Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using FIDO keys

777.tf

Post reply on HN
Print view View original

41–50 of 65 posts

Re: Using FIDO keys

#41

Post by jeroenhd »

aidenn0 wrote: post #14
navigate8310 wrote: post #11

Earlier quoted context omitted.

One thing to keep in mind before buying their NFC keys is that it can only store up to 10 resident keys

Yubikey 5 can only store 20, which isn't a whole lot better. Are there yet any readily available FIDO devices that can store 100s of resident keys (I have almost 400 logins in bitwarden)?

Depending on your level of trust in Bitwarden and your security model, you could consider unlocking the Bitwarden vault with a security key, and then using Bitwarden's passkey support to authenticate to websites. It's not really 2FA, but it works around the resident key limitation.

There's also a nifty app that implements CTAP2 on Android Wear, and basically act like an NFC/Bluetooth security key. If you have an Android Wear and don't think your watch will be hacked and rooted, this could be a useful alternative, especially in places where Google doesn't sell their Titan keys.

Re: Using FIDO keys

#42

Post by tialaramex »

timwis wrote: post #25
alwa wrote: post #24

Earlier quoted context omitted.

What do you imagine a solution here might look like? I don’t know enough about the problem space to truly know, but I feel like I’ve seen versions of this: I can authorize any arbitrary public key for use over SSH, for example; and (based on my memory of YubiOTP) it’s seemed like at least some of these hardware auth protocols work based on using an open serial number or public key to identify the authorized authentic…

Perhaps if you could register your hardware key using its public key, which could be saved on your device? So you don’t need the hardware keys to be physically present when registering; just when signing in later.

In FIDO a separate public+private key pair is minted for each (key,site) pairing. This has lots of important benefits, but one is that it preserves existing anonymity.

If I use a Security Key to sign into Facebook as "Melissa Smith" and use the same Security Key to sign into my GitHub account "acab420", even if Facebook and Microsoft work very hard they can't correlate the information they have to prove those are being authenticated with the same authenticator. The keys are different, as they would be if these were different authenticators.

You might think it's impossible for FIDO1 or in scenarios where it's "just" a second factor and isn't storing anything for the site on your key, but there's a really clever trick. The Relying Party (e.g. web site) is required to remember a large random-looking "ID" for your key. Those aren't really random - they're effectively your private key for that site, but encrypted using a symmetric key only your authenticator knows. It encrypted its own private key and just sent that, in plain text, knowing it's impossible to decrypt (typically AES-128 or similar) and when the ID is sent back, the authenticator just decrypts it. AEAD is used, so an authenticator can tell if this ID isn't one it made because the AEAD fails.

Re: Using FIDO keys

#43

Post by tbone55 »

There is something to be said about having a physical key for an online account. Beyond the security implications it's kind of like a key to your home. Locking the door keeps most out, but there are still ways in.

Re: Using FIDO keys

#44

Post by dale_glass »

throwawayqqq11 wrote: post #27

Am i the only one concerned about the tendency of putting your identity on hardware you possibly do not own? What a wet dream for the internet controlling fascists when the adoption of "just wield your smart phone" auth would be in place and mandated every where. Nothing compares to the secrecy of passwords.

What? Security keys are only "identity" in that they deliver opaque, secure numbers. The actual important bits are somewhere else anyway.

FIDO is a standard algorithm and doesn't need a phone.

Re: Using FIDO keys

#45

Post by ac50hz »

My Yubikeys are great and have been since I started using them (2011), adopting newer products if necessary as they are released.

Passkeys are a confusing mess for most users, and the limited storage on Yubikeys doesn't help. However, 1Password's passkey support manages to reasonably successfully hide the confusions that always exist when explaining passkeys to anyone.

For now, I'm happy with my Yubikeys+1Password for all the platforms I use.

Re: Using FIDO keys

#46

Post by timwis »

tialaramex wrote: post #42
timwis wrote: post #25

Earlier quoted context omitted.

Perhaps if you could register your hardware key using its public key, which could be saved on your device? So you don’t need the hardware keys to be physically present when registering; just when signing in later.

In FIDO a separate public+private key pair is minted for each (key,site) pairing. This has lots of important benefits, but one is that it preserves existing anonymity. If I use a Security Key to sign into Facebook as "Melissa Smith" and use the same Security Key to sign into my GitHub account "acab420", even if Facebook and Microsoft work very hard they can't correlate the information they have to prove those are bei…

Thanks, that's a really helpful explanation.

Re: Using FIDO keys

#47

Post by dandanua »

stavros wrote: post #35
dandanua wrote: post #17

Earlier quoted context omitted.

I don't think resident keys are that worthwhile. Relaying party anyway has to remember the user somehow, even if it's just the public key. And it still has to associate the key with the user data. I think resident keys just complicate things for users and developers.

Resident keys are great, I don't have to remember usernames. I don't care what the RP does, I care that I can sign in with one click.

But you still have to remember what the key unlocks. A username could be just a label for it.

Re: Using FIDO keys

#48

Post by DistractionRect »

coffee33go wrote: post #22
DistractionRect wrote: post #5

I have a couple v1 Solokey Somus lying about. Good little devices. Unfortunately the main selling point of upgradeable firmware is moot if they no longer support the old devices and you have to upgrade. At that point it's they're like everyone else. Except they require some setup on some machines, whereas other keys "just work" I've since replaced them with yubikeys. Yubikeys have a better feature set (at least compa…

Are you sure? apt-get install solo-python One can update the firmware.

The "hacker" variant can be flashed with whatever, but if you lock it down to signed firmware, you're at the mercy of SoloKeys to provide updates. That's kinda one of the tenets of hardware keys, that they can't be modified/corrupted/dumped by rogue firmware.

Re: Using FIDO keys

#49

Post by DistractionRect »

jaefi wrote: post #9
DistractionRect wrote: post #5

I have a couple v1 Solokey Somus lying about. Good little devices. Unfortunately the main selling point of upgradeable firmware is moot if they no longer support the old devices and you have to upgrade. At that point it's they're like everyone else. Except they require some setup on some machines, whereas other keys "just work" I've since replaced them with yubikeys. Yubikeys have a better feature set (at least compa…

Given how the project is going, not even sure if there will be a V3 at some point.

That's actually what gives me confidence. All the hardware manufacturing problems almost ensure a v3 will be designed.

Re: Using FIDO keys

#50

Post by kemotep »

jeroenhd wrote: post #41
aidenn0 wrote: post #14

Earlier quoted context omitted.

Yubikey 5 can only store 20, which isn't a whole lot better. Are there yet any readily available FIDO devices that can store 100s of resident keys (I have almost 400 logins in bitwarden)?

Depending on your level of trust in Bitwarden and your security model, you could consider unlocking the Bitwarden vault with a security key, and then using Bitwarden's passkey support to authenticate to websites. It's not really 2FA, but it works around the resident key limitation. There's also a nifty app that implements CTAP2 on Android Wear, and basically act like an NFC/Bluetooth security key. If you have an Andr…

Ideally self hosted bitwarden (or a local only password manager such as keepassxc with passkey support) using a master password and a security key for the 2nd factor with all the accounts in your vault using passkey makes it so you need to know 1. the master password password, 2. have the security key, and also have 3. access to the vault.

The website being breached and the passkey public key being dumped is meaningless. They are more likely to compromise a site’s admin access that can get into user accounts than ever crack public key cryptography or simultaneously acquire all three factors necessary to gain access to my vault. And no matter what I do on my end (except only use sites that take security seriously) can stop that.

Post reply on HN