Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using FIDO keys

777.tf

Post reply on HN
Print view View original

31–40 of 65 posts

Re: Using FIDO keys

#31

Post by stavros »

coffee33go wrote: post #22
DistractionRect wrote: post #5

I have a couple v1 Solokey Somus lying about. Good little devices. Unfortunately the main selling point of upgradeable firmware is moot if they no longer support the old devices and you have to upgrade. At that point it's they're like everyone else. Except they require some setup on some machines, whereas other keys "just work" I've since replaced them with yubikeys. Yubikeys have a better feature set (at least compa…

Are you sure? apt-get install solo-python One can update the firmware.

My key won't get upgraded (it just pretends to install the upgrade, says done, and the key stays on the same version).

Re: Using FIDO keys

#32

Post by stavros »

aborsy wrote: post #15

This space is confusing. FIDO2, U2F, UAF, CTAP, WebAuth, Passkey, 2FA, … The names frequently change. Aren’t all of them just public key authentication (with the private key in a mini-HSM, and public key either calculated in real-time, or stored, in the HSM, and synced externally)?

They are all just public key authentication with a protocol on top to enable various use cases. For FIDO2/WebAuthn/passkeys, the device, on registration, gives the website the public key to use for subsequent authentications.

Re: Using FIDO keys

#33

Post by stavros »

jaefi wrote: post #28
guerby wrote: post #26

After looking at various keys and their features I chose basic FIDO2 with NFC with no storage or other fancy feature. Keys with lots of feature have a larger code base and this means more bugs in the long term. I use my FIDO2 keys for proxmox, ssh ed25519-sk, vaultwarden, nextcloud, GAFAM accounts. Unfortunately I know of no bank that has adopted FIDO2/webauthn. Note: Paypal only allows one FIDO2 key AFAIK, so not an…

Looking at bank security is probably the saddest landscape around. Most will ask you for a PIN at maximum and then tell you it's not possible to have stronger authentication because of "safety". I wish there was stronger laws forcing banks to adopt stuff like that.

I wish there were laws making it the bank's problem if your account gets hacked. The security they choose to use is secondary, but you bet they'd be the most secure websites around if they were liable for the losses.

Re: Using FIDO keys

#34

Post by stavros »

timwis wrote: post #18

As much as I want a hardware key, I still struggle with the practicality of having a backup key. I create new accounts on websites quite often, and the idea of having to go fetch my backup key out of a safe to register it (and hope the site allows multiple keys) just feels impractical (“I’ll do it tomorrow”). Not to mention—what if I’m at work, or out and about setting it up on my phone? Am I really going to remember…

You can use a software passkey and still get 99% of the benefit. For the other 1%, you can't have it both ways, where a hardware key is both required and not required to sign in.

Maybe there can be better UX around signing up, ie "give me your public keys so I can set them up in your account", but then you lose a lot of the privacy, because the public keys aren't different per site any more (and operators can then tell the same person has an account on multiple sites).

Re: Using FIDO keys

#35

Post by stavros »

dandanua wrote: post #17
navigate8310 wrote: post #11

Earlier quoted context omitted.

One thing to keep in mind before buying their NFC keys is that it can only store up to 10 resident keys

I don't think resident keys are that worthwhile. Relaying party anyway has to remember the user somehow, even if it's just the public key. And it still has to associate the key with the user data. I think resident keys just complicate things for users and developers.

Resident keys are great, I don't have to remember usernames. I don't care what the RP does, I care that I can sign in with one click.

Re: Using FIDO keys

#36

Post by tialaramex »

aborsy wrote: post #15

This space is confusing. FIDO2, U2F, UAF, CTAP, WebAuth, Passkey, 2FA, … The names frequently change. Aren’t all of them just public key authentication (with the private key in a mini-HSM, and public key either calculated in real-time, or stored, in the HSM, and synced externally)?

There are a bunch of related but distinct technologies with names here. For example:

CTAP is a protocol for say a PC, or a Phone to talk to an authenticator, maybe over USB or maybe Bluetooth.

WebAuthn is a W3C standard for how a web site can negotiate (via Javascript) exactly what we're going to authenticate and then perform the authentication.

