Thanks, appreciate the package. I submitted a PR as I was also looking for a Go package similar to this, and wanted to make using this as a library a bit easier. I plan on using this to automate some website login/authentication flows, where physical tokens are (for obvious reasons) not really a possibility.
Show HN: A virtual Yubikey device for 2FA/WebAuthN
131–140 of 143 posts
Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN
#132This sort of defeats the idea of 2FA, doesn't it? If it's implemented as a software service on the same device, it's (well theoretically at least) hackable at the same time as the device itself. The 2 factors from 2FA are both accessible to an attacker at the same time, so you effectively have just a single factor auth.
Actually if your PC is compromised, then bad guy can exploit even hardware Yubi, because Yubikey lacks any screen, only button.
Adversary can intercept your login in MITM style, authorize themselves on other machine, just using your machine as proxy, and website you tried to login to would just display error "can't authenticate, try again".
And thangs to fact that key lacks display, attacker can event authenticate to different site, than you are authenticating now.
Trezor is way better device here:
> Phishing protection with on-screen verification. Trezor always displays the URL of the website the user wants to log in to, and what exactly is going to be authorized; therefore it is possible to verify that what was sent to the device is what is expected.
https://wiki.trezor.io/U2F https://wiki.trezor.io/FIDO2
And it supports U2F and FIDO2 (FIDO2 requires more expensive, newer model).
P.S. storing locally in TPM is bit more secure, but still exploitable in case of local privileged code execution.
Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN
#133This sort of defeats the idea of 2FA, doesn't it? If it's implemented as a software service on the same device, it's (well theoretically at least) hackable at the same time as the device itself. The 2 factors from 2FA are both accessible to an attacker at the same time, so you effectively have just a single factor auth.
It does, but there's actually a way to do this (ie. u2f without having to buy another device) in a safe way, by using the TPM available on most computers: https://github.com/psanford/tpm-fido
By the way, I like that tpm-fido is using uhid instead of USB/IP, because USB/IP doesn't have any security and authentication. At least we can restrict what user can create uhid host process etc.
But USB/IP seems very insecure!
Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN
#134Earlier quoted context omitted.
Can you use the Yubikey as a keyboard on iOS?
Not sure if this answers your question, but you can use a Yubikey for FIDO2 on iOS with any iOS device with a USB port, or use the camera connection kit to make one on a Lightning port device. Source: I was curious, so I used a camera connection kit to login to Okta with a Yubikey as my MFA last month.
I was curious about the use case of using a YubiKey to unlock 1Password.
Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN
#135Earlier quoted context omitted.
That is the hid mode parent is mentionning. With ykman you can configure the Yubikey to simulate being a USB keyboard (Human Interface Device) and then "type" a static password. The default setting is to type a Yubico specific OTP that can be checked by calling an API. The issue with the static password is that anybody getting near the yubikey with a device having a USB port can steal the password in seconds.
And any accidental button-press while in a chat-app or website will leak your password. I've seen many yubikey otp's accidentally pasted into irc, if you set it to password, you just posted that. I'd never recommend using that mode.
Never happened to me since I use the slot 2 and it requires a long press.
Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN
#136Earlier quoted context omitted.
I do something similar with pass, pass-otp and browserpass. Looking forward to using virtual-fido because I do not want non-free hardware keys. https://github.com/browserpass/ https://github.com/tadfisher/pass-otp https://www.passwordstore.org/
Are you familiar with https://solokeys.com/ ?
I don't remember the details but some aspect of their behavior turned me off them. I'm also not sure I want a physical device at all.
Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN
#137Earlier quoted context omitted.
I store both passwords and 2FA in an automated software. 2FA seeds can be exported (eg. when moving to a new phone). the categorization makes some minimal sense, but basically any additional not-identical "factor" is additional security (though there's obviously a diminishing return because of the complexity-vs-security trade off).
> I store both passwords and 2FA in an automated software. This effectively reduces the 2nd factor to the first, and indeed produces the diminishing return. It's sufficient to hack one system using one method and you compromise both defenses. The point behind 2nd factor is to provide a second, *independent* layer of protection that would need to be compromised using an entirely different attack. In the case of the FI…
Um, excuse my shoddy phrasing. I meant a desktop password manager and a mobile TOTP manager. Both are software, but they are not "a software", sorry.
But yes, recently I have seen people use password managers that really do both in one single piece of software (a browser extension).
I have a few U2F hardware devices, they are convenient when set up and plugged in, rather inconvenient otherwise :/
Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN
#138Earlier quoted context omitted.
I do something similar with pass, pass-otp and browserpass. Looking forward to using virtual-fido because I do not want non-free hardware keys. https://github.com/browserpass/ https://github.com/tadfisher/pass-otp https://www.passwordstore.org/
Whoa. I'd never dived into the whole hardware key thing because I never felt like I needed it -- except one (AND ONLY ONE) of my 2FA deals requires a specific app (i.e. they won't give you your generating token, you have to use Duo Mobile or a device). As I'm seeing it, "virtual-fido" will let me fake a hardware device and get me so that I only need the laptop for 2FA? Gotta look into this.
Right. virtual-fido is similar to Apple Passkeys in that respect.
Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN
#139The entire point of something you have is that it's physical and can't be copied. This isn't something you have, it's something you know with multiple layers of obscurity on top of it.
Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN
#140Earlier quoted context omitted.
If the computer is compromised you're screwed either way. Even though WebAuthN can't be easily MITM'd like TOTP codes, someone compromising your computer could just use the UI to lie to you. I think the main reduction in security is just that the virtual 2FA device is "cloneable" vs a hardware FIDO2 token where IIRC you can't extract the internal secret. So you're getting TOTP levels of 2FA (which also uses a cloneab…
They could, but it's still limiting - the maximum number of challenges the attacker is able to satisfy is the number of times you touch the token before you realise that something's up.
Based on a certain recent high profile hack, getting just one 2FA auth this way could already be enough ;-)
I doubt most people would be suspicious if their system prompted them to touch their key, they touched it, the software kept waiting, so they touch it again and it works this time.