Just to be clear, "Yubikey" is a brand of FIDO key. See:
https://fidoalliance.org. You can find other brands which in my experience, are just as functional but often less expensive. I have a yubikey, one from hyperfido and most interesting is the open source 'U2F zero'. All of them work equally well. Unless MS has a non-standard implementation or does not use FIDO, then any FIDO would work.
YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
11–20 of 45 posts
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#12Earlier quoted context omitted.
How useful is that, really, considering you couldn't possibly use a Yubikey to configure disk encryption? Unless you actually put the unlock key on the Yubikey somehow (I've never heard of someone attempting or succeeding at that), anyone with physical access - which is what this is intended to protect against - could still wreak all kinds of havoc with disk access. It's certainly easier and may even be safer (in the…
With FileVault, the disk won't decrypt until the user enters their login password. Here's Yubico's documentation on Filevault integration: https://www.yubico.com/support/knowledge-base/categories/art... It seems an attacker with physical access still requires your password to unlock the disk. At that point, they'd need the Yubikey to login (assuming they haven't already decrypted the disk and taken your data). Someon…
Furthermore, just encrypt your disk with a password concatenated with said static yubikey password and you've got effective MFA.
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#13Just to be clear, "Yubikey" is a brand of FIDO key. See: https://fidoalliance.org . You can find other brands which in my experience, are just as functional but often less expensive. I have a yubikey, one from hyperfido and most interesting is the open source 'U2F zero'. All of them work equally well. Unless MS has a non-standard implementation or does not use FIDO, then any FIDO would work.
[deleted]
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#14Just to be clear, "Yubikey" is a brand of FIDO key. See: https://fidoalliance.org . You can find other brands which in my experience, are just as functional but often less expensive. I have a yubikey, one from hyperfido and most interesting is the open source 'U2F zero'. All of them work equally well. Unless MS has a non-standard implementation or does not use FIDO, then any FIDO would work.
If we really want to be clear, a Yubikey is a token capable of running applets including, but not limited to FIDO U2F. Other applets commonly used include PIV (pkcs11), OpenPGP, OATH, and Yubi's own OTP applet.
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#15Earlier quoted context omitted.
With FileVault, the disk won't decrypt until the user enters their login password. Here's Yubico's documentation on Filevault integration: https://www.yubico.com/support/knowledge-base/categories/art... It seems an attacker with physical access still requires your password to unlock the disk. At that point, they'd need the Yubikey to login (assuming they haven't already decrypted the disk and taken your data). Someon…
Furthermore, just encrypt your disk with a password concatenated with said static yubikey password and you've got effective MFA.
I feel like a static password doesn't really count as MFA. Someone can keylog that static password without you knowing.
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#16Just to be clear, "Yubikey" is a brand of FIDO key. See: https://fidoalliance.org . You can find other brands which in my experience, are just as functional but often less expensive. I have a yubikey, one from hyperfido and most interesting is the open source 'U2F zero'. All of them work equally well. Unless MS has a non-standard implementation or does not use FIDO, then any FIDO would work.
This is the part I don't understand... the Yubikey U2F-only option (1/2 the price) is not listed as supported by this application.
As best I can tell, U2F as it is used today isn't supported by Windows Hello; this is a custom app to support the more advanced Yubikey products.
Apparently there is some v2 of U2F coming down the pike that vendors are waiting for before implementing support; however, I couldn't find much information on how this currently affects Windows Hello:
https://groups.google.com/a/fidoalliance.org/forum/#!topic/f...
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#17Earlier quoted context omitted.
How useful is that, really, considering you couldn't possibly use a Yubikey to configure disk encryption? Unless you actually put the unlock key on the Yubikey somehow (I've never heard of someone attempting or succeeding at that), anyone with physical access - which is what this is intended to protect against - could still wreak all kinds of havoc with disk access. It's certainly easier and may even be safer (in the…
I wonder if one of the coreboot/openboot/whatever could implement that. I don't know enough about that part of the stack to know whose responsibility it is to implement it.
I don't think the BIOS is responsible for this kind of stuff.
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#18Earlier quoted context omitted.
You lose it and it's gone. You can't remove credentials on the device. This is why you buy two, register both, and save one in a safe. EDIT: I mean you can't copy credentials off in most cases, like this one. Credentials can be replaced.
If you program your own keys into the Yubi, then you know them and can archive them for reprogramming on another device. You can do this with the Yubi Personalisation tool [1] for a few modes the device supports. [1] https://www.yubico.com/products/services-software/personaliz...
Eh. Hence why I said it like I did. In most cases, the device generates the secrets. And that's how it should be done, it guarantees that they can't be compromised easily (vs if someone compromised wherever you backed up those keys to).
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#19And apparently with macOS Sierra it's possible to once again use a Yubikey to configure login on a Mac. I'd missed that news, will have to go dig mine out of the drawer!
It's interesting what direction Yubico will go with the new Macs having no USB A port.
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#20Just to be clear, "Yubikey" is a brand of FIDO key. See: https://fidoalliance.org . You can find other brands which in my experience, are just as functional but often less expensive. I have a yubikey, one from hyperfido and most interesting is the open source 'U2F zero'. All of them work equally well. Unless MS has a non-standard implementation or does not use FIDO, then any FIDO would work.
No it is not. There are yubikeys that implement U2F but Yubikeys also provide more. In this case, their specific U2F key is not listed as requirement. So this is most likely not implemented using U2F.