something that is or should be a commodity product. The top picks for me when I search for "yubikey" on amazon are all ~$55 USD. When I search for "fido2" the top picks are ~$24 USD. This article is about Yubikeys. Or is it. T…

> It seems like getting this to run on an Android would be significantly more functional (no extra device) and cheaper.

That’s basically Google Authenticator.

Didn’t RTFA as I know the algorithm is just one line of python using built-in libraries (which is how I generate passwords minus the time-based part).

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#109

Post by xani_ »

ivanhoe wrote: post #36

This sort of defeats the idea of 2FA, doesn't it? If it's implemented as a software service on the same device, it's (well theoretically at least) hackable at the same time as the device itself. The 2 factors from 2FA are both accessible to an attacker at the same time, so you effectively have just a single factor auth.

Yes it is for security, but it could be useful for testing

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#110

Post by xani_ »

gryn wrote: post #97
jbverschoor wrote: post #93

Earlier quoted context omitted.

By that, totp isn't a second factor either.. it's something you know. If it's something you have, that would be the same with passwords.. I don't know them..

something you have: mobile phone or email address (in which you'll receive the code).

The e-mail thing is a bit silly; sure, if someone leaks your password you're safe but if your device is compromised there is good chance attacker have access to your e-mail too
Post reply on HN