Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico and Microsoft Introduce Passwordless Login

yubico.com

Post reply on HN
Print view View original

151–160 of 218 posts

Re: Yubico and Microsoft Introduce Passwordless Login

#151

Post by not_that_noob »

datalog19908 wrote: post #149
emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

> he new YubiKeys support an on-device PIN that isn't shared with the server Doesn't this PIN become a master password for all the websites at that point?

That’s really the flaw of single sign-on and Webauthn - that one key now unlocks the kingdom.

Re: Yubico and Microsoft Introduce Passwordless Login

#152

Post by toast0 »

krupan wrote: post #95
georgyo wrote: post #89

Earlier quoted context omitted.

Still reading the comments, but is anyone actually saying passwords are more secure in general? I think most people are saying that they get locked out of their account if they lose the token. How do you validate your account is your account if the only secret you have is lost? If you 100% require a hardware token, you need at least two and/or a method to auth that is not a hardware token so you can recover in a mode…

"Security from the people directly around you and security from everyone on the internet." Are the people around you not on the internet? They are just a subset of that larger group, aren't they? Sorry if I'm not understanding your point there. And like I said in my edit, I really hope that Yubikey is not the one and only one way to store private keys. I personally would be perfectly happy, for most websites and apps…

The people around you are (probably) on the internet, but let me try to articulate the threats differently.

If I'm worried about 'people on the internet' that's threats like brute forcing my weak password, or determining my password on one site (through phishing, password leaks, whatever) and trying it everywhere else and finding I reused it; potentially using malware to slurp up passwords.txt from the desktop where I keep my varied passwords. If I keep a strong password for each site in a journal near my computer, I'm fairly well protected from internet threats as long as I don't get a keylogger. If I make sure I keep a copy of my passport journal somewhere else too, I won't lose access.

If I'm worried about people next to me, say roommates, office mates, or any one else who is near my computer, I'm more concerned about the physical security of my password journal; it might not be a good idea to keep it next to the computer if untrusted people will be there. These people could also be looking through password leaks, but they probably aren't.

Re: Yubico and Microsoft Introduce Passwordless Login

#153

Post by sametmax »

sp332 wrote: post #31
sametmax wrote: post #25

Earlier quoted context omitted.

I doubt that. Friends or family can't read your mind, but they can steal your physical key. People putting pins on their phones or password on their laptop are not afraid of being pirated. This is a vague, abstract threat to them. Becoming part of a botnet is really not important to them, and they getting their credit card stolen from the web is really not credible enough for non tech saavy user. What they are afraid…

Anyone in the world could crack your password. (Well, any of 2.5 billion people with an internet connection.) Requiring a physical key instead cuts the attack surface down quite a bit. If you can secure your car and house keys, you can secure this.

You use it much more often than those keys. And really people don't care abou being pirated by a stranger. Theyvcare about their spouse leeaning you still talk to your ex. Or your sibling getting a picture of you that is embarassing.

And of course you need a duplucate for the key.

Re: Yubico and Microsoft Introduce Passwordless Login

#154

Post by beagle3 »

crankylinuxuser wrote: post #81

My problem is that Microsoft doesn't allow swapping in and out of authentication plugins like PAM. I work primarily in a Windows shop, and I got the other co-workers in Linux because PAM supports seamless multi-factor auth. I would have went Windows, but its too obfuscated or hard to do that. LinOTP works very well. And LinOTP works with a wide variety of tokens. Don't be locked to a single vendor.

Back in the Win2000 days, we had GINA[0]; still worked on XP sans fast-user-switching, but killed on Vista+7+8+10 ; The wikipedia page says "credential providers" gives some of the functionality on those OSes though.

I like Linux better too.

[0] https://en.wikipedia.org/wiki/Graphical_identification_and_a...

