I was wondering if there is any driverless USB smartcard that can speak GIDS? The GIDS login for our sysadmin worked wonderfully, but the downside is the reader.
Have you tried PIV in place of GIDS?
No
FIDO2 security key company publishes results of internal security audit
51–60 of 64 posts
Re: FIDO2 security key company publishes results of internal security audit
#52I am probably wrong, but I think Fido2 keys should be ubiquitous. They provide a hardened solution for some security situations, certainly they could be a good 2nd factor or 3rd, and hopefully they could reduce the password madness we have. Yubico appears focused on the enterprise and high end users resulting in higher prices. Solokeys seems more focused on individual users with lower prices. Disclaimer I have two Yu…
They offer more security so what you say is true,but there is always a cost-benefit calculation to be had. They solve the human user authentication problem really well,but they do have a cost of ownership significantly higher than just passwords or even software authenticators. You have to keep in mind that attackers want passwords to get access to some resource,not to just collect your password. Evem with a yubikey,…
A solokey is $20 I wouldn't call that significant especially in comparison to the cost of losing your email, bank, steam account etc.
Re: FIDO2 security key company publishes results of internal security audit
#53Physical hardware seems like a promising replacement for passwords. But is there any real adoption in consumer services right now? The only two services I know that suppport Fido2 are Google and GitHub. Are there any other big services I'm missing here?
There are a fair bit of tech aware services which use it. I wish Paypal/banks would support it though.- Twitter
- Google
- Bitwarden (password manager)
- Dropbox
- Gitlab
- Github
- Nextcloud
Re: FIDO2 security key company publishes results of internal security audit
#54Earlier quoted context omitted.
They offer more security so what you say is true,but there is always a cost-benefit calculation to be had. They solve the human user authentication problem really well,but they do have a cost of ownership significantly higher than just passwords or even software authenticators. You have to keep in mind that attackers want passwords to get access to some resource,not to just collect your password. Evem with a yubikey,…
A solokey is $20 I wouldn't call that significant especially in comparison to the cost of losing your email, bank, steam account etc.
You're talking about purchasing cost, there is additional cost as well. Who supports it,how much more does it cost to support. How easily can you issue new yubikeys,what is the cost of that delay? Do you still keep passwords or hope people keep their yubi's in a secure place?
Business cost example: some important guy is making a business deal but he lost/forgot his credential and can't login to show a presentation. If that credential is a password or TOTP key, he calls helpdesk and gets it sorted out. But if it is a FIDO key and they are on the other side of the planet (or a city close by where you have no support staff) that can humiliate not just the person but your whole company. Are hackers a bigger risk than a guy losing his yubikey? Depends on who you are and what you do. There are even more subtle costs like people forgeting their yubi at work/home and losing man hours for when they have to retrieve it. Malicious insiders swiping a fido key to do harm because of how much trust a session authenticated with a fido key has,etc...
Re: FIDO2 security key company publishes results of internal security audit
#55I see a lot of confusion in this thread (warranted, because it's a confusing subject), and I want to clarify a few things: U2F is the old standard, it is only meant be used as a second factor. WebAuthn is the new standard, it has different modes for usage as a second factor, first factor and single factor (usernameless). Only the usernameless mode requires state on the client side. Usernameless strikes me as the holy…
This seems like a cool idea, but the Yubikey NEO that I use to log into github doesn't seem to be accepted by the page. I doubt I've hit the 25 website limit.
Re: FIDO2 security key company publishes results of internal security audit
#56I see a lot of confusion in this thread (warranted, because it's a confusing subject), and I want to clarify a few things: U2F is the old standard, it is only meant be used as a second factor. WebAuthn is the new standard, it has different modes for usage as a second factor, first factor and single factor (usernameless). Only the usernameless mode requires state on the client side. Usernameless strikes me as the holy…
This seems like a cool idea, but the Yubikey NEO that I use to log into github doesn't seem to be accepted by the page. I doubt I've hit the 25 website limit.
The Neo doesn't support FIDO2, only U2F.
Re: FIDO2 security key company publishes results of internal security audit
#57Earlier quoted context omitted.
Microsoft supports passwordless login (you can try it out on outlook.com — some ppl refer to this as username less). Dropbox is also an early adopter. Plus you have all the u2f that are back compat, including facebook, twitter, aws, gitlab... (I may have confuse some u2f that already moved to webauthn, if so, sorry). Considering that webauthn was standardized last March and that ios still has no in-app support, that’…
So the reason for the usernameless / passwordless distinction goes like this: U2F was explicitly designed only as a second factor. ("Universal 2nd Factor") but WebAuthn is not. Even with U2F you could (it wasn't recommended) just not actually have passwords. Use their second factor as your only factor. In this scenario the user needs to provide their username (email address, whatever you're using) because their FIDO…
Is this right... so in FIDO2, the website only has to store the public key of the token (which will get sent on registration/signup and mapped to a userid)?
Re: FIDO2 security key company publishes results of internal security audit
#58I got a Solokey as part of the Kickstarter and love em. USB-C + NFC in one device. The one thing I'd love out of a security key is the ability to set up a "Twinned Pair". So I can have one key on my keychain that I use everyday and one I keep in my safe in case something happens to the primary. Yes, I know some services support multiple security keys - but setting up two is more work and not all services do support t…
The standard is actually designed specifically to prevent that.
So what happens when you lose your key, or it stops working?
Re: FIDO2 security key company publishes results of internal security audit
#59Earlier quoted context omitted.
Why did Yubikey ever close source their firmware? It's really saddening to see a company going back on that
The YubiKey hardware with its integral firmware has never been open sourced. https://www.yubico.com/blog/secure-hardware-vs-open-source/
Wow... I've never read so much bullshit in one blog post. They're basically hoping that nobody who reads this has any embedded development knowledge.
Re: FIDO2 security key company publishes results of internal security audit
#60Earlier quoted context omitted.
The standard is actually designed specifically to prevent that.
So what happens when you lose your key, or it stops working?
You need to have a completely separate fallback. Typically the service will at minimum give you some one-time codes as an alternative for such cases. many services allow you to register multiple keys or TOTP apps.