Imagine you connect an external CD drive to your laptop. The CD can turn Red Book CD audio into PCM data, maybe the drive plugs in with a USB-C cable, and the drive uses a SCSI-based Mass Storage variant USB protocol to talk to the laptop, which has an XHCI USB controller, so your operating system needn't know the fine details of this precise PCI USB controller chip. Again, distinct technologies with their own names.

Re: Using FIDO keys

#37

Post by timwis »

twicetwice wrote: post #29
timwis wrote: post #18

As much as I want a hardware key, I still struggle with the practicality of having a backup key. I create new accounts on websites quite often, and the idea of having to go fetch my backup key out of a safe to register it (and hope the site allows multiple keys) just feels impractical (“I’ll do it tomorrow”). Not to mention—what if I’m at work, or out and about setting it up on my phone? Am I really going to remember…

My "solution" to this problem is: hardware keys with backups for the really important services—Bitwarden, Google, domain registrar, etc. And then for stuff that isn't absolutely critical, I just use an OTP stored in Bitwarden. As for having both the password and OTP stored in the same place, the way I see it, the OTP is mainly protecting against keyloggers, data breaches, etc. And then I figure, if someone gets into…

That sounds like a pretty reasonable solution, just doing it for the ‘crown jewels’.

The OTP in the password manager one is another thing I’ve struggled to wrap my head around. There’s an interesting conversation about it with folks at 1Password for those interested: https://1password.community/discussion/101714/why-is-it-a-go...

Re: Using FIDO keys

#38

Post by jeroenhd »

aborsy wrote: post #15

This space is confusing. FIDO2, U2F, UAF, CTAP, WebAuth, Passkey, 2FA, … The names frequently change. Aren’t all of them just public key authentication (with the private key in a mini-HSM, and public key either calculated in real-time, or stored, in the HSM, and synced externally)?

There are two names that the end user should see today (WebAuthn for older apps, Passkey for modern stuff). U2F is a pretty old name that may still pop up, but I'm not sure if any user facing software ever used that name to begin with. Most likely, the names facing the user are "security key" or "passkey".

FIDO2 is a standard set up by a couple of authentication companies and stakeholders. U2F was basically an earlier attempt at that. FIDO UAF is a protocol for authenticating, CTAP is a protocol for communicating with hardware. 2FA is just a generic term for "multiple factors", like combining a PIN with your fingerprint. WebAuthn is the web API for authenticating with security keys.

Most of them do indeed come down to public key cryptography. The challenge is providing a public key API that works across hardware vendors, supports attestation, and allows for things like "use your phone to verify your login if your computer's TPM isn't sufficient". They all solve a different problem in the chain, and the names have changed a bit over the decades.

If you're building software now, use the word "passkeys". Apple and Google have stuck with those names, and they're named a lot friendlier than "WebAuthn".

Re: Using FIDO keys

#39

Post by zinekeller »

stavros wrote: post #33
jaefi wrote: post #28

Earlier quoted context omitted.

Looking at bank security is probably the saddest landscape around. Most will ask you for a PIN at maximum and then tell you it's not possible to have stronger authentication because of "safety". I wish there was stronger laws forcing banks to adopt stuff like that.

I wish there were laws making it the bank's problem if your account gets hacked. The security they choose to use is secondary, but you bet they'd be the most secure websites around if they were liable for the losses.

You won't probably get what you wish for: this is how it works in South Korea but the solution that the banks went is worse than SMS-OTP, where your bank is expected to monitor your computer (https://palant.info/2023/01/02/south-koreas-online-security-...).

Re: Using FIDO keys

#40

Post by jeroenhd »

twicetwice wrote: post #29
timwis wrote: post #18

As much as I want a hardware key, I still struggle with the practicality of having a backup key. I create new accounts on websites quite often, and the idea of having to go fetch my backup key out of a safe to register it (and hope the site allows multiple keys) just feels impractical (“I’ll do it tomorrow”). Not to mention—what if I’m at work, or out and about setting it up on my phone? Am I really going to remember…

My "solution" to this problem is: hardware keys with backups for the really important services—Bitwarden, Google, domain registrar, etc. And then for stuff that isn't absolutely critical, I just use an OTP stored in Bitwarden. As for having both the password and OTP stored in the same place, the way I see it, the OTP is mainly protecting against keyloggers, data breaches, etc. And then I figure, if someone gets into…

Now that Bitwarden supports passkeys, I hope the "copy 2fa code to clipboard" approach to 2fa integration will soon come to an end.
Post reply on HN