Re: Yubico and Microsoft Introduce Passwordless Login

#155

Post by icebraining »

not_that_noob wrote: post #150
emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

A PIN is really a numeric password. It has all the same flaws - compromise risk (say via social engineering) and the risk of forgetting and needing it reset. So the ‘passwordless’ option here is either rename the password to PIN or eliminate it to provide single-factor login. The latter is a dream for smart attackers, since there is always some social engineering route they can use to acquire a legit token.

Not all the same flaws; malware will have a much harder time recovering it. Also, you can use a regular password to "semi-authenticate" with the call center of the service and try to get them to disable the second factor, but this PIN is only useful with physical access to the device.

Re: Yubico and Microsoft Introduce Passwordless Login

#156

Post by zaarn »

not_that_noob wrote: post #151
datalog19908 wrote: post #149

Earlier quoted context omitted.

> he new YubiKeys support an on-device PIN that isn't shared with the server Doesn't this PIN become a master password for all the websites at that point?

That’s really the flaw of single sign-on and Webauthn - that one key now unlocks the kingdom.

I don't see that as a flaw really. It's not different to having a password manager, with proper WebAuthn atleast.

What you do is you take this key that unlocks the kingdom.

And then you keep it safe.

Unlike before there isn't 20 keys that unlock parts of the kingdom that might lead to unlocking other kingdoms via roundabout ways. Your attention for security can be focused on a single key.

The average users will be much safer if we force them to only have to remember one single password that can be securely used for everything without the usual drawbacks (that's why security people recommend password managers)

Re: Yubico and Microsoft Introduce Passwordless Login

#157

Post by tallanvor »

ascorbic wrote: post #148
vzaliva wrote: post #10

Correct me if I am wrong, but passwordless login is a single-factor authentication and less secure than MFA. Depending on whenever hardware key is more or less secure than the password, the mass adoption of this could make things LESS secure.

You trust a single factor hardware key to protect your car and your home. How often have you lost those?

This is the point that I think too many people don't understand.

If your password is leaked, your username/email has probably been leaked as well.

If your hardware key is lost, assuming it wasn't stolen by someone who has specifically been trying to get your credentials, then there's nothing to tie it to you. You're still going to get a new key and change the locks, but you know it happened.

Re: Yubico and Microsoft Introduce Passwordless Login

#158

Post by tialaramex »

joering2 wrote: post #144

Why can't I secure login with a fingerprint? Microsoft could have team up with Logitech like Sony with Erricson, and come up with a standard and put (mildly cheap) finger print reader on each sold keyboard and popularize open source standard for software implementation.

Your fingerprint is not a key, it's an identity. So your design tells every place you sign in this way "I'm joering2". And if course if any of them want to log in somewhere else, they now know to say the same thing, "I'm joering2".

I guess this is slightly easier than typing your email address? But it's not a security feature.

The FIDO/U2F design is a cryptographic key enshrined as a physical key, so rather than "I'm joering2" it says: "I can prove I'm this particular key talking to your site again using mathematics".

Which key? No way to know, but it's the same one as before. Google can't use the credentials it presents to them to get into Facebook and vice versa, the proof from yesterday is worthless today and so on.

Re: Yubico and Microsoft Introduce Passwordless Login

#159

Post by adrianN »

krupan wrote: post #86

The conversation here is blowing my mind. People are actually worried that their yubikey might get lost or stolen when likely most of your passwords are already all over the internet. I got an email from Twitter just a few days ago stating that they'd leaked my password. Twitter! Not Joe's Auto-Body who's website is being run by a high-schooler, but one of the pioneers of internet companies. They messed up. Your pass…

When my password is leaked, I can still access my $important_stuff. When I lose a hardware dongle, I potentially just lost irreplaceable data.

Re: Yubico and Microsoft Introduce Passwordless Login

#160

Post by teknopaul »

emlun wrote: post #127

I'd like to try to answer some common questions I see here: - Q: Doesn't passwordless mean single factor? Isn't that insecure? A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is opt…

Does it identity you as the same person to two different websites? I.e. Is it for building up advertising profiles like google oor facebook logins?
Post reply on HN