The transition from logins to cryptographic passkeys is getting messy
31–40 of 154 posts
Re: The transition from logins to cryptographic passkeys is getting messy
#32Earlier quoted context omitted.
> also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... May I humbly suggest you RTFM before posting FUD. You can set a PIN on the Yubikey (or on the Yubikey Bio's, your fingerprint). Further, the PIN will block after three failed attempts, requiring the PUK to reset the PIN. Key loggers are of course defeated by the Yubikey's touch requiremen…
Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? if so keyloggers would work as before
> Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry?
It only uses the keyboard in the OTP mode[1] (which you don't have to use, and you can even configure to completely disable). I guess OTP mode is probably the one you were thinking of ?
To be honest other than the Yubico demo website, I've never come across a resource in the wild that uses Yubikey OTP mode login anyway. :)
I'm not familiar with the technicalities of OTP mode but I'm guessing its resilient to replay attacks, so key loggers could still be limited that way.
For all other modes (PIV, FIDO, PGP) it doesn't.
I believe there is an option to store a static string in the Yubikey and replay that on-demand when you touch it ... but, well, I'd say you're on your own if you choose that option !
Re: The transition from logins to cryptographic passkeys is getting messy
#33Oh, what could go wrong! Why is there no discussion on users losing their private keys? Ask all those cryptocurrency users who lost their private keys. Now don't tell that there are crypto wallets/vaults that manage private keys; there are many ways key can be lost even when using wallets/vaults. We engineers live in a different world, disconnected from the regular users who have no clue what public-private keys are!
The standard mantra for physical key-based 2FA has always been "register two keys and keep one in a safe", which seems doable for important accounts (like banks and government stuff) but no way am I going to get a key out of my safe when I want to order a replacement part on JoesDiscountDishwasherParts.biz. I really wish there was a way to register your backup key through your primary key.
Luckily, FIDO2 can fix a lot of these problems. People who don't have significant security needs can use a trusted service (currently Apple, Google, and a few small companies) rather than a physical device. Lose your phone? As long as you can get your account onto a new one, you can still access all of your stuff.
Once this type of auth will take off, I can imagine a business model for a FIDO2 company that focuses on customer service. The only problem with the system right now is that if you can't log in to your Apple/Google/whatever account, there's no recovery. Try contacting customer support and see how long it takes until they just block your number, because there is nothing they can do.
Having a business where you can go to a physical office and show up with ID so you can get your account back would solve this problem. Recovery would still be a massive pain, but it's better than spending years on a legal battle like some people trying to get their pictures back from their cloud providers after getting locked out.
Re: The transition from logins to cryptographic passkeys is getting messy
#34Oh, what could go wrong! Why is there no discussion on users losing their private keys? Ask all those cryptocurrency users who lost their private keys. Now don't tell that there are crypto wallets/vaults that manage private keys; there are many ways key can be lost even when using wallets/vaults. We engineers live in a different world, disconnected from the regular users who have no clue what public-private keys are!
Passkey is a concept that even the majority of tech enthusiasts seem not to have groked as of today. The thing that google/Apple have brought to the table is cloud backup of your private keys (yes, you should have lots of questions about how that is managed). This should enable disaster recovery/device transition for people using a phone as one of their passkeys. You’d probably add a fingerprint from your laptop for convenience, and if that laptop is all you have then no disaster recovery for you.
However, to be fair, if people have one of something it’s going to be a phone. If you use google or android, then those keys are backed up into the cloud “securely”. Those keys are also “secured” on the device. Not as good as HSM, but if you dig into the details it’s probably much more solid than you’d expect.
Re: The transition from logins to cryptographic passkeys is getting messy
#35Just give me password auth back. I work in a lab that requires fingerprint login (TrustKey FIDO keys) with no fallback. Every 6-8 weeks I need to have my keys reset with new prints, which is a process that involves meeting a member of the security team in a room for 20 minutes so my key and the backup key (kept in a safe by the firm) can both be reset. Everyday, without fail, I sit there like a chimp taking on averag…
How does that work for people with poor/unreadable fingerprints? We're 3% of the general population apparently.
A sane setup would provide an alternative to unlock the passkey, with a PIN.
Yes, you're back to entering a password, but you don't have most of the weaknesses and pitfalls of password-based logins in distributed systems (phishing,credential stuffing,keyloggers probably a few others).
Re: The transition from logins to cryptographic passkeys is getting messy
#36Part of the problem is that right now the most convenient use of things like yubikeys is that the most convenient use of them is just leave them in your computer wherever they may be. That makes them a pretty hard sell for any workplace environment, but also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... Seems like 2FA is the future...
For most digital services, physical theft is one of your least concerns. Someone can just take your laptop and extract your session token, who even needs a Yubikey?
The problem these keys solve is that humans suck at managing passwords. Password managers are nice, but they're also protected by passwords, and humans suck at using those protective passwords.
I'm all for 2FA, but I'd like to see websites switch to key-then-password rather than password-then-key. Most people won't turn on 2FA and physical keys are a lot safer in today's world of leaked passwords galore than passwords.
If you don't enable 2FA and default to using a key, you can still do the whole "forgot password" (or rather, "lost my key") routine to reset your authentication through email.
Re: The transition from logins to cryptographic passkeys is getting messy
#37> Another big challenge with establishing consistency and continuity will be the long transition to passkeys alone. If I wanted passwordless login, why wouldn't I just hit the big 'sign in with facebook' button practically every website has these days?
I deleted my Facebook account. I lost access to several accounts that way, luckily none of them were important.
At least this time I chose to close my account. Next time it can be Facebook/Google/Microsoft/Twitter/Apple who decide that you're a robot/fraud/whatever after receiving a bunch of automated reports.
If Google ever bans me, I'm screwed in many different yet interesting ways.
Re: The transition from logins to cryptographic passkeys is getting messy
#38Earlier quoted context omitted.
This is an extraordinarily bad take. :) - The biggest threat almost all users face is in the form of remote attackers: password phishing, database leaks + password reuse, tricking users into installing malware, etc. Local attackers are so far down the list of concerns that, really, using unique passwords and storing them on Post-Its is, for most people, an improvement in security! - Leaving a Yubikey in the computer…
> The biggest threat almost all users face is in the form of remote attackers I'm not sure what users you interact with most on a regular basis, but for a pretty significant portion of the population, the most likely threats to their online (and offline) safety are jealous boyfriends/spouses/parents
Actually a valid point, but if you're gonna be that condescending about someone not considering that part of the population you should have something better than weasel words to argue how big it is.
Re: The transition from logins to cryptographic passkeys is getting messy
#39Doesn't this just mean handing over authentication keys to proprietary systems?
I couldn't find a single open source hardware FIDO L2 implementation.
Looking at the specification, is it even possible for an open source implementation to gain L3+ certification?
Re: The transition from logins to cryptographic passkeys is getting messy
#40Earlier quoted context omitted.
Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? if so keyloggers would work as before
> Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? It only uses the keyboard in the OTP mode[1] (which you don't have to use, and you can even configure to completely disable). I guess OTP mode is probably the one you were thinking of ? To be honest other than the Yubico demo website, I've never come across a resource in the wild…
Anecdotal, though about half of services that I have used only support Yubikeys with OTP mode. PingID does and I think Lastpass does too.
I don't use either of them through choice though...