Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

yubico.com

Post reply on HN
Print view View original

41–50 of 62 posts

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#41

Post by monocasa »

michaelt wrote: post #27
moduspwnens14 wrote: post #18

Earlier quoted context omitted.

Using the secure enclave, you (as a developer) can have it generate a private key you'll never be able to get and then ask it to sign / encrypt (symmetrically) arbitrary things for you. https://developer.apple.com/documentation/security/certifica... AFAIK that means it'll take more than a jailbreak to get to them, although I don't know if OTP apps are using that capability or not.

Sadly, the Secure Enclave doesn't support HMAC-SHA-1 or importing keys [1] so it's not compatible with the industry standard TOTP 2fa mechanism. [1] https://developer.apple.com/documentation/security/certifica...

I think we can do a lot better than the industry standard TOTP 2fa system anyway. TOTP involves sending plaintext private keys around during setup.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#42

Post by zaroth »

jotux wrote: post #29
zaroth wrote: post #2

If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…

>I trust the secure element on the iPhone a lot more than I trust the hardware on the Yubikey. Why?

In my eyes, the Yubikey is a bespoke toy compared to the latest-gen iPhone Secure Element.

Apple just has a lot more riding on their chip, and since they first introduced a secure element back in 2014 have spent perhaps 2 orders of magnitude more dollars on security R&D than Yubico ($4mm angel round in 2007, $30mm raised in 2017)

Apple’s secure element is in, what, more than a billion devices, and powers how many billions in Apple Pay? Yubikey by comparison ships devices that mostly nerds pile in their sock drawer with those old USB sticks they don’t use anymore.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#43

Post by zaroth »

sweden wrote: post #38
pilif wrote: post #35

Earlier quoted context omitted.

I don't know about the OP, but for me the reason is that it's made by a company with a much bigger profile than yubico This means that it's under much higher scrutiny by the public. Due to that big profile I also expect security issues to be fixed quickly as Apple has much more reputation (and money) to lose than Yubico. Finding exploits in the iPhone's secure element gains you much more fame than finding exploits in…

But an Yubikey is a passive and isolated device: it doesn't turn itself on, it doesn't run any apps, it doesn't connect to the internet. And if it gets compromised (stolen or exploited), it's cheap enough to throw it away and to replace it with a new and improved version without any hassle.

Stealing a Yubikey gives you immediate access to the 2nd factor, and I might not notice right away.

Stealing my iPhone gives you almost zero chance of accessing the second factor, I would notice a lot quicker, and I could revoke access (remote wipe) with a single click versus having to re-enroll a new 2FA at every single site individually.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#44

Post by [deleted] »

monocasa wrote: post #40
donarb wrote: post #14

Earlier quoted context omitted.

Google Authenticator is not a password storage app. It produces time-based hashes that expire every 60 seconds. https://en.wikipedia.org/wiki/Time-based_One-time_Password_a...

Google authenticator generates those hashes from a plaintext key stored on device in a SQLite database. If you can read /data, then you can generate any hashes that Google Authenticator can.

[deleted]

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#45

Post by azinman2 »

zaroth wrote: post #42
jotux wrote: post #29

Earlier quoted context omitted.

>I trust the secure element on the iPhone a lot more than I trust the hardware on the Yubikey. Why?

In my eyes, the Yubikey is a bespoke toy compared to the latest-gen iPhone Secure Element. Apple just has a lot more riding on their chip, and since they first introduced a secure element back in 2014 have spent perhaps 2 orders of magnitude more dollars on security R&D than Yubico ($4mm angel round in 2007, $30mm raised in 2017) Apple’s secure element is in, what, more than a billion devices, and powers how many bil…

But are there fundamental reasons why yubikey isn’t good? The amount of money spent doesn’t mean yubikey isn’t good, and they’re trying to accomplish different things (yubikey doesn’t have an OS running Facebook on it that could be used to attack itself, nor does it try to authenticate its secrets beyond a button press).

Note Google uses Yubikey to authenticate it’s employees into their laptops — hardly just nerds piling in their sock drawer.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#46

Post by gruez »

moduspwnens14 wrote: post #18
rightos wrote: post #16

Earlier quoted context omitted.

Are iOS Authenticator apps actually calculating OTPs on the Secure Element? Is there a way to execute arbitrary code on it? If not, they have to pull the keys off to the main CPU where they're open to attack like anything else. Still secured as private app data, still mostly protected, but an attacker with a jailbreak could still dump them. I know for a fact I can dump Google Authenticator keys from my Android device…

Using the secure enclave, you (as a developer) can have it generate a private key you'll never be able to get and then ask it to sign / encrypt (symmetrically) arbitrary things for you. https://developer.apple.com/documentation/security/certifica... AFAIK that means it'll take more than a jailbreak to get to them, although I don't know if OTP apps are using that capability or not.

>AFAIK that means it'll take more than a jailbreak to get to them, although I don't know if OTP apps are using that capability or not.

sure, you wouldn't be able to extract the keys, but what's preventing you from generating thousands of codes and extracting those instead? since they're time based, you could easily generate lots of them for a long time into the future (eg. 10 per day for the next 5 years). that should afford you plenty of opportunities to do a login attempt.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#47

Post by moduspwnens14 »

gruez wrote: post #46
moduspwnens14 wrote: post #18

Earlier quoted context omitted.

Using the secure enclave, you (as a developer) can have it generate a private key you'll never be able to get and then ask it to sign / encrypt (symmetrically) arbitrary things for you. https://developer.apple.com/documentation/security/certifica... AFAIK that means it'll take more than a jailbreak to get to them, although I don't know if OTP apps are using that capability or not.

>AFAIK that means it'll take more than a jailbreak to get to them, although I don't know if OTP apps are using that capability or not. sure, you wouldn't be able to extract the keys, but what's preventing you from generating thousands of codes and extracting those instead? since they're time based, you could easily generate lots of them for a long time into the future (eg. 10 per day for the next 5 years). that shoul…

This can't be used directly for generating OTP tokens (see the other comments), but what would stop you with a normal key on the secure enclave is that you can require the enclave itself requires a higher level of authentication (facial scan match, fingerprint scan) to perform those key operations.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#48

Post by YR372zm87 »

zaroth wrote: post #43
sweden wrote: post #38

Earlier quoted context omitted.

But an Yubikey is a passive and isolated device: it doesn't turn itself on, it doesn't run any apps, it doesn't connect to the internet. And if it gets compromised (stolen or exploited), it's cheap enough to throw it away and to replace it with a new and improved version without any hassle.

Stealing a Yubikey gives you immediate access to the 2nd factor, and I might not notice right away. Stealing my iPhone gives you almost zero chance of accessing the second factor, I would notice a lot quicker, and I could revoke access (remote wipe) with a single click versus having to re-enroll a new 2FA at every single site individually.

You can password protect the Yubikey. That's how mine is setup. Adds an extra step, but I don't worry about losing it.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#49

Post by acdha »

m-p-3 wrote: post #32

I kinda hope they'll make a newer version of the Yubikey that supports NFC and PGP keys bigger than 2048 bits.

Agreed on NFC but they support 4096 bit RSA in the current generation hardware:

https://www.yubico.com/product/yubikey-4-series/#tab-specs

It suffers the usual PGP-world usability problems so I ended up not using it very much but it was definitely working and takes noticeably longer to generate the key than a 2048-bit key does.

Post reply on HN