Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FIDO2 security key company publishes results of internal security audit

blog.doyensec.com

Post reply on HN
Print view View original

31–40 of 64 posts

Re: FIDO2 security key company publishes results of internal security audit

#31

Post by rsnor »

pooloo1 wrote: post #27
tptacek wrote: post #25

Earlier quoted context omitted.

Go on...?

Having a few vaults with security guards is a great deterrence as the reward is little for the high risk. Having many vaults with security guards draws a bit more attention...

I’m having trouble understanding what you’re saying.

You’d think we’d be better off even with the higher attention, were it to exist, because the level of attention going into making FIDO2 as secure as possible would scale with its userbase. Same with any other security solution being implemented.

Re: FIDO2 security key company publishes results of internal security audit

#32

Post by brazzy »

pooloo1 wrote: post #23
talkingtab wrote: post #17

I am probably wrong, but I think Fido2 keys should be ubiquitous. They provide a hardened solution for some security situations, certainly they could be a good 2nd factor or 3rd, and hopefully they could reduce the password madness we have. Yubico appears focused on the enterprise and high end users resulting in higher prices. Solokeys seems more focused on individual users with lower prices. Disclaimer I have two Yu…

Don't get me wrong I love the idea of physical/hardware security; however, isn't the reason it is so effective right now because it is not mainstream?

No. It's more effective because it's fundamentally more secure.

Re: FIDO2 security key company publishes results of internal security audit

#33

Post by brazzy »

ShakataGaNai wrote: post #16

I got a Solokey as part of the Kickstarter and love em. USB-C + NFC in one device. The one thing I'd love out of a security key is the ability to set up a "Twinned Pair". So I can have one key on my keychain that I use everyday and one I keep in my safe in case something happens to the primary. Yes, I know some services support multiple security keys - but setting up two is more work and not all services do support t…

The standard is actually designed specifically to prevent that.

Re: FIDO2 security key company publishes results of internal security audit

#34

Post by toastal »

moooo99 wrote: post #28

Physical hardware seems like a promising replacement for passwords. But is there any real adoption in consumer services right now? The only two services I know that suppport Fido2 are Google and GitHub. Are there any other big services I'm missing here?

Amazon Web Services supports it

Re: FIDO2 security key company publishes results of internal security audit

#35

Post by _8j50 »

talkingtab wrote: post #17

I am probably wrong, but I think Fido2 keys should be ubiquitous. They provide a hardened solution for some security situations, certainly they could be a good 2nd factor or 3rd, and hopefully they could reduce the password madness we have. Yubico appears focused on the enterprise and high end users resulting in higher prices. Solokeys seems more focused on individual users with lower prices. Disclaimer I have two Yu…

They offer more security so what you say is true,but there is always a cost-benefit calculation to be had. They solve the human user authentication problem really well,but they do have a cost of ownership significantly higher than just passwords or even software authenticators.

You have to keep in mind that attackers want passwords to get access to some resource,not to just collect your password. Evem with a yubikey, an attacker can still get access to session/auth cookies post authentication to get access to a desired resource.

If the cost makes sense to you, they are the best way to do it,but if not there is no shame in other sane factors of authentication like TOTP or software attested webauthn.

I would restate what you said and say FIDO2 and/or WebAuthn need to be ubiqutous. It should be easy for some random guy working on ASP.NET site or something to support them.

right now even if you have it ,you can login to a handful of sites and that's it. For companies,they need to do SSO for everything with a yubi if they go that route.

Re: FIDO2 security key company publishes results of internal security audit

#37

Post by NicolaiS »

dochtman wrote: post #36

So I have a SoloKey. How do I check what firmware it is running? Is the firmware upgraded automatically, or do I have to do something? The SoloKey website from some quick skimming doesn't seem to have any information on the topic.

You can see the version and update it using their (deprecated) website: https://update.solokeys.com/

Re: FIDO2 security key company publishes results of internal security audit

#38

Post by kelnos »

martin8412 wrote: post #14
frankharv wrote: post #12

Earlier quoted context omitted.

The YubiKey hardware with its integral firmware has never been open sourced. https://www.yubico.com/blog/secure-hardware-vs-open-source/

Okay - So reading through that I get two impressions. They can't release source code because they use proprietary hardware. Secondly they believe that security through obscurity is better than publishing the code for everyone to see.

I doubt they keep it closed as a (dubious) security measure. Likely they believe the source gives them some sort of competitive advantage. (Not saying they're right or wrong about that, just that's likely what they believe.)

Re: FIDO2 security key company publishes results of internal security audit

#39

Post by Iolaum »

dochtman wrote: post #36

So I have a SoloKey. How do I check what firmware it is running? Is the firmware upgraded automatically, or do I have to do something? The SoloKey website from some quick skimming doesn't seem to have any information on the topic.

Their github repository of their python command line tool should have all the info you need.

https://github.com/solokeys/solo-python

Re: FIDO2 security key company publishes results of internal security audit

#40

Post by microtonal »

XMPPwocky wrote: post #18
ecesena wrote: post #7

Earlier quoted context omitted.

OpenPGP is arriving, will be available via firmware upgrade. https://github.com/solokeys/openpgp

Note that for a PGP key, the idea of using cheap microcontrollers is significantly worse. U2F/FIDO2, sure, whatever- the worst failure state there is "your account is only secured by a password", and more likely attacks require physical access. I could post the secrets off the security key I use for my Google account right now and...eh, I'd probably be fine. PGP? Ohohohoh. Now we're talking about long-term keys and n…

If I leak your keys once- say, through power analysis, glitching, whatever- I can decrypt everything that has ever been encrypted for that key, and everything that ever will be.

Doesn't it depend on the threat model? If your thread model does not include physical access compromise, then the commodity STM32 approach is quite ok right? At least, in most cases it provides more security than storing the private key on disk.

I do agree that given the low prices of secure elements it is surprising that keys still don't use them. But that may depend on the lower-priced parts not being fit for FIDO2 or OpenPGP (though the Nitrokey FIDO does use an ATECC608A).

Post reply on HN