Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard • Hacker News Board

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#341

Post by lxgr » Thu, May 05, 2022, 7:20 PM UTC

mmis1000 wrote: post #328

lxgr wrote: post #308

Earlier quoted context omitted.

At least the WebAuthN standard seems to be moving in a different direction [1], which is also surprising to me. In a nutshell, it will be possible for relying parties (i.e. websites) to detect multi-device/backup capable authenticators if required, but disabling multi-device functionality would require a very explicit opt-out, not an opt-in, on the relying party's side. [1] https://github.com/w3c/webauthn/issues/1714

That seems to make fido just a non human readable/rememberable account/password. A somewhat downgrade from original hardware enforced implementation. But also make it more usable to majority of people, because keep something without losing it is just a pain to many people(where is my fxxking key goes again?). And it is still 1000x better than people using same password on every website.

It's much more than a non-rememberable password: One of the most important attributes of WebAuthN/FIDO is that it's fundamentally impossible to fall victim to phishing.

Assuming your browser isn't itself compromised, it is impossible to authenticate using a key for service.com on evil.com. Passwords can't do that. (PAKEs or other challenge/response protocols theoretically could, if implemented in the browser and not on websites, but that's a different story.)

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#342

Post by snarf21 » Thu, May 05, 2022, 7:24 PM UTC

snarf21 wrote: post #256

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

I wish FIDO was built into the phones (enclave) requiring a biometric and passcode. For 99% of users this would be superior to email/password and get rid of a lot of hacks/phishing. It doesn't require extra hardware to buy and simply requires a minor protocol update to have the challenge on a laptop/desktop show as a QR-code (or could be sent via BT). The mobile sends the response out of band to a destination set at…

Let me be more specific, this should work in apps not just the browser and should work with my logging into my laptop in the browser and leveraging my phone as a FIDO "key".

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#343

Post by sdfgdfgbsdfg » Thu, May 05, 2022, 7:26 PM UTC

jeroenhd wrote: post #335

blibble wrote: post #329

Earlier quoted context omitted.

TPMs don't generally store encrypted data (bar their master key) instead they wrap/seal everything instead with a layer of crypto, then you can pass that wrapped object around as much as you want, only the TPM can unseal it a TPM could easily be instructed to seal an internally generated secret with additional escrow keys for MS/Apple/... that plus remote attestation could make it so you can never see the key in the…

As far as my understanding goes this sealed secret is device specific and connected to the TPM master key. That would mean you could pass it around, but you'd need to have the blob on the device itself to actually use it. The problem is that you need private/public key pairs that are synchronised across devices for FIDO to work properly cross-device. When you register an account on your phone, you need that account k…

Yes but what the OP is saying is that the TPM does not store the encrypted passkey, rather, the passkey is wrapped with this TPM's public key by another TPM that already trusts this TPM, so this TPM can import a passkey that's been wrapped with its own public key and store it unencrypted. See Apple's circle of trust: https://support.apple.com/guide/security/secure-keychain-syn...

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#344

Post by dwaite » Thu, May 05, 2022, 7:31 PM UTC

0daystock wrote: post #83

throwaway52022 wrote: post #74

I don't trust Google or Apple to be my main authentication provider, or to manage syncing my private key. Their customer service is terrible and they are way too arbitrary on locking folks out. I would trust my bank (well, my credit union.) I can go see them in person if I need to and they take my lawyer seriously, they also take security seriously, they're properly regulated, and ultimately they're my main concern i…

This announcement isn't about that and neither provider is asking to sync your private key. In fact the opposite is true: with FIDO2, you're in much greater control of your account security because authentication creds are now on a hardware token versus as bearer credentials you type and an adversary can steal and replay. Many of us believe we're very good at protecting our passwords, but this isn't true in reality a…

This announcement is partially about the platform-integrated authenticators being made into 'virtual' authenticators backed by a platform vendor-specific cloud ecosystem. So for example, a credential registered on an iPhone may be synchronized over iCloud Keychain to work to log in my Mac via TouchID.

This is something which has always been as part of the model - an authenticator is just an abstract thing that represents an authentication factor, generates keys for a particular use, and doesn't share private keys outside its boundaries.

