Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FIDO2 security key company releases hardware that's open source and uses Rust

solokeys.com

Post reply on HN
Print view View original

41–50 of 160 posts

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#41

Post by vlovich123 »

conorpp wrote: post #29
l0b0 wrote: post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

Just wanted to add since I didn't see this covered in other comments yet -- TOTP and any sort of one time code authentication are just as phishable as passwords. Perhaps the biggest benefit for most people using U2F or FIDO2, is the large resistance to phishing. This is because of how the whole ecosystem has adopted FIDO2. When a FIDO2 key signs an assertion for a website, it includes the domain in the signature base…

I look at it like nothing Every layer buys you a little bit (or a lot) more, raising the skill level and/or cost. Fido2 is much harder to phish but of course weaknesses may be found in the future.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#42

Post by ahnick »

kelnos wrote: post #31
l0b0 wrote: post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

Others have answered most of your questions, but there's something I think deserves emphasizing: In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doin…

Some devices derive their keys from a recovery seed that you can store offline in paper form. The benefit of this approach is that you can recreate the key on a backup device using the recovery seed, should you lose your primary.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#43

Post by tialaramex »

kelnos wrote: post #31
l0b0 wrote: post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

Others have answered most of your questions, but there's something I think deserves emphasizing: In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doin…

> Some sites will allow you to simultaneously enroll two devices, so you can keep one as a backup

For WebAuthn (the actual standard for how to do this which is what you should be rolling out if you have a greenfield authentication environment that doesn't already do U2F today) the specification explicitly says:

> Relying Parties SHOULD allow and encourage users to register multiple credentials to the same account. Relying Parties SHOULD make use of the excludeCredentials and user.id options to ensure that these different credentials are bound to different authenticators.

https://w3c.github.io/webauthn/#sctn-credential-loss-key-mob...

I'm aware of (and along with many of its other users annoyed that) AWS only permits a single authenticator. If there are other popular sites that do this, this is no worse a place than any other to say so.

FWIW I have two (or more) FIDO authenticators with Google, GitHub, GitLab, Facebook, Dropbox, Login.gov and Digidentity (the Gov.UK verify provider)

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#44

Post by tialaramex »

conorpp wrote: post #29
l0b0 wrote: post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

Just wanted to add since I didn't see this covered in other comments yet -- TOTP and any sort of one time code authentication are just as phishable as passwords. Perhaps the biggest benefit for most people using U2F or FIDO2, is the large resistance to phishing. This is because of how the whole ecosystem has adopted FIDO2. When a FIDO2 key signs an assertion for a website, it includes the domain in the signature base…

> If you accidentally go to a fake website, "exaample.com", then the key will make a signature for "exaample.com", which is invalid for "example.com".

This actually isn't true - the result is even better.

When you visit fake.example instead of real.example there are two scenarios: For FIDO2 (like this product) with usernameless mode, just as with a modern iPhone or fancy Android with fingerprint reader, the authenticator knows perfectly well that you've never registered at fake.example so, you can't very well authenticate to it, you get an error.

With FIDO1 (or on sites that don't use the usernameless feature anyway) the authenticator has no idea you've never visited fake.example... but the site has to hand over an opaque ID, a large binary blob. This is (either directly or in effect) actually your private key, encrypted in AEAD mode using a symmetric key known only to your authenticator. Another ingredient to this encryption is the domain name. So either fake.example hands over a random blob, which is gibberish, or they hand over a genuine real.example blob... but they're fake.example so the decryption fails. You get an error.

The way I found this out was by trying it, I built a toy site with WebAuthn authentication. If I run the same code, on another site I own, it gets an error in the Javascript telling it that apparently I don't yet have a Security Key enrolled for this site, maybe it should enroll me first. If I tell it to pretend it's a different site, it gets an error saying no it isn't.

[ The bad guys could enroll you, but now you're really signing into their web site. Which is cool, but, doesn't actually help them phish credentials for the other site ]

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#45

Post by barkingcat »

l0b0 wrote: post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

The general idea is not to backup these devices.

To make a backup, you get 2 different keys and set them both up. The second one you keep somewhere safe, for example in a safety deposit box at a bank.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#46

Post by _abox »

Nice, I'd love this as an open source yubikey replacement.

But it doesn't do OpenPGP, I rely on that way too much sadly. Not just for SSH which supports fido2 now but also for file encryption and my password manager.

If they add that in the future I might jump ship.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#47

Post by GekkePrutser »

leafmeal wrote: post #9

How does this compare to a Yubikey for example?

Yubikey supports fido2, piv like this one but also supports openPGP so if you need that it's not a replacement.

It's more open source though. Yubikey open sources some components like that PGP applet but not all.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#48

Post by conorpp »

tialaramex wrote: post #44
conorpp wrote: post #29

Earlier quoted context omitted.

Just wanted to add since I didn't see this covered in other comments yet -- TOTP and any sort of one time code authentication are just as phishable as passwords. Perhaps the biggest benefit for most people using U2F or FIDO2, is the large resistance to phishing. This is because of how the whole ecosystem has adopted FIDO2. When a FIDO2 key signs an assertion for a website, it includes the domain in the signature base…

> If you accidentally go to a fake website, "exaample.com", then the key will make a signature for "exaample.com", which is invalid for "example.com". This actually isn't true - the result is even better. When you visit fake.example instead of real.example there are two scenarios: For FIDO2 (like this product) with usernameless mode, just as with a modern iPhone or fancy Android with fingerprint reader, the authentic…

You are right, I lied a bit to oversimplify :)

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#49

Post by smichel17 »

kelnos wrote: post #31
l0b0 wrote: post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

Others have answered most of your questions, but there's something I think deserves emphasizing: In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doin…

> But many sites only allow a single device to be enrolled.

Ugh, I hate these. I want to use u2f, but I am not willing to risk being locked out of my account if I lose the key. So I only enable it if there is some other 2fa I can enable (either adding a second key or totp).

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#50

Post by taeric »

g_p wrote: post #30
taeric wrote: post #24

Earlier quoted context omitted.

Having multiple keys without auditing when the backups are used, though, feels wrong. And that is my main gripe with these right now. Very hard to get any system to help build the habit of using the things. Most places default to remember your login. Basically forever.

While not cryptographic level auditing, this is arguably a UX feature for sites to implement -- on their inevitable loading spinner after login, they could show you the U2F tokens enrolled, and their most recent use on a small timeline. If your cold backup suddenly goes from ancient to now, that ought to be looked into! Regards habits, I find U2F is so easy to use that there's no real issue there. The bigger issue is…

Yeah, I just installed the pass support for otp for some site. Can't remember which.

My problem with the habit remains, though. I would love if my phone insisted me try a key at least once a week. I don't know how to force that. :(

Post reply on HN