Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting Started with Security Keys

paulstamatiou.com

Post reply on HN
Print view View original

21–30 of 104 posts

Re: Getting Started with Security Keys

#21

Post by blintz »

burner589432 wrote: post #19
judge2020 wrote: post #10

Earlier quoted context omitted.

> Unpopular opinion Yes, quite unpopular since keyloggers and clipboard watching malware are probably a threat model to many more people than someone stealing a security key off your keychain.

If malware is in a position to steal data from your clipboard or keylog your device, it's very likely to be in a position to hijack your session tokens.

Even if the malware hijacks your session tokens, using something like WebAuthn prevents silent theft of a password, which is much more powerful (allows creation of new sessions).

Re: Getting Started with Security Keys

#22

Post by burner589432 »

_jal wrote: post #16
burner589432 wrote: post #5

Unpopular opinion: These keys are about selling the idea that physical-based security is somehow magically better. If you have good password hygene (read: a decent password manager) then I'll need to breach your host to obtain it - if you use a security key, I'll have to breach your host and hijack your session which is slightly more convenient but chances are you're royally screwed once you're breached anyway. Sure…

Other folks have mentioned things you missed, here's another: insider threats. A authentication event requiring a hardware token is significantly harder to deny, especially if used again by the legitimate user after the questionable event. So any insider attacks that are not last-hurrahs or one-shots plausibly explained by theft are significantly riskier.

If you're trying to prevent credential theft: Educate users on password managers, deploying 2FA, or tokens like this would also make sense. MFA deployments are probably significantly cheaper though (And yes, ActiveDirectory OTP and smartcard based MFA tools exist). Productivity-wise, MFA will work better than USB tokens - I know a bunch of people who regularly forget their work smartcard pass, I don't know many people that forget their mobile phone.

If you're trying to have rock solid audit trails that will stand up in court: This, or 2FA won't have a huge functional difference, but chances are unless you have NSA/Google tier security, your money would be better spent hardening infrastructure - your logs won't be worth jack if a pentest rips your network apart in two hours. I regularly see $1m+ SEIM deployments on MS17-010 vulnerable networks, I feel like security gimmicks like these distract them away from fixing real problems and are, if anything, detrimental to security.

Re: Getting Started with Security Keys

#23

Post by burner589432 »

blintz wrote: post #21
burner589432 wrote: post #19

Earlier quoted context omitted.

If malware is in a position to steal data from your clipboard or keylog your device, it's very likely to be in a position to hijack your session tokens.

Even if the malware hijacks your session tokens, using something like WebAuthn prevents silent theft of a password, which is much more powerful (allows creation of new sessions).

If your host is infected with malware but it can't steal your passwords due to hardware boundaries, it still has access to your host at a pretty reasonable permission level.

In most corporate environments that's far more damaging than getting persistence in a handful of webapps.

Also, 2FA solves this exact issue.

Re: Getting Started with Security Keys

#24

Post by arshbot »

There is a depressing lack of open standards with these off-the-shelf physical tokens. It's unfortunate that a company's security can rely on the APIs of another company which could go bankrupt and disappear at any time.

Re: Getting Started with Security Keys

#25

Post by pvg »

kadoban wrote: post #17
datguacdoh wrote: post #15

Earlier quoted context omitted.

100% this. Phishing is incredibly common, really difficult for even sophisticated users to detect when done well, and the best password manager isn't going to help you. A security key will all but guarantee that this isn't an issue and is a pretty good UX too.

Correct me if I'm wrong, but password managers can prevent quite a lot of phishing, because autofill can automatically check the domain. It would be abundantly obvious to me if I were going to put my paypal password into anything but paypal, for instance, because I wouldn't even have the option. I'd have to copy/paste if I wanted to, which would up my suspicion level to the extreme. (this is not to downplay security…

It would be abundantly obvious to me

That's what people say but even security experts have fallen for phishing attacks. And since the autofill is not 100% reliable, it's not that unusual to go into the password store and manually get the password out of there.

Re: Getting Started with Security Keys

#26

Post by skybrian »

I would put greater emphasis on not locking yourself out, since that's the most likely threat for many people. Losing your phone (or having it die on you) is common and you should assume you'll do it sooner or later. Print out backup codes and store them somewhere safe that you won't forget before enabling two-factor authentication that depends on you having your phone or other device that can break.

Re: Getting Started with Security Keys

#27

Post by couchand »

arshbot wrote: post #24

There is a depressing lack of open standards with these off-the-shelf physical tokens. It's unfortunate that a company's security can rely on the APIs of another company which could go bankrupt and disappear at any time.

This comment held water about five years ago, but times have changed.

Re: Getting Started with Security Keys

#29

Post by burner589432 »

kadoban wrote: post #17
datguacdoh wrote: post #15

Earlier quoted context omitted.

100% this. Phishing is incredibly common, really difficult for even sophisticated users to detect when done well, and the best password manager isn't going to help you. A security key will all but guarantee that this isn't an issue and is a pretty good UX too.

Correct me if I'm wrong, but password managers can prevent quite a lot of phishing, because autofill can automatically check the domain. It would be abundantly obvious to me if I were going to put my paypal password into anything but paypal, for instance, because I wouldn't even have the option. I'd have to copy/paste if I wanted to, which would up my suspicion level to the extreme. (this is not to downplay security…

> since the autofill is not 100% reliable, it's not that unusual to go into the password store and manually get the password out of there.

I imagine you can extract passwords out of security keys in some form without being on the correct domain, too.

Do domain check fails that regularly? I'm sure enterprise configuration policies would provide functionality to prevent password extraction should you be inclined to enable it.

Re: Getting Started with Security Keys

#30

Post by vel0city »

skybrian wrote: post #26

I would put greater emphasis on not locking yourself out, since that's the most likely threat for many people. Losing your phone (or having it die on you) is common and you should assume you'll do it sooner or later. Print out backup codes and store them somewhere safe that you won't forget before enabling two-factor authentication that depends on you having your phone or other device that can break.

Including printable backup codes, most services supporting FIDO U2F or WebAuthn support tying multiple security keys to your account. Many of these authenticator devices are pretty cheap these days, its not insane to have a few of them. Have one on your keychain, another in a desk drawer, etc.
Post reply on HN