Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

yubico.com

Post reply on HN
Print view View original

31–40 of 62 posts

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#31

Post by rightos »

moduspwnens14 wrote: post #26
akerl_ wrote: post #20

Earlier quoted context omitted.

Given that TOTP (one of the more common phone OTP methods, used by Google Authenticator) uses a symmetric key, it seems unlikely it’s being stored in the Secure Enclave

It may just require an extra step. My understanding of TOTP is that it's the key data (typically a string represented by a QR code) and a time offset that is used to generate the OTP. If the only thing stored on disk is the code encrypted by the secure enclave's key, and the only way the decrypted code is in memory at runtime is if it's decrypted by the secure enclave's key, then that still offers protection against…

You as an attacker would arguably have just as much trouble simply unlocking the device, you'd be left with the same amount of protection approximately. As long as you have disk encryption, the security margin would be about the same. A marginal improvement at best.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#33

Post by m-p-3 »

Spivak wrote: post #11
kevin_b_er wrote: post #5

Earlier quoted context omitted.

Allowing two way communication would permit innovation in connecting devices that are not subject to Apple's direct control.

Yeah, it's so annoying having to buy Apple brand Wi-Fi routers and Apple brand Bluetooth headphones.

Wait, your non-Apple bluetooth speakerphone allow you to speak, not only listen?!

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#35

Post by pilif »

jotux wrote: post #29
zaroth wrote: post #2

If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…

>I trust the secure element on the iPhone a lot more than I trust the hardware on the Yubikey. Why?

I don't know about the OP, but for me the reason is that it's made by a company with a much bigger profile than yubico

This means that it's under much higher scrutiny by the public. Due to that big profile I also expect security issues to be fixed quickly as Apple has much more reputation (and money) to lose than Yubico.

Finding exploits in the iPhone's secure element gains you much more fame than finding exploits in the Yubikey.

And finally, Apple has come out very publicly against aiding law enforcement and has a much bigger war chest to fight requests by law enforcement.

Yubico has neither.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#36

Post by buddylw »

blitmap wrote: post #7
zaroth wrote: post #2

If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…

Another neat solution: https://krypt.co/

I've been playing with this, and it's mostly good. It solves the key forwarding problem in nested Linux VMs (-A forwarding is kind of bad).

I do find it a bit silly that they don't support any iOS or android ssh clients, so they only way to authenticate ssh from an iphone is to connect to a VM first where the linux client is installed.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#37

Post by zaroth »

_asummers wrote: post #25
amelius wrote: post #23

Earlier quoted context omitted.

Why not? The iPhone is a personal computer (PC) after all, ironic as it may sound.

Your iPhone is a second factor to all devices except itself.

Regardless of what screen you are authenticating on, a key stored on the iPhone secure element can always be considered to be a factor in the authentication process.

If are logging into a site on your mobile device, and part of the authentication verifies your password and another part verifies that you are in fact on your mobile (e.g. verifying a signature of a private key stored on the device) I would still call that multi-factor authentication.

Optionally, there may be a user prompt on the device before allowing the signature.

Optionally, the user prompt could also require a local biometric authentication (3rd factor).

Or there could be no prompt at all — just a automatic handshake proving it is the same device being used that was originally enrolled.

In any case you are constraining the authentication process to only work with access to a specific private key, hence a second factor.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#38

Post by sweden »

pilif wrote: post #35
jotux wrote: post #29

Earlier quoted context omitted.

>I trust the secure element on the iPhone a lot more than I trust the hardware on the Yubikey. Why?

I don't know about the OP, but for me the reason is that it's made by a company with a much bigger profile than yubico This means that it's under much higher scrutiny by the public. Due to that big profile I also expect security issues to be fixed quickly as Apple has much more reputation (and money) to lose than Yubico. Finding exploits in the iPhone's secure element gains you much more fame than finding exploits in…

But an Yubikey is a passive and isolated device: it doesn't turn itself on, it doesn't run any apps, it doesn't connect to the internet. And if it gets compromised (stolen or exploited), it's cheap enough to throw it away and to replace it with a new and improved version without any hassle.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#39

Post by zaroth »

Spivak wrote: post #12
zaroth wrote: post #2

If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…

For the purposes of 2FA, your physical machine typically doesn't count as 'something you have' and your phone is really no different.

If I install a TOTP generator on a machine and setup 2FA on a 3rd party service, and I then later login with a password and a 6 digit TOTP code, that is definitely 2FA.

You can argue my TOTP shared secret may or may not be secure enough from malware. But it’s definitely 2FA and it successfully protects against the attack vectors that adding a “something you have” factor is designed to protect against. Better than SMS codes, for sure.

Could the TOTP shared secret be stolen if it’s kept in a file on my desktop? Of course! But that fundamentally changes the attack vector from the typical password spraying attack because now an attacker needs to directly target me and compromise my machine.

If the TOTP shared secret is in the iPhone secure element and protected by the iOS sandbox, no consumer application could reasonably ask for anything better than that. That’s $1B of security R&D on your side.

Another way to think about it is that on-device TOTP is “something you have” just like a saved password is something you have.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#40

Post by monocasa »

donarb wrote: post #14
jpdb wrote: post #3

Earlier quoted context omitted.

Do iPhones allow access to the underlying TPM devices? I personally don't believe things like Google Authenticator are a good "something you have" second factor as the "something you have" is just a string stored in a sqlite database. Much easier to covertly copy that than a hardware key where the string is burned into the key.

Google Authenticator is not a password storage app. It produces time-based hashes that expire every 60 seconds. https://en.wikipedia.org/wiki/Time-based_One-time_Password_a...

Google authenticator generates those hashes from a plaintext key stored on device in a SQLite database. If you can read /data, then you can generate any hashes that Google Authenticator can.
Post reply on HN