Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

yubi.co

Post reply on HN
Print view View original

21–30 of 45 posts

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#21

Post by sasas »

Elizzy wrote: post #18
sasas wrote: post #9

Earlier quoted context omitted.

If you program your own keys into the Yubi, then you know them and can archive them for reprogramming on another device. You can do this with the Yubi Personalisation tool [1] for a few modes the device supports. [1] https://www.yubico.com/products/services-software/personaliz...

Eh. Hence why I said it like I did. In most cases, the device generates the secrets. And that's how it should be done, it guarantees that they can't be compromised easily (vs if someone compromised wherever you backed up those keys to).

Sure. There are also other instances where the Yubis keys maybe exposed, such as when using their OTP protocol which requires the keys stored in a validation server (either theirs by default, or your own [1])

[1] https://www.yubico.com/products/services-software/open-sourc...

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#22

Post by [deleted] »

talkingtab wrote: post #11

Just to be clear, "Yubikey" is a brand of FIDO key. See: https://fidoalliance.org . You can find other brands which in my experience, are just as functional but often less expensive. I have a yubikey, one from hyperfido and most interesting is the open source 'U2F zero'. All of them work equally well. Unless MS has a non-standard implementation or does not use FIDO, then any FIDO would work.

[deleted]

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#24

Post by powmonk »

qplex wrote: post #23

Does it protect you also from the spy/ad/malware that Windows 10 is?

Some of us need to use windows for various reasons. There's a bunch of other stuff you can do to prevent spying, they do not fall within the scope of this post.

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#25

Post by chaz6 »

I got as far as plugging in the key, and then it said "Windows companion devices are disabled on your system. Contact your system administrator." My computer is a standalone desktop, not connected to a domain.

Edit:

If you run into this problem, here's how to fix it

To modify local security policy

Open the Local Group Policy Editor. To do this, press the Windows key, type R, and then type gpedit.msc. In the Local Group Policy Editor, from the top level Local Computer Policy, navigate to Computer Configuration > Administrative Templates > Windows Components > Microsoft Secondary Authentication Factor. In the right pane, click the link to Edit policy setting. (You can also double-click the setting to Allow companion device for secondary authentication.) The default state is Not configured. In the setting screen, select the option for Enabled, and click OK. If this option is already selected, your policy is set and you can click Cancel. Exit the Local Group Policy Editor and the Management Console.

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#26

Post by [deleted] »

talkingtab wrote: post #11

Just to be clear, "Yubikey" is a brand of FIDO key. See: https://fidoalliance.org . You can find other brands which in my experience, are just as functional but often less expensive. I have a yubikey, one from hyperfido and most interesting is the open source 'U2F zero'. All of them work equally well. Unless MS has a non-standard implementation or does not use FIDO, then any FIDO would work.

[deleted]

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#27

Post by chaz6 »

talkingtab wrote: post #11

Just to be clear, "Yubikey" is a brand of FIDO key. See: https://fidoalliance.org . You can find other brands which in my experience, are just as functional but often less expensive. I have a yubikey, one from hyperfido and most interesting is the open source 'U2F zero'. All of them work equally well. Unless MS has a non-standard implementation or does not use FIDO, then any FIDO would work.

I have a Yubikey 4, a Plug Up key (pu1.fr/sk though seems to be awol) and a Fidesmo nfc card for my phone. Annoyingly the nfc card works fine with github, but Google says it is not supported on my device.

I hope that someone adds support for using U2F with windows accounts.

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#29

Post by Fnoord »

vrdabomb5717 wrote: post #5
STRML wrote: post #3

Earlier quoted context omitted.

How useful is that, really, considering you couldn't possibly use a Yubikey to configure disk encryption? Unless you actually put the unlock key on the Yubikey somehow (I've never heard of someone attempting or succeeding at that), anyone with physical access - which is what this is intended to protect against - could still wreak all kinds of havoc with disk access. It's certainly easier and may even be safer (in the…

With FileVault, the disk won't decrypt until the user enters their login password. Here's Yubico's documentation on Filevault integration: https://www.yubico.com/support/knowledge-base/categories/art... It seems an attacker with physical access still requires your password to unlock the disk. At that point, they'd need the Yubikey to login (assuming they haven't already decrypted the disk and taken your data). Someon…

> It seems an attacker with physical access still requires your password to unlock the disk. At that point, they'd need the Yubikey to login (assuming they haven't already decrypted the disk and taken your data).

Its just PAM (pam_yubikey to be precise). If they have physical access they can edit the requirement for Yubikey in PAM.

If there's FDE (FileVault) then I don't know. But I do know the PAM configuration must be read, and is therefore in r/w. It isn't in some kind of security enclave.

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#30

Post by mark_l_watson »

I don't like something that I have to plugin. What I greatly prefer is what PacBell gave me as a consultant in the 1990s to access their secure inner networks remotely: a device that would display a new random number every 10 seconds and I would add that number to my password when logging in. I was given the same sort of device at Google in 2013 when I was a consultant there.

For laptop and mobile devices, I like the idea of password and biometrics (finger print reader and/or facial recognition).

Post reply on HN