Getting Started with Security Keys • Hacker News Board

Re: Getting Started with Security Keys

#101

Post by jessaustin » Fri, Nov 01, 2019, 4:29 PM UTC

mceachen wrote: post #98

jessaustin wrote: post #75

Earlier quoted context omitted.

Sure it can handle logins to both "theircompany.com" and "service.theircompany.com", assuming the cert is set up correctly. It probably isn't going to figure out that those are related to "theircompany-service.net". This would arguably be a failure in domain setup, but I've certainly seen similar setups before. Example: " https://hbweb.incompass-solutions.com/" uses the same credentials as " http://www.equineline.com…

Some password managers (like bitwarden) allow for N URL patterns for a given credential, for exactly this purpose.

Sure, but that's something the user sets up, so it still contradicts GP's contention that the user never needs to think about this. The only thing a password manager can (validly) do automatically is look at subject name and subject alt names. (I don't know that all of them even do this.) Even that's assuming that certs are set up correctly...

Re: Getting Started with Security Keys

#102

Post by delogan » Fri, Nov 01, 2019, 6:59 PM UTC

allset_ wrote: post #94

sebazzz wrote: post #44

I have a Yubikey but I can't use it fully yet: - There is no Yubikey OTP app for the iPhone - Safari iOS does not respond to WebAuthn APIs (the apis are available but don't have any effect). I rather use plain Safari or Firefox, so Brave browser is not an option for me.

Yubico Authenticator for iOS was released today.

> Only iPads with Lightning connectors are supported.

Re: Getting Started with Security Keys

#103

Post by tjoff » Sat, Nov 02, 2019, 8:31 AM UTC

deadbunny wrote: post #100

tjoff wrote: post #71

Earlier quoted context omitted.

Yeah, scenario that I still need to solve is: Go on vacation, loose your phone and security key (along with any written passwords) - by robbery, theft, customs or accident. You'd still need to be able to access your email etc. or else your experience is going to be a hundred times worse. What you really want is optional 2FA. You have a regular (unique) password but you never use it unless there is an emergency. Now y…

1. Buy 2 yubikeys (with U2F) 2. Add both for each site you use it for 3. If using gpg keys you masterkey lives on a USB key, use subkeys which get transferred onto both yubikeys 4. Lock one the USB key and 2nd yubikey in a safe* with the password you never use 5. If you lose your day to day keys, unlock safe *safe can be an actual safe, a "secure enough" place in your house, a bank safety deposit box, etc... You can…

Doesn't cover the scenario I outlined.

Step 1 then becomes "buy airline ticket to get home so I can get at the safe".

Sure, of course doable, but a million times more cumbersome.

What if passport was also stolen? Maybe in such a time it would be convenient to be able to contact anyone? Even if not to solve the situation but more of a heads-up.

Re: Getting Started with Security Keys

#104

Post by sebazzz » Sun, Nov 03, 2019, 10:30 AM UTC

jacekm wrote: post #66

sebazzz wrote: post #44

I have a Yubikey but I can't use it fully yet: - There is no Yubikey OTP app for the iPhone - Safari iOS does not respond to WebAuthn APIs (the apis are available but don't have any effect). I rather use plain Safari or Firefox, so Brave browser is not an option for me.

> does not respond to WebAuthn APIs Hmm, is it still the case? I don't have an iPhone, but after reading this post https://www.yubico.com/2019/09/yubico-ios-authentication-exp... my understanding was that WebAuthn will now work with all browsers, not only Brave.

No, I tried it. The APIs work normally from the web application perspective, but no prompt comes up to connect the security key. You also need to enable it from the experimental features page.