Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A virtual Yubikey device for 2FA/WebAuthN

github.com

Post reply on HN
Print view View original

111–120 of 143 posts

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#111

Post by xani_ »

iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

You can use Yubikeys(most of them, the cheapest ones don't have that feature IIRC) as smartcards in addition to other features.

You can use smartcard in linux as both GPG key, and SSH key (via GPG SSH agent).

Which means leaking your private key for SSH is essentially impossible, as key can be generated on device which means it never leaves it, even if your machine gets compromised

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#112

Post by xani_ »

snadal wrote: post #65
hamandcheese wrote: post #61

Earlier quoted context omitted.

> Malware on a device where I'm logged into the service can use that authenticated session to access all the things I want protected. Any well-secured service should protect critical actions with 2fa. “oh, are you sure you want to transfer all your funds? Please re-authenticate first”

So if your device is compromised, the attacker could trick you into entering 2FA for some minor action while it actually is transferring all your funds. If your PC or smartphone is compromised nothing will prevent you from losing control of your accounts.

That's kinda problem of many 2FA systems, my bank's send me the reason for 2FA and amount + last few digits of account if it is money transactions.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#113

Post by xani_ »

jabbany wrote: post #43
askvictor wrote: post #24

Wouldn't this reduce security considerably, for the scenario where the computer is compromised?

If the computer is compromised you're screwed either way. Even though WebAuthN can't be easily MITM'd like TOTP codes, someone compromising your computer could just use the UI to lie to you. I think the main reduction in security is just that the virtual 2FA device is "cloneable" vs a hardware FIDO2 token where IIRC you can't extract the internal secret. So you're getting TOTP levels of 2FA (which also uses a cloneab…

If someone uses my computer to lie to me about bank transaction, SMS 2FA still shows amount and type of transaction. That's kinda a problem with few of the 2FAs, there is no context attached to code

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#114

Post by ivanhoe »

ivanhoe wrote: post #36

This sort of defeats the idea of 2FA, doesn't it? If it's implemented as a software service on the same device, it's (well theoretically at least) hackable at the same time as the device itself. The 2 factors from 2FA are both accessible to an attacker at the same time, so you effectively have just a single factor auth.

To reiterate after giving it a bit more thought, this actually could be very useful if combined with fingerprint or facial detection as approval method - a bit like what Apple is now doing with passkeys, but will work with many more services out-of-box...

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#115

Post by pas »

oneplane wrote: post #105
jbverschoor wrote: post #93

Earlier quoted context omitted.

By that, totp isn't a second factor either.. it's something you know. If it's something you have, that would be the same with passwords.. I don't know them..

TOTP is a second factor because you can't store it in your mind (and therefore it's not something you know, but something you have to have). You could defeat that using this virtual FIDO project or by storing the secret in readable format in a password manager that itself can be unlocked with your knowledge, but if we're just trying to find ways to use factors in a way that makes them useless, you can also just store…

I store both passwords and 2FA in an automated software. 2FA seeds can be exported (eg. when moving to a new phone).

the categorization makes some minimal sense, but basically any additional not-identical "factor" is additional security (though there's obviously a diminishing return because of the complexity-vs-security trade off).

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#117

Post by rzzzt »

sbdncuvh wrote: post #107
talkingtab wrote: post #106

This is my problem with fido/yubikey's and WebAuthN, etc. Somehow Fido and Yubikey have become intermixed and conflated. Like kleenex - one brand of facial tissue has become the common name for something that is or should be a commodity product. The top picks for me when I search for "yubikey" on amazon are all ~$55 USD. When I search for "fido2" the top picks are ~$24 USD. This article is about Yubikeys. Or is it. T…

You could start by saying smartphone, but that was probably intentional.

Robocop is an Android, and the spike extending from his knuckle was used in the film as an authentication device.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#118

Post by azornathogron »

UncleEntity wrote: post #108
talkingtab wrote: post #106

This is my problem with fido/yubikey's and WebAuthN, etc. Somehow Fido and Yubikey have become intermixed and conflated. Like kleenex - one brand of facial tissue has become the common name for something that is or should be a commodity product. The top picks for me when I search for "yubikey" on amazon are all ~$55 USD. When I search for "fido2" the top picks are ~$24 USD. This article is about Yubikeys. Or is it. T…

> It seems like getting this to run on an Android would be significantly more functional (no extra device) and cheaper. That’s basically Google Authenticator. Didn’t RTFA as I know the algorithm is just one line of python using built-in libraries (which is how I generate passwords minus the time-based part).

> Didn’t RTFA as I know the algorithm is just one line of python using built-in libraries

Time-based OTP (TOTP), which is what Google Authenticator implements, is not the same as FIDO U2F. They use different underlying mechanisms and have different security properties.

TOTP relies on a shared secret key to generate a matching code on client & server. FIDO U2F uses a challenge-response protocol and incorporates the domain of the requesting website (the domain as verified by TLS certificate) into the challenge to ensure that the response is _only_ valid when it was requested directly from the correct website. This prevents phishing attacks, which TOTP does not.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#119

Post by Sephr »

talkingtab wrote: post #106

This is my problem with fido/yubikey's and WebAuthN, etc. Somehow Fido and Yubikey have become intermixed and conflated. Like kleenex - one brand of facial tissue has become the common name for something that is or should be a commodity product. The top picks for me when I search for "yubikey" on amazon are all ~$55 USD. When I search for "fido2" the top picks are ~$24 USD. This article is about Yubikeys. Or is it. T…

> This article is about Yubikeys. Or is it. The project itself is "virtual-fido".

It would be unwise for the author to use the Yubikey trademark in their project name.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#120

Post by nickzana »

talkingtab wrote: post #106

This is my problem with fido/yubikey's and WebAuthN, etc. Somehow Fido and Yubikey have become intermixed and conflated. Like kleenex - one brand of facial tissue has become the common name for something that is or should be a commodity product. The top picks for me when I search for "yubikey" on amazon are all ~$55 USD. When I search for "fido2" the top picks are ~$24 USD. This article is about Yubikeys. Or is it. T…

That's essentially what passkeys are: a consumer-friendly name for on-device FIDO keys you can use over webauthn, along with (in the apple/google/Microsoft case) a mechanism for syncing/backup/recovery provided by your platform account provider. The keys are still backed by hardware, but instead of an external key it uses the internal platform security module (TPM, Secure Enclave, etc.)

You can use your phone without the syncing part to authenticate other device through a mix of a QR code, a tunnel server, and Bluetooth.

Post reply on HN