Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebAuthN and Fido for Linux

github.com

Post reply on HN
Print view View original

21–22 of 22 posts

Re: WebAuthN and Fido for Linux

#21

Post by Borealid »

ranguna wrote: post #19
Borealid wrote: post #17

Earlier quoted context omitted.

I bet you're using U2F/FIDO1. Or, more precisely, I bet you're not using CTAP2. An easy test is to set a PIN on your authenticator, which is an operation that is supported in CTAP2 and unsupported in CTAP1. Does Firefox prompt you for a PIN when you go to authenticate? If no, you're using CTAP1.

My token has a global pin which when o unlock, I can authorise any request with a simple click. But for ssh keys I do have a pin for each one. The websites I've tried never requested for a pin when setting up. Also LUKS does use FIDO2 https://www.freedesktop.org/software/systemd/man/systemd-cry...

Firefox (only talking about Firefox here) does not use CTAP2, to the best of my knowledge. What you think is "FIDO2" is likely actually U2F/CTAP1. Backwards compatibility with that protocol is part of the FIDO2 spec, but it doesn't enable no-username-provided authentication. LUKS uses libfido2, which supports CTAP2 (and most of CTAP2.1).

Re: WebAuthN and Fido for Linux

#22

Post by notpushkin »

roblabla wrote: post #11
michaelt wrote: post #10

Earlier quoted context omitted.

Yeah, but that only sandboxes the applications that opt in. If you want to stop malicious applications from doing malicious things, even when the system owner unwisely grants them permission, you need mandatory sandboxing that the system owner can't bypass. And that isn't compatible with the free software ethos.

I don't think that's necessarily true. All you need is default-on sandboxing that is "painfully obviously wrong" for the system owner to bypass. As a case in point, look at macOS. You can bypass almost every security feature in macOS by rebooting to recovery and disabling CSR, AMFI and whatnot. And even after disabling all this, touchID will still work, and I believe it will still be accepted as a platform authentica…

This exactly. Bypassing sandbox should be like installing software from tarball as opposed to package managers: possible but pretty much discouraged, an “escape hatch” of sorts.
Post reply on HN