Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using FIDO keys

777.tf

Post reply on HN
Print view View original

11–20 of 65 posts

Re: Using FIDO keys

#11

Post by navigate8310 »

seymon wrote: post #8

What do you think about the german Nitrokeys? Especially the features and compatibility of the Nitrokey 3? Anyone has one of those? https://www.nitrokey.com/products/nitrokeys

One thing to keep in mind before buying their NFC keys is that it can only store up to 10 resident keys

Re: Using FIDO keys

#12

Post by jaefi »

spiridow wrote: post #10

My colleague and I recently gave a workshop about security keys where we tried to answer questions like: * Why should I use a security key? * What is it used for? * How can I choose one ? * What features should I look for? We did cover FIDO2/Passkeys but also multiple other use cases. Here are the slides if you're interested: https://tome.one/slides/amiet-pelissier-security-keys-worksh...

Oh that's interesting, thanks for linking it!

Re: Using FIDO keys

#13

Post by lemper »

i use security key by yubikey (blue one, USB A) as one of the mfa. mostly for github and aws. and i personally like the "cool factor" when I have to "look" for the key when the sites ask for it. "bro, what are ya doing ya dingus?" "i literally can't login without the key, bro. like a real renter in a saas world!"

Re: Using FIDO keys

#14

Post by aidenn0 »

navigate8310 wrote: post #11
seymon wrote: post #8

What do you think about the german Nitrokeys? Especially the features and compatibility of the Nitrokey 3? Anyone has one of those? https://www.nitrokey.com/products/nitrokeys

One thing to keep in mind before buying their NFC keys is that it can only store up to 10 resident keys

Yubikey 5 can only store 20, which isn't a whole lot better. Are there yet any readily available FIDO devices that can store 100s of resident keys (I have almost 400 logins in bitwarden)?

Re: Using FIDO keys

#15

Post by aborsy »

This space is confusing. FIDO2, U2F, UAF, CTAP, WebAuth, Passkey, 2FA, … The names frequently change.

Aren’t all of them just public key authentication (with the private key in a mini-HSM, and public key either calculated in real-time, or stored, in the HSM, and synced externally)?

Re: Using FIDO keys

#16

Post by ok_dad »

rpicard wrote: post #7
ok_dad wrote: post #6

I use an old Google Titan key, not the bluetooth model but the regular one, as my backup (it was my primary) and a Yubikey 5 for my primary. I like the peace of mind that they give me that no one can steal my password and login to my important accounts, but I found that certain providers only allow a single 2FA to be used, with no backup, so I don't feel good using them there (AWS, what the F?) and also I find that n…

AWS IAM supports multiple keys now! I think this was a blocker for using hardware keys on AWS for a bunch of organizations. https://aws.amazon.com/about-aws/whats-new/2022/11/aws-ident...

Cool! Thanks for letting me know!

Re: Using FIDO keys

#17

Post by dandanua »

navigate8310 wrote: post #11
seymon wrote: post #8

What do you think about the german Nitrokeys? Especially the features and compatibility of the Nitrokey 3? Anyone has one of those? https://www.nitrokey.com/products/nitrokeys

One thing to keep in mind before buying their NFC keys is that it can only store up to 10 resident keys

I don't think resident keys are that worthwhile. Relaying party anyway has to remember the user somehow, even if it's just the public key. And it still has to associate the key with the user data.

I think resident keys just complicate things for users and developers.

Re: Using FIDO keys

#18

Post by timwis »

As much as I want a hardware key, I still struggle with the practicality of having a backup key. I create new accounts on websites quite often, and the idea of having to go fetch my backup key out of a safe to register it (and hope the site allows multiple keys) just feels impractical (“I’ll do it tomorrow”). Not to mention—what if I’m at work, or out and about setting it up on my phone? Am I really going to remember to add my backup key when I get home every time?

Wish there were a way around this :/

Re: Using FIDO keys

#19

Post by [deleted] »

aborsy wrote: post #15

This space is confusing. FIDO2, U2F, UAF, CTAP, WebAuth, Passkey, 2FA, … The names frequently change. Aren’t all of them just public key authentication (with the private key in a mini-HSM, and public key either calculated in real-time, or stored, in the HSM, and synced externally)?

[deleted]

Re: Using FIDO keys

#20

Post by Nextgrid »

timwis wrote: post #18

As much as I want a hardware key, I still struggle with the practicality of having a backup key. I create new accounts on websites quite often, and the idea of having to go fetch my backup key out of a safe to register it (and hope the site allows multiple keys) just feels impractical (“I’ll do it tomorrow”). Not to mention—what if I’m at work, or out and about setting it up on my phone? Am I really going to remember…

I very much wonder if this obvious oversight was intentionally left unaddressed in order to create a requirement on proprietary sync/backup solutions and make true security more difficult (since the key material is now being synced around and could technically leak or be subject to "lawful intercept" or bruteforce of the sync service's authentication).
Post reply on HN