This announcement possibly marks a transition where sites supporting Web Authentication (with a bring-your-own-authenticator model) will go from seeing 90%+ hardware-bound authenticators to seeing 90%+ platform-integrated, synchronizing authenticators. Bundled into that prediction is a hope that this (and other proposed changes) will lead to a 10x increase in adoption.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#345

Post by [deleted] » Thu, May 05, 2022, 7:32 PM UTC

_vdpp wrote: post #280

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

I think the whole point of HSMs is that you can’t back up (read: exfiltrate) the master secrets. Having said that, on certain Yubikeys you can store PGP keys on them, and put the same secret key on several different Yubis. If you’re relying on a hardware key it’s probably a good idea to have a backup key and make sure both are registered with whatever system you’re accessing. LastPass and GitHub at least support addi…

[deleted]

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#346

Post by matheusmoreira » Thu, May 05, 2022, 7:35 PM UTC

anthony_r wrote: post #96

eMGm4D0zgUAVXc7 wrote: post #91

Earlier quoted context omitted.

> It's very hard to make a privacy case against FIDO. With username and password, I have full control over my privacy in a very easy to understand fashion: If I randomly generate them I know I cannot be tracked (as long as I ensure my browser doesn't allow it by other means). With those keys I have a opaque piece of hardware which transfers an opaque set of data to each website I use and I have NO idea what data that…

> Which is rather likely, because why else would big tech companies push this if it didn't benefit them in some way? They switched to this internally a long time ago which basically eliminated phishing attacks against employees. There are security teams inside those megacorps that have a general objective of reducing the number of account takeovers, and non trivial resources to accomplish that. Not everything is a co…

> There are security teams inside those megacorps that have a general objective of reducing the number of account takeovers

The same corporations that routinely intercept all network traffic.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#347

Post by xdennis » Thu, May 05, 2022, 7:35 PM UTC

vngzs wrote: post #38

throwaway52022 wrote: post #35

I've resisted switching to a hardware key because I know that I'm going to break it, and that seems like a huge pain in the ass. I really want to be able to make a couple of backup keys, or maybe put another way, I want to be able to put the private key on the device myself, I don't necessarily care that the key is generated on the device and never leaves the device. I don't care if that slightly reduces my security…

You just register 2-3 keys. It's not so bad.

Why do people always say this? Do you not know how expensive they are?

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#348

Post by dwaite » Thu, May 05, 2022, 7:38 PM UTC

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

The vendors here are proposing a platform synchronization method such that these are both backed up as well as shared across devices within a particular platform account.

There likely is a hardware key that supports export and import of keys (even if that winds up being a fork of say the Solo key firmware). However, as an end-user one doesn't want to accidentally forget to export keys for a while, nor do they want to worry about how to properly secure a backup. So, you likely would want additional infrastructure such as vendor software which would do this for you on a schedule.

There are interesting models which could work here, such as a factory-paired 'set' of keys being sold in the same package, where only the second key (the one you kept in your fire safe) has the necessary keys to decrypt and load such a backup.

The question is whether a security manufacturer would be interested in this, as the presence of such a mechanism may prevent them from getting certain security certifications and being able to sell/be used in certain markets and scenarios.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#349

Post by adrian_b » Thu, May 05, 2022, 7:38 PM UTC

_vdpp wrote: post #280

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

I think the whole point of HSMs is that you can’t back up (read: exfiltrate) the master secrets. Having said that, on certain Yubikeys you can store PGP keys on them, and put the same secret key on several different Yubis. If you’re relying on a hardware key it’s probably a good idea to have a backup key and make sure both are registered with whatever system you’re accessing. LastPass and GitHub at least support addi…

The ability to have a backup does not imply any ability to exfiltrate the master secrets.

It is enough to have a means to wipe out any information contained in the device, including any master secret.

At that point, there should be a means to enter a new master secret in the blank device, before proceeding to use it normally.

If a device provides this feature and it does not contain any other secret information introduced in it by the manufacturer, then it allows the owner to have any kind of backup that is desired.

I am also one of those who would never use a security device that contains any kind of secret information that is not under my control.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#350

Post by jeroenhd » Thu, May 05, 2022, 7:39 PM UTC

sdfgdfgbsdfg wrote: post #343

jeroenhd wrote: post #335

Earlier quoted context omitted.

As far as my understanding goes this sealed secret is device specific and connected to the TPM master key. That would mean you could pass it around, but you'd need to have the blob on the device itself to actually use it. The problem is that you need private/public key pairs that are synchronised across devices for FIDO to work properly cross-device. When you register an account on your phone, you need that account k…

Yes but what the OP is saying is that the TPM does not store the encrypted passkey, rather, the passkey is wrapped with this TPM's public key by another TPM that already trusts this TPM, so this TPM can import a passkey that's been wrapped with its own public key and store it unencrypted. See Apple's circle of trust: https://support.apple.com/guide/security/secure-keychain-syn...

I understand that, but that's not supported by any current standard as far as I know. We'll need a new TPM standard for this, which probably also means it will take years before every device supports this feature as modern computers can easily last five to seven years if you replace the batteries and don't cheap out. FIDO needs something that works now, or maybe tomorrow.