Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico and Microsoft Introduce Passwordless Login

yubico.com

Post reply on HN
Print view View original

131–140 of 218 posts

Re: Yubico and Microsoft Introduce Passwordless Login

#131

Post by ajeet_dhaliwal »

krupan wrote: post #92
TheDong wrote: post #91

Earlier quoted context omitted.

> I got an email from Twitter just a few days ago stating that they'd leaked my password Clearly you didn't read the email. The password was potentially logged to twitter's servers in plaintext. They have no evidence anyone collected those passwords, but various employees could, in theory, have seen those logs. Presumably those logs are now all deleted. Even if you didn't reset your twitter password, it's very likely…

You obviously are more trusting than I am. Also, my point was that if Twitter messed up, so has every other website. Do you trust them all as much as you trust the Twitter employees?

You don’t trust Twitter’s story but you trust Twitter software engineers more than others?

I trust Twitter’s story about the plain text logging but don’t trust their software engineers more than others.

Re: Yubico and Microsoft Introduce Passwordless Login

#132

Post by emlun »

krupan wrote: post #86

The conversation here is blowing my mind. People are actually worried that their yubikey might get lost or stolen when likely most of your passwords are already all over the internet. I got an email from Twitter just a few days ago stating that they'd leaked my password. Twitter! Not Joe's Auto-Body who's website is being run by a high-schooler, but one of the pioneers of internet companies. They messed up. Your pass…

>I also really hope that hardware tokens like a yubikey are not required for every site or app. I'd like to be able to keep private keys on my phone or laptop for some things

Web Authentication supports this with what's called "platform authenticators" - some kind of TPM/secure enclave etc. built into the computer (most likely a laptop/phone), possibly integrated with a fingerprint scanner. The expectation is that sites will let you register more than one credential (like many (most?) do for U2F), so you can have a keyring device for initial logins on new computers (or for logging in on a friend's computer) and then use a platform credential on each for most daily use. Intel's built-in U2F thing is something to this effect, and might be compatible.

It's also theoretically possible that a phone could expose its platform authenticator to other computers via Bluetooth/NFC/USB, but that's still hypothetical at this point.

Re: Yubico and Microsoft Introduce Passwordless Login

#134

Post by u801e »

zrail wrote: post #4
grondilu wrote: post #2

Can someone remind me why we don't use public key cryptography for authentication on websites?

The browser UI is terrible and there's been very little incentive to improve it. The largest user of client-side crypto that I'm aware of is the US DoD with the Common Access Card program, and they just train people on how to use the crappy UI.

> The browser UI is terrible and there's been very little incentive to improve it.

It seems like a chicken and egg problem. There's very little incentive to improve it because practically no one uses it. And no one uses it because it's a bad user experience.

But I would prefer it over using a Yubikey because, IMO, the private key should be associated with a machine, rather than a person. That is, if one of my devices is stolen or compromised, I can use another one of my devices to revoke the stolen/compromised device's access.

Re: Yubico and Microsoft Introduce Passwordless Login

#135

Post by ahelwer »

emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

What's the deal with lost yubikey user workflow? Rely on individual websites to give you a one-time recovery passcode that you then have to input into every website? I can't believe I'm taking UX cues from cryptocurrencies, but what about providing the user with a seed for the yubikey private key they can back-up offline then reinstall in a new yubikey?

P.S. just ordered a yubikey security key, excited to add this additional layer to my own personal byzantine security labyrinth. Or maybe simplify it, who knows!

Re: Yubico and Microsoft Introduce Passwordless Login

#136

Post by closeparen »

ahelwer wrote: post #135
emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

What's the deal with lost yubikey user workflow? Rely on individual websites to give you a one-time recovery passcode that you then have to input into every website? I can't believe I'm taking UX cues from cryptocurrencies, but what about providing the user with a seed for the yubikey private key they can back-up offline then reinstall in a new yubikey? P.S. just ordered a yubikey security key, excited to add this ad…

Recovery codes or 2 Yubikeys.

Re: Yubico and Microsoft Introduce Passwordless Login

#137

Post by francislavoie »

emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

Do you have any plans to release server code (I'm mainly concerned about PHP) for CTAP2/WebAuthn support? I really appreciated having access to a reference implementation to handle the data from the client for U2F. CTAP2 looks significantly more complex, and I'm somewhat worried about complexity of implementing it correctly based on the spec.

Re: Yubico and Microsoft Introduce Passwordless Login

#138

Post by krrrh »

ahelwer wrote: post #135
emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

What's the deal with lost yubikey user workflow? Rely on individual websites to give you a one-time recovery passcode that you then have to input into every website? I can't believe I'm taking UX cues from cryptocurrencies, but what about providing the user with a seed for the yubikey private key they can back-up offline then reinstall in a new yubikey? P.S. just ordered a yubikey security key, excited to add this ad…

You can use Trezor or Ledger hardware wallets for U2F with recoverable seed words. Even if you go with a Yubikey, which has a better form factor, one of these is a pretty good backup device since they can be further backed up to paper.

Re: Yubico and Microsoft Introduce Passwordless Login

#139

Post by pfg »

nikolay wrote: post #73

No USB-C version and no way to upgrade my other 4+ YubiKeys I've got for more than $50 each! I think YubiKey has been abusing its monopoly recently! They've been working on this for quite some time and clearly new they're not going to make their old premium keys support it so that people can waste time and money to upgrade! Is there an alternative more conscious company - I'd pay even $200 for the piece of mind that…

YubiKeys are non-upgradable by design. This is occasionally annoying when new standards come out and you need to go buy new keys (which is not something that's gonna happen a lot), but it significantly reduces the attack surface of these devices. They've been pretty good about giving out free replacement keys whenever major flaws have been found, and webauthn is pretty good about remaining backwards-compatible with U2F keys, so I don't think it's something they handled particularly badly.
Post reply on HN