Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

yubico.com

Post reply on HN
Print view View original

51–60 of 62 posts

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#51

Post by amluto »

michaelt wrote: post #27
moduspwnens14 wrote: post #18

Earlier quoted context omitted.

Using the secure enclave, you (as a developer) can have it generate a private key you'll never be able to get and then ask it to sign / encrypt (symmetrically) arbitrary things for you. https://developer.apple.com/documentation/security/certifica... AFAIK that means it'll take more than a jailbreak to get to them, although I don't know if OTP apps are using that capability or not.

Sadly, the Secure Enclave doesn't support HMAC-SHA-1 or importing keys [1] so it's not compatible with the industry standard TOTP 2fa mechanism. [1] https://developer.apple.com/documentation/security/certifica...

Fortunately, we have WebAuthn now. Hopefully Apple will jump on board soon.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#52

Post by sbr464 »

jakobegger wrote: post #10
jpdb wrote: post #3

Earlier quoted context omitted.

Do iPhones allow access to the underlying TPM devices? I personally don't believe things like Google Authenticator are a good "something you have" second factor as the "something you have" is just a string stored in a sqlite database. Much easier to covertly copy that than a hardware key where the string is burned into the key.

Yes, iPhones allow storing data that can’t leave the device. Otherwise OTP apps would be pointless. I don’t know the details, but some apps use it to store OTP secrets. Eg. if you use the DUO app, your secrets will be backed up, but they can only be restored on your phone. (was quite a hassle to reset 2FA on all the websites after my phone was replaced in warranty repair) Not sure what Google authenticator does.

Duo recently added a feature (haven’t tested it yet) that allows you to transfer to another phone.

Quote from email:

In late August we will release an updated version of the Duo Mobile app that includes a new feature called Duo Restore. This functionality enables Android and iOS Duo Mobile users to recover their Duo-protected accounts when they get a new device.

Duo Restore is an opt-in feature that can be enabled or disabled by Duo Administrators in the Duo Admin Panel. It is not enabled by default.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#53

Post by tenken »

zaroth wrote: post #2

If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…

Your phone that is visible and accessible to every WiFi network is not what I would consider a secure device.

A small smart dongle on the other hand, an island unto itself, I do consider more secure.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#55

Post by jlgaddis »

buddylw wrote: post #36
blitmap wrote: post #7

Earlier quoted context omitted.

Another neat solution: https://krypt.co/

I've been playing with this, and it's mostly good. It solves the key forwarding problem in nested Linux VMs (-A forwarding is kind of bad). I do find it a bit silly that they don't support any iOS or android ssh clients, so they only way to authenticate ssh from an iphone is to connect to a VM first where the linux client is installed.

Yes, AgentForwarding is a bad idea... but thanks to ProxyCommand (and now the simpler) ProxyJump, I haven't needed to use it in years.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#56

Post by kej »

jakobegger wrote: post #10
jpdb wrote: post #3

Earlier quoted context omitted.

Do iPhones allow access to the underlying TPM devices? I personally don't believe things like Google Authenticator are a good "something you have" second factor as the "something you have" is just a string stored in a sqlite database. Much easier to covertly copy that than a hardware key where the string is burned into the key.

Yes, iPhones allow storing data that can’t leave the device. Otherwise OTP apps would be pointless. I don’t know the details, but some apps use it to store OTP secrets. Eg. if you use the DUO app, your secrets will be backed up, but they can only be restored on your phone. (was quite a hassle to reset 2FA on all the websites after my phone was replaced in warranty repair) Not sure what Google authenticator does.

>was quite a hassle to reset 2FA on all the websites after my phone was replaced in warranty repair

Next time print out all the QR codes and save them in a secure place. Now you can easily add them to a new device, although you need to be more careful to make sure they're fully removed from an old device before you get rid of it.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#57

Post by matheusmoreira »

zaroth wrote: post #2

If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…

Does the iPhone's secure element implement smart card functionality? Does it allow generating and storing PGP keys in secure tamper-resistant memory?

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#58

Post by snowwrestler »

zaroth wrote: post #39
Spivak wrote: post #12

Earlier quoted context omitted.

For the purposes of 2FA, your physical machine typically doesn't count as 'something you have' and your phone is really no different.

If I install a TOTP generator on a machine and setup 2FA on a 3rd party service, and I then later login with a password and a 6 digit TOTP code, that is definitely 2FA. You can argue my TOTP shared secret may or may not be secure enough from malware. But it’s definitely 2FA and it successfully protects against the attack vectors that adding a “something you have” factor is designed to protect against. Better than SMS…

2FA protects against "password spraying" but that is not really the scariest threat model.

The scariest threat model is phishing, and the disadvantage of a TOTP app on your phone is that you type in the one-time code by hand. Anything you type in by hand can be phished.

The advantage of a token for 2FA is that you don't type it in. It takes human judgment out of the equation. Using NFC to supply the one-time code on an iPhone preserves that advantage.

Now, you might not think a phishing threat model is relevant to you, and that's fine. My point is simply that there is a difference between a 2FA code you type in, and a 2FA code that is supplied directly from hardware.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#59

Post by watersb »

snowwrestler wrote: post #58
zaroth wrote: post #39

Earlier quoted context omitted.

If I install a TOTP generator on a machine and setup 2FA on a 3rd party service, and I then later login with a password and a 6 digit TOTP code, that is definitely 2FA. You can argue my TOTP shared secret may or may not be secure enough from malware. But it’s definitely 2FA and it successfully protects against the attack vectors that adding a “something you have” factor is designed to protect against. Better than SMS…

2FA protects against "password spraying" but that is not really the scariest threat model. The scariest threat model is phishing, and the disadvantage of a TOTP app on your phone is that you type in the one-time code by hand. Anything you type in by hand can be phished. The advantage of a token for 2FA is that you don't type it in. It takes human judgment out of the equation. Using NFC to supply the one-time code on…

> The scariest threat model is phishing, and the disadvantage of a TOTP app on your phone is that you type in the one-time code by hand. Anything you type in by hand can be phished.

I can be fooled into reading a 6-digit PIN to Evil Mallory, a MITM attack.

I can be fooled into tapping my NFC auth token on Mallory's Evil Website, and the auth handshake would fail. Or not. It depends on the protocol, I suppose.

Is that what you mean?

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

#60

Post by zaroth »

snowwrestler wrote: post #58
zaroth wrote: post #39

Earlier quoted context omitted.

If I install a TOTP generator on a machine and setup 2FA on a 3rd party service, and I then later login with a password and a 6 digit TOTP code, that is definitely 2FA. You can argue my TOTP shared secret may or may not be secure enough from malware. But it’s definitely 2FA and it successfully protects against the attack vectors that adding a “something you have” factor is designed to protect against. Better than SMS…

2FA protects against "password spraying" but that is not really the scariest threat model. The scariest threat model is phishing, and the disadvantage of a TOTP app on your phone is that you type in the one-time code by hand. Anything you type in by hand can be phished. The advantage of a token for 2FA is that you don't type it in. It takes human judgment out of the equation. Using NFC to supply the one-time code on…

I would posit that set of people able to be phished and the set of people willing & able to use a Yubikey are disjoint, or nearly indistinguishably so.
Post reply on HN