Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FIDO2 security key company releases hardware that's open source and uses Rust

solokeys.com

Post reply on HN
Print view View original

111–120 of 160 posts

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#111

Post by Corrado »

tialaramex wrote: post #43
kelnos wrote: post #31

Earlier quoted context omitted.

Others have answered most of your questions, but there's something I think deserves emphasizing: In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doin…

> Some sites will allow you to simultaneously enroll two devices, so you can keep one as a backup For WebAuthn (the actual standard for how to do this which is what you should be rolling out if you have a greenfield authentication environment that doesn't already do U2F today) the specification explicitly says: > Relying Parties SHOULD allow and encourage users to register multiple credentials to the same account. Re…

> I'm aware of (and along with many of its other users annoyed that) AWS only permits a single authenticator. If there are other popular sites that do this, this is no worse a place than any other to say so.

Just to clarify, AWS only allows a single authenticator for their IAM users. If you are using AWS SSO then you can have multiple authenticators. And yes, I am very annoyed and frustrating to think that IAM is forced into a lower security profile that it needs to be.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#112

Post by Corrado »

andrewwebber wrote: post #103
kelnos wrote: post #31

Earlier quoted context omitted.

Others have answered most of your questions, but there's something I think deserves emphasizing: In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doin…

Looking at you AWS cloud.

Just to be clear, AWS SSO supports multiple keys. Yes, AWS IAM only supports a single key and it's very frustrating. If you want multiple key support, I suggest moving to AWS SSO. It's much better in every way.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#113

Post by fsflover »

_abox wrote: post #46

Nice, I'd love this as an open source yubikey replacement. But it doesn't do OpenPGP, I rely on that way too much sadly. Not just for SSH which supports fido2 now but also for file encryption and my password manager. If they add that in the future I might jump ship.

Librem Key can do OpenPGP and uses FLOSS:

https://puri.sm/posts/introducing-the-librem-key/

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#114

Post by g_p »

mkj wrote: post #89
stouset wrote: post #39

Earlier quoted context omitted.

> Some (like Yubico) let you purchase a "cloned" set of devices Wait, they do? How? I would love to do this, but I can't find anything relevant on their website.

I assume the solokey generates its master key on-device. Seems like it wouldn't be too hard for it to perform Diffie Hellman key exchange with another device to get a shared secret (at first setup) then they could be a cloned pair.

The issue with this would be counter synchronisation, as services shouldn't accept cloned responses when the counter ceases to be monotonic for what should be one single device.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#115

Post by FeepingCreature »

kelnos wrote: post #80
vlovich123 wrote: post #40

Earlier quoted context omitted.

> On the flip side, if someone steals your backup key, it becomes harder to deal with the situation; with distinct keys, you can just revoke access to the stolen key. But with cloned keys, revoking access to the stolen key will also revoke the key you use daily. Get a new key, revoke old key, switch to new one?

Right, but the "get new key" bit means that your accounts are in a vulnerable state while you're getting the new key. If you have two independent keys, and you learn that your backup key is compromised, you immediately revoke it with all services, and order a new one. When the new one arrives, it becomes your new backup, and you enroll that in everything. Your vulnerability to an attacker ends immediately after you f…

Of course, the problem here is that the attacker can also revoke your backup key, and since they're the attacker, they can probably do it faster than you.

Preferably I'd have a certificate chain scheme where I have a private revocation key sitting in a safe somewhere whose public key I specify everywhere, so I don't even need to take it out of the safe to sign up somewhere.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#116

Post by Xylakant »

tialaramex wrote: post #86
smichel17 wrote: post #49

Earlier quoted context omitted.

> But many sites only allow a single device to be enrolled. Ugh, I hate these. I want to use u2f, but I am not willing to risk being locked out of my account if I lose the key. So I only enable it if there is some other 2fa I can enable (either adding a second key or totp).

Most sites which offer U2F (or WebAuthn, which is what they ought to be doing for new sites) have a last ditch "Write down this huge random string" way back in. If you're the sort of person who'd hate to lose an account (seems like you are) then you should definitely write that down, and keep it somewhere damn safe. But, as I wrote elsewhere in this thread, the only site I'm aware of that forbids multiple Authenticat…

There’s one special account though and that’s the AWS root account. It’s needed for certain special things and tying it to a yubikey means that you cannot easily give those a creds to 2 people.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#117

Post by StavrosK »

tialaramex wrote: post #96
t0astbread wrote: post #69

Earlier quoted context omitted.

Ah, I see! So cross-site (across multiple relying parties) linking is prevented but if I have multiple accounts within one relying party they can be linked?

FIDO (except in resident mode which we'll ignore here) requires the site requesting you authenticate to hand over a large opaque blob called an ID that your authenticator gave it when you enrolled the authenticator. This ID will be different for every time you enrolled an authenticator, and it can recognise its own IDs (using modern cryptography). To prevent you enrolling the same one twice, sites hand over a list of…

I implemented this mode in a Django library [0] (demo on www.pastery.net) because I love the idea of not needing a password manager any more, just simply having a key with you to log in anywhere, but it doesn't seem to have widespread browser support yet.

Maybe I made a mistake, but Firefox doesn't seem to work very reliably with it, and mobile support is spotty too.

[0] https://pypi.org/project/django-webauthin/

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#118

Post by Arainach »

xur17 wrote: post #20
Groxx wrote: post #19

Earlier quoted context omitted.

> - The ideal backup for this is to have a separate key, both authorized. This in particular is important. Security is only as strong as your weakest link, so any backup methods (e.g. "forgot password" flows) might as well be your primary method, if you actually care to strongly secure things. Adding another (or more) key gets you same-security redundancy if one fails or is lost. Nothing else will achieve this. Degra…

This is one thing I hate about these keys though - some services only support one key, and for ones that support multiple, I struggle to figure out a storage system for my backup key. I don't want to keep it with me (because then I am at risk of losing both), but if I keep it separate, I need to remember to add it to new accounts - there's no way to see a list of accounts a key has been associated with. I'm curious h…

I keep one backup key in a fire safe at my residence (in case I lose my primary key somehow) and one with a trusted party in a different state (in case Mt. Rainier explodes and the entire state of Washington is lost - though at that point I have bigger concerns)

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#119

Post by StavrosK »

This looks great and I'm very excited for it, but it's been "coming soon" for more than a year. The original release date was last June, now it's this June for the first backer keys, AFAIK.

I hope it doesn't take that long, but there's a history of delays, unfortunately.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#120

Post by Avamander »

IgorPartola wrote: post #74
georgyo wrote: post #62

Earlier quoted context omitted.

What about code signing? People like to dislike PGP and replace it with a myriad of different solutions. But PGP is everywhere and awesome. It's very wide spread adoption is invaluable. I really don't want to see it replaced with zillions of different bespoke solutions.

Why do people like to hate on PGP? It’s a pretty great project.

Because it has a shitton of issues. The implementations aren't great, cryptographic issues, memory safety issues, stable API/ABI issues. It's still not supported well by software that could use these features.
Post reply on HN