11–20 of 62 posts
Yubikey OTP is much weaker than a good challenge-response protocol like U2F. I assume that Yubico is supporting OTP because iOS only exposes NDEF data, and NDEF is effectively a one-way protocol.
Allowing two way communication would permit innovation in connecting devices that are not subject to Apple's direct control.
If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…
Ok, this is dumb. Real dumb. I would trust (the leaked) secure enclave OS than Yubico's offerings. And the Secure Enclave is already built in, versus this 3rd party hardware. Also, using something like andOTP is perfectly fine to run, which is also a U2F TOTP solution. It integrates perfectly with LinOTP, Google Authenticatior, or other 2fa solutions. In essence, if you're using Linux anywhere, 2fa is free to impleme…
It also has a massive attack surface since you need to secure an Android device. The big win for a dedicated hardware token is that there's so little to attack, along with lesser things like not running out of battery at inconvenient moments.
If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…
Do iPhones allow access to the underlying TPM devices? I personally don't believe things like Google Authenticator are a good "something you have" second factor as the "something you have" is just a string stored in a sqlite database. Much easier to covertly copy that than a hardware key where the string is burned into the key.
https://en.wikipedia.org/wiki/Time-based_One-time_Password_a...
Earlier quoted context omitted.
Do iPhones allow access to the underlying TPM devices? I personally don't believe things like Google Authenticator are a good "something you have" second factor as the "something you have" is just a string stored in a sqlite database. Much easier to covertly copy that than a hardware key where the string is burned into the key.
Yes, iPhones allow storing data that can’t leave the device. Otherwise OTP apps would be pointless. I don’t know the details, but some apps use it to store OTP secrets. Eg. if you use the DUO app, your secrets will be backed up, but they can only be restored on your phone. (was quite a hassle to reset 2FA on all the websites after my phone was replaced in warranty repair) Not sure what Google authenticator does.
Earlier quoted context omitted.
Do iPhones allow access to the underlying TPM devices? I personally don't believe things like Google Authenticator are a good "something you have" second factor as the "something you have" is just a string stored in a sqlite database. Much easier to covertly copy that than a hardware key where the string is burned into the key.
Yes, iPhones allow storing data that can’t leave the device. Otherwise OTP apps would be pointless. I don’t know the details, but some apps use it to store OTP secrets. Eg. if you use the DUO app, your secrets will be backed up, but they can only be restored on your phone. (was quite a hassle to reset 2FA on all the websites after my phone was replaced in warranty repair) Not sure what Google authenticator does.
I know for a fact I can dump Google Authenticator keys from my Android device with root as I'm able to back it up and move it to another device. Theoretically on most Android devices even there's a secure enclave available that could do it, yet I haven't seen any apps use it.
Most of the benefit of OTPs really comes from approving on a secondary device rather than protecting the keys to an absolute degree though, so this is probably of little concern to most users. In fact it may provide a convenience benefit, I like being able to backup and move my keys, without that I probably wouldn't use 2FA at all.
Earlier quoted context omitted.
Do iPhones allow access to the underlying TPM devices? I personally don't believe things like Google Authenticator are a good "something you have" second factor as the "something you have" is just a string stored in a sqlite database. Much easier to covertly copy that than a hardware key where the string is burned into the key.
Google Authenticator is not a password storage app. It produces time-based hashes that expire every 60 seconds. https://en.wikipedia.org/wiki/Time-based_One-time_Password_a...
Earlier quoted context omitted.
Yes, iPhones allow storing data that can’t leave the device. Otherwise OTP apps would be pointless. I don’t know the details, but some apps use it to store OTP secrets. Eg. if you use the DUO app, your secrets will be backed up, but they can only be restored on your phone. (was quite a hassle to reset 2FA on all the websites after my phone was replaced in warranty repair) Not sure what Google authenticator does.
Are iOS Authenticator apps actually calculating OTPs on the Secure Element? Is there a way to execute arbitrary code on it? If not, they have to pull the keys off to the main CPU where they're open to attack like anything else. Still secured as private app data, still mostly protected, but an attacker with a jailbreak could still dump them. I know for a fact I can dump Google Authenticator keys from my Android device…
https://developer.apple.com/documentation/security/certifica...
AFAIK that means it'll take more than a jailbreak to get to them, although I don't know if OTP apps are using that capability or not.
If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…
I could see using a yubikey stored securely in your house for just this reason and relying on the secure element in your phone for everything else. If course if you have two phones, or a computer with a secure element (like the new MacBook Pro) you could just use your other device to authenticate.
Earlier quoted context omitted.
Are iOS Authenticator apps actually calculating OTPs on the Secure Element? Is there a way to execute arbitrary code on it? If not, they have to pull the keys off to the main CPU where they're open to attack like anything else. Still secured as private app data, still mostly protected, but an attacker with a jailbreak could still dump them. I know for a fact I can dump Google Authenticator keys from my Android device…
Using the secure enclave, you (as a developer) can have it generate a private key you'll never be able to get and then ask it to sign / encrypt (symmetrically) arbitrary things for you. https://developer.apple.com/documentation/security/certifica... AFAIK that means it'll take more than a jailbreak to get to them, although I don't know if OTP apps are using that capability or not.