41–50 of 64 posts
Physical hardware seems like a promising replacement for passwords. But is there any real adoption in consumer services right now? The only two services I know that suppport Fido2 are Google and GitHub. Are there any other big services I'm missing here?
Physical hardware seems like a promising replacement for passwords. But is there any real adoption in consumer services right now? The only two services I know that suppport Fido2 are Google and GitHub. Are there any other big services I'm missing here?
Microsoft supports passwordless login (you can try it out on outlook.com — some ppl refer to this as username less). Dropbox is also an early adopter. Plus you have all the u2f that are back compat, including facebook, twitter, aws, gitlab... (I may have confuse some u2f that already moved to webauthn, if so, sorry). Considering that webauthn was standardized last March and that ios still has no in-app support, that’…
U2F was explicitly designed only as a second factor. ("Universal 2nd Factor") but WebAuthn is not.
Even with U2F you could (it wasn't recommended) just not actually have passwords. Use their second factor as your only factor. In this scenario the user needs to provide their username (email address, whatever you're using) because their FIDO token doesn't know who they are either -- it needs to be presented with a cookie [which it gave the site when the user registered to use this FIDO token], and you've probably got a database table mapping users to cookies and public keys.
In FIDO2 the token is capable of handling resident credentials. No cookie, resident credentials are permanently inside the token itself.
The massive downside of this is that obviously the token has finite storage for such credentials, a Yubikey can store 25. Whereas for ordinary FIDO (all the WebAuthn deployments I've seen outside Microsoft) there's no practical limit.
The upside is that since the token has your credentials it can now do the entire sign-in, no need for even a username so the login flow is much nicer.
Of course while convenient on its own that's arguably worse security - if a bad guy steals your token they're in without even knowing your username, much like the proximity card badges often used for site access. So the fix is that a FIDO2 token in this mode can be (usually will be) set to require a PIN or some other factor. This seems like we're back to passwords again, but it's different because the extra factor is local to your device. Bad guys can't steal PINs from devices in bulk or brute force them, they need to steal your FIDO2 token and then brute force that somehow.
I have two OnlyKeys I backup against the other to handle the lack of ubiquity of FIDO2. So many places are still only using SMS, but as an alternative, have built proprietary, in-app authentication systems that can't be audited. I had a phone break, and I wanted to purchase a new phone online to have it ship when I returned; and I couldn't access my remote work paycheck transfer (in-app), I couldn't log into my bank…
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...
> Dynamic linking is possible through the generation of authentication codes which is subject to a set of strict security requirements. To remain technologically neutral a specific technology for the implementation of authentication codes should not be required. Therefore authentication codes should be based on solutions such as generating and validating one-time passwords, digital signatures or other cryptographically underpinned validity assertions using keys or cryptographic material stored in the authentication elements, as long as the security requirements are fulfilled.
My bank (Swedbank Latvia) used this regulation as a pretext for removing authentication via passwords + code cards. They didn't do too well on the "technologically neutral" part though – you now have to use proprietary software or hardware to authenticate :-/
Physical hardware seems like a promising replacement for passwords. But is there any real adoption in consumer services right now? The only two services I know that suppport Fido2 are Google and GitHub. Are there any other big services I'm missing here?
I was wondering if there is any driverless USB smartcard that can speak GIDS? The GIDS login for our sysadmin worked wonderfully, but the downside is the reader.
I am probably wrong, but I think Fido2 keys should be ubiquitous. They provide a hardened solution for some security situations, certainly they could be a good 2nd factor or 3rd, and hopefully they could reduce the password madness we have. Yubico appears focused on the enterprise and high end users resulting in higher prices. Solokeys seems more focused on individual users with lower prices. Disclaimer I have two Yu…
Aside from the bad form factor (nope, usb "top" isn't necessarily device "top"), it really requires a conscious effort to use them.
That said, theoretically they are awesome.
U2F is the old standard, it is only meant be used as a second factor.
WebAuthn is the new standard, it has different modes for usage as a second factor, first factor and single factor (usernameless). Only the usernameless mode requires state on the client side.
Usernameless strikes me as the holy grail of authentication, where we don't need to remember any usernames or passwords (or even have them), but I haven't seen any websites that support usernameless authentication, other than demo ones and my own.
If you want to see what a usernameless flow looks like, you can visit https://www.deadmansswitch.net/. You have to log in with an email link first, and then associate your FIDO2 credential with it. You don't need a hardware key, for example on phones you can use your fingerprint reader and it will work fine.
The problem with hardware keys, and which is not mentioned anywhere, is that because usernameless requires storage on the key, Yubikeys only support a maximum of 25 sites you can authenticate with.
In order to further my goal of some day ditching password managers, I also made a Django library for usernameless logins which you can use today on your Django sites:
So I have a SoloKey. How do I check what firmware it is running? Is the firmware upgraded automatically, or do I have to do something? The SoloKey website from some quick skimming doesn't seem to have any information on the topic.
Their github repository of their python command line tool should have all the info you need. https://github.com/solokeys/solo-python
Earlier quoted context omitted.
Microsoft supports passwordless login (you can try it out on outlook.com — some ppl refer to this as username less). Dropbox is also an early adopter. Plus you have all the u2f that are back compat, including facebook, twitter, aws, gitlab... (I may have confuse some u2f that already moved to webauthn, if so, sorry). Considering that webauthn was standardized last March and that ios still has no in-app support, that’…
So the reason for the usernameless / passwordless distinction goes like this: U2F was explicitly designed only as a second factor. ("Universal 2nd Factor") but WebAuthn is not. Even with U2F you could (it wasn't recommended) just not actually have passwords. Use their second factor as your only factor. In this scenario the user needs to provide their username (email address, whatever you're using) because their FIDO…
I got a Solokey as part of the Kickstarter and love em. USB-C + NFC in one device. The one thing I'd love out of a security key is the ability to set up a "Twinned Pair". So I can have one key on my keychain that I use everyday and one I keep in my safe in case something happens to the primary. Yes, I know some services support multiple security keys - but setting up two is more work and not all services do support t…
I definitely would like the requirement to allow multiple keys to be a part of the standard. Allowing it at the key level seems dangerous to me, perhaps, in allowing an attacker to perhaps "clone" someone's key that hasn't setup a pair yet, though of course I'm sure there's mitigations for that if it was seriously proposed! I have two Yubikeys, one in a safe and one on my person. It saved my butt when I lost access t…