Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

yubi.co

Post reply on HN
Print view View original

31–40 of 45 posts

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#31

Post by petejansson »

mark_l_watson wrote: post #30

I don't like something that I have to plugin. What I greatly prefer is what PacBell gave me as a consultant in the 1990s to access their secure inner networks remotely: a device that would display a new random number every 10 seconds and I would add that number to my password when logging in. I was given the same sort of device at Google in 2013 when I was a consultant there. For laptop and mobile devices, I like the…

A serious problem with biometrics is credential revocation. The best answer I've seen to this is using the biometric to locally unlock some other credential like a certificate that can be revoked. There are other problems that are flashier, like spoofing and liveness, but revocation is a real show-stopper that is frequently ignored.

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#32

Post by [deleted] »

mongol wrote: post #20
talkingtab wrote: post #11

Just to be clear, "Yubikey" is a brand of FIDO key. See: https://fidoalliance.org . You can find other brands which in my experience, are just as functional but often less expensive. I have a yubikey, one from hyperfido and most interesting is the open source 'U2F zero'. All of them work equally well. Unless MS has a non-standard implementation or does not use FIDO, then any FIDO would work.

No it is not. There are yubikeys that implement U2F but Yubikeys also provide more. In this case, their specific U2F key is not listed as requirement. So this is most likely not implemented using U2F.

[deleted]

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#33

Post by rcm239 »

talkingtab wrote: post #11

Just to be clear, "Yubikey" is a brand of FIDO key. See: https://fidoalliance.org . You can find other brands which in my experience, are just as functional but often less expensive. I have a yubikey, one from hyperfido and most interesting is the open source 'U2F zero'. All of them work equally well. Unless MS has a non-standard implementation or does not use FIDO, then any FIDO would work.

This YubiKey implementation is not FIDO U2F - it is using a challenge and response technique with HMAC-SHA 256 – here is a bit more detail from Microsoft https://msdn.microsoft.com/en-us/windows/uwp/security/compan...

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#34

Post by luma »

homakov wrote: post #28
qplex wrote: post #23

Does it protect you also from the spy/ad/malware that Windows 10 is?

I'll extend the question: from what does it protect at all? (Answer: nothing, FIDO keys is a hype)

Can you expound on that a bit? It seems like a reasonable solution for a hardware security token. What don't you like about FIDO keys?

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#35

Post by lima »

mark_l_watson wrote: post #30

I don't like something that I have to plugin. What I greatly prefer is what PacBell gave me as a consultant in the 1990s to access their secure inner networks remotely: a device that would display a new random number every 10 seconds and I would add that number to my password when logging in. I was given the same sort of device at Google in 2013 when I was a consultant there. For laptop and mobile devices, I like the…

Those are considered deprecated by now. The most important issue with those devices is that they're not secure against phishing.

If you accidentally input your credentials and PIN code in a phishing site, it's game over.

With FIDO tokens, this is impossible - authentication is challenge-response based and tied to the encrypted channel. Your device contains a private key which is used to authenticate. This requires two-way communication, so you have to plug in the device.

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#36

Post by seanp2k2 »

lima wrote: post #35
mark_l_watson wrote: post #30

I don't like something that I have to plugin. What I greatly prefer is what PacBell gave me as a consultant in the 1990s to access their secure inner networks remotely: a device that would display a new random number every 10 seconds and I would add that number to my password when logging in. I was given the same sort of device at Google in 2013 when I was a consultant there. For laptop and mobile devices, I like the…

Those are considered deprecated by now. The most important issue with those devices is that they're not secure against phishing. If you accidentally input your credentials and PIN code in a phishing site, it's game over. With FIDO tokens, this is impossible - authentication is challenge-response based and tied to the encrypted channel. Your device contains a private key which is used to authenticate. This requires tw…

What makes it impossible for a phishing site to mimic the challenge?

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#37

Post by lima »

seanp2k2 wrote: post #36
lima wrote: post #35

Earlier quoted context omitted.

Those are considered deprecated by now. The most important issue with those devices is that they're not secure against phishing. If you accidentally input your credentials and PIN code in a phishing site, it's game over. With FIDO tokens, this is impossible - authentication is challenge-response based and tied to the encrypted channel. Your device contains a private key which is used to authenticate. This requires tw…

What makes it impossible for a phishing site to mimic the challenge?

The challenge-response protocol is using assymetric cryptography and is tied to the SSL session ID.

More explanations on why: https://security.stackexchange.com/questions/71316/how-secur...

And how: https://fidoalliance.org/specs/fido-u2f-v1.0-nfc-bt-amendmen...

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#38

Post by andrewstuart2 »

jrockway wrote: post #15
andrewstuart2 wrote: post #12

Earlier quoted context omitted.

Furthermore, just encrypt your disk with a password concatenated with said static yubikey password and you've got effective MFA.

I feel like a static password doesn't really count as MFA. Someone can keylog that static password without you knowing.

If it's long and random enough to be very hard to remember, then it's MFA, in my opinion. A private key (e.g. the one used for TOTP) is nothing more than a quantity of random bits (with specific properties, grant you). I'll give you that the output is certainly reusable for a statically stored key, but you're still adding a second factor that, barring some alternate attack like keylogging, still adds security beyond a password.

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#39

Post by nickik »

j_s wrote: post #16
talkingtab wrote: post #11

Just to be clear, "Yubikey" is a brand of FIDO key. See: https://fidoalliance.org . You can find other brands which in my experience, are just as functional but often less expensive. I have a yubikey, one from hyperfido and most interesting is the open source 'U2F zero'. All of them work equally well. Unless MS has a non-standard implementation or does not use FIDO, then any FIDO would work.

This is the part I don't understand... the Yubikey U2F-only option (1/2 the price) is not listed as supported by this application. As best I can tell, U2F as it is used today isn't supported by Windows Hello; this is a custom app to support the more advanced Yubikey products. Apparently there is some v2 of U2F coming down the pike that vendors are waiting for before implementing support; however, I couldn't find much…

Windows Hallo will usr FIDO 2.0 but this is just a normal HMAC ChallengeResponse, not FIDO.

Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey

#40

Post by nickik »

petejansson wrote: post #31
mark_l_watson wrote: post #30

I don't like something that I have to plugin. What I greatly prefer is what PacBell gave me as a consultant in the 1990s to access their secure inner networks remotely: a device that would display a new random number every 10 seconds and I would add that number to my password when logging in. I was given the same sort of device at Google in 2013 when I was a consultant there. For laptop and mobile devices, I like the…

A serious problem with biometrics is credential revocation. The best answer I've seen to this is using the biometric to locally unlock some other credential like a certificate that can be revoked. There are other problems that are flashier, like spoofing and liveness, but revocation is a real show-stopper that is frequently ignored.

The new FIDO UAF standard solves exactly this problem, all biometrics are only unlocking a local identifier preferable on Secure Element or in a Trust Zone.
Post reply on HN