Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

fidoalliance.org

Post reply on HN
Print view View original

231–240 of 525 posts

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#231

Post by diggernet »

pat2man wrote: post #171
aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

Ledger ( https://www.ledger.com ) supports FIDO and lets you do backups. You really need a screen to do it correctly, otherwise there is little point in having an external device.

TacticalCoder has previously commented here (https://news.ycombinator.com/item?id=26844019) about the ability to set a specific seed on Ledger devices, so you can make a backup key that behaves identically to your main key.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#232

Post by dane-pgp »

jeroenhd wrote: post #10
missosoup wrote: post #6

So their vision of the future is that to do anything online, one MUST have a phone (ahem, portable wiretap)? And they're going to be keeping my secrets for me, for my own good? I'm not sure I'm down with any of that.

I doubt they'll do away with tools like smart cards or Yubikeys any time soon. Laptops and modern computers also contains a TPM so you don't necessarily need to have a phone for secrets storage. If push comes to shove, I'm sure someone will develop a lightweight Android emulation layer you can run in the cloud that pretends to be a phone enough that you can use it.

> Laptops and modern computers also contains a TPM

The root of trust for which extends to who knows where, and you're not allowed to look at the source code or learn how it works because that would threaten Hollywood's profit margins.

We're basically building a system of DRM for access to human beings, and making the whole world dependent on these unaccountable entities.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#233

Post by tadfisher »

rdl wrote: post #226
aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

Ideally there would be a way to create "tickets" or something from an authenticator in advance and then use them for registration without physical access to the device. Then I could have 100 tickets from my backup on my master, keep the physical backup in a secure offsite location, and enroll new services using master + backup-tickets. When I run out of tickets, generate 100 more. Being able to export/back up/restore…

This sounds suspiciously like PGP subkeys. Having not read into how FIDO works, I'm going to now assume it works by supplying a "public key" to a third party, and the third party authenticates by having you encrypt a nonce with a private key. How far off am I?

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#234

Post by browningstreet »

vngzs wrote: post #38
throwaway52022 wrote: post #35

I've resisted switching to a hardware key because I know that I'm going to break it, and that seems like a huge pain in the ass. I really want to be able to make a couple of backup keys, or maybe put another way, I want to be able to put the private key on the device myself, I don't necessarily care that the key is generated on the device and never leaves the device. I don't care if that slightly reduces my security…

You just register 2-3 keys. It's not so bad.

So if you're travelling overseas for 3-4 weeks, you need to keep extras in all your different luggage/bags, just in case?

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#236

Post by dlivingston »

criddell wrote: post #227
jeroenhd wrote: post #162

Earlier quoted context omitted.

Honestly, biometrics are terrible for authorization. They're more of a username than a password and we shouldn't use them like passwords. The same is truth for facial recognition algorithms, no matter how advanced. They're so damn convenient, though. I trust the fingerprint scanner on my phone and my laptop, but there are definitely bad scanners out there.

Why do you trust your laptop scanner? Have you let other people try to unlock with their fingerprint? FWIW, my daughter's laptop is a Dell.

Apple's bioauth is very good and I trust both the fingerprint and face authentication. YMMV with other manufacturers and devices.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#237

Post by andrey_utkin »

traceroute66 wrote: post #158
aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

> Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? Why would you need that ? On most services that I use that support FIDO, you can register as many keys as you like. Seems to me that is a much more secure option than to provide a potentially exploitable option of allowing key extraction.

You cannot register more than one security key with *AWS*. Which a lot of devs beg for, for years. Can't find that support ticket URL now.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#238

Post by tadfisher »

vngzs wrote: post #211
teeray wrote: post #192

Does this provide any benefit over a (properly used) password manager? I’d be happy with just: - an “alphabet”, “minlength” and “maxlength” attributes on password fields so password managers generate perfect passwords every time - a well-known URI for password managers to do zero-touch password rotation. - actual elements for login components to close the confused deputy attack for password managers. All these things…

If you're copying passwords out of a password manager and pasting them into password fields, then yes, you're getting a significant improvement to phishing protection with a hardware key. If you're using the password manager's autofill feature, and that autofill feature is bug-free, then you're not getting any additional phishing protection. Your passwords can still be stolen, however. Any hardware authentication mec…

If the password manager stores the requesting site with the secret, either manually or through TOFU, then it has an opportunity to provide better phishing protection than manual copying.

This is how Android Password Store [1] works, and it regularly triggers a phishing warning (that I have to override with multiple taps) when I'm trying it out by attempting to autofill a password for one app with the password associated with a different app ID.

Granted, I also use it with my Yubikey, because that's what holds the GPG decryption key.

[1]: https://github.com/android-password-store/Android-Password-S...

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#239

Post by bradstewart »

bpye wrote: post #217
georgyo wrote: post #59

Earlier quoted context omitted.

It's actually horrible! Even key rotation is horrible! My yubikey is getting to about 10 years old, and I have replacements for it but find it very difficult to switch. It will eventually fail as an things do and it will be problematic. The problem is that I have several dozen accounts connected to it and I don't know all of them. So either I'm carrying and trying multiple keys at all times or not getting into a site…

I’m going to need to work this out soon. I picked up a pair of new YubiKey 5Cs yesterday with their sale. I’ve been using a YubiKey Neo for years for U2F, TOTP and GPG. Moving the GPG key is easy - though I might try using the FIDO2 support in SSH instead. However for every TOTP and U2F key I’m going to have to re-enroll the new keys… It feels like there should be a better way.

It would indeed be nice if you could "cross sign", CA style, a new yubikey with an old one, and that would somehow get passed along to the various services.

I have not thought about the various attack vectors that this may or may not enable though.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#240

Post by stavros »

fmakunbound wrote: post #187

Reading through the threads here: If the HN can't articulate FIDO and differences between it and the now decades old password model to each other, I think regular jack-offs are going to have trouble. People have the mental model that their secret is stored in their gray matter/post-it note/password manager, and now you're telling them it's in their phone, and somewhat related to the phone's security model, or maybe a…

FIDO is an authentication standard. It doesn't care where your secrets are, it just mandates a way to use them to log in to websites. You can still use a password manager, it will just basically contain a single encryption key for all sites.
Post reply on HN