As someone who's not familiar with U2F or comparable standards I have a general question about the topic: When registering a key for multiple accounts (at the same site or at different sites) can website owners link those accounts by some common "key ID"? In the sense of: "Oh, this is Bob's key so this account must belong to Bob".
FIDO2 security key company releases hardware that's open source and uses Rust
51–60 of 160 posts
Re: FIDO2 security key company releases hardware that's open source and uses Rust
#52"Reversible USB-A" now there's a feature I wish we'd see more often!
Would have been nice to be common before USB-C started becoming standard...
Re: FIDO2 security key company releases hardware that's open source and uses Rust
#53Earlier quoted context omitted.
Others have answered most of your questions, but there's something I think deserves emphasizing: In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doin…
> Some (like Yubico) let you purchase a "cloned" set of devices Wait, they do? How? I would love to do this, but I can't find anything relevant on their website.
The same for me. I bought 2 keys and the idea was to have one as a backup key. But I did not find a way to do it. Anyway, even after read about how it works on some websites and watched some videos, the whole things is still a bit of a black box for me. I have no idea how a non-techie at moment a such device can use safe.
Re: FIDO2 security key company releases hardware that's open source and uses Rust
#54As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…
I use a yubikey, but I suppose the Solo will be similar. > - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. On windows10, yes. I haven't tried it on Ubuntu 20.10 yet, but I think FIDO/WebAuthN will Just Work. (PIV will likely need custom software, but if you're using PIV, you probably know what you're doi…
The moment you lose your key, WebAuthN becomes terrible and the UX is atrocious. You may literally have to go to an office (in the middle of a pandemic!) to restore access to your account.
This is bananas. We absolutely should not be recommending them to normal people until security researchers come to their senses and fix this problem.
Re: FIDO2 security key company releases hardware that's open source and uses Rust
#55As someone who's not familiar with U2F or comparable standards I have a general question about the topic: When registering a key for multiple accounts (at the same site or at different sites) can website owners link those accounts by some common "key ID"? In the sense of: "Oh, this is Bob's key so this account must belong to Bob".
I think that would be the public key. You can roughly think of it as the hardware key has a private key embedded in it in a way that it (supposedly) can't be gotten off. That private key has a corresponding public key. You can think of the private key as the password and the public key as the username. So I think the public key is the "key ID" you're looking for.
Re: FIDO2 security key company releases hardware that's open source and uses Rust
#56Nice, I'd love this as an open source yubikey replacement. But it doesn't do OpenPGP, I rely on that way too much sadly. Not just for SSH which supports fido2 now but also for file encryption and my password manager. If they add that in the future I might jump ship.
We hope and think that PIV can replace all the practical use cases for PGP. Specifically among those mentioned, `age` for file encryption, and either FIDO resident keys with hmac-secret for password managers, or something like `passage` (fork of `pass` using, again, `age` for encryption). For SSH you can use FIDO for newer OpenSSH, and either `pivy` or `yubikey-agent` via PIV. Cheers!
Re: FIDO2 security key company releases hardware that's open source and uses Rust
#57As someone who's not familiar with U2F or comparable standards I have a general question about the topic: When registering a key for multiple accounts (at the same site or at different sites) can website owners link those accounts by some common "key ID"? In the sense of: "Oh, this is Bob's key so this account must belong to Bob".
No, they cannot. This is an explicit design goal of FIDO (https://fidoalliance.org/specs/fido-security-requirements/fi...).
The actual public key used for logging in to a specific site is completely random.
Optionally, the website can ask for "attestation", which is intended to prove that the public key is from a specific vendor/model. To make this also unlinkable, devices are supposed to share attestation keys in batches of 100k units.
Re: FIDO2 security key company releases hardware that's open source and uses Rust
#58As someone who's not familiar with U2F or comparable standards I have a general question about the topic: When registering a key for multiple accounts (at the same site or at different sites) can website owners link those accounts by some common "key ID"? In the sense of: "Oh, this is Bob's key so this account must belong to Bob".
For U2F I don't believe that's the case for most devices.
Yubikey outlines their method here[1]. They generate a different keypair for each website public key and have the server store an encrypted and authenticated copy of the private key using a single on-device key. So baring breaking the underlying primitives the server will only have a site-specific public key and a site-specific encrypted blob.
[1]: https://developers.yubico.com/U2F/Protocol_details/Key_gener...
Re: FIDO2 security key company releases hardware that's open source and uses Rust
#59As someone who's not familiar with U2F or comparable standards I have a general question about the topic: When registering a key for multiple accounts (at the same site or at different sites) can website owners link those accounts by some common "key ID"? In the sense of: "Oh, this is Bob's key so this account must belong to Bob".
[deleted]
Re: FIDO2 security key company releases hardware that's open source and uses Rust
#60am i reading their marketing stuff correctly that this doesn't include any new fido-protocol features vs the solo key v1? that is, as far as chrome sees it, it might as well be the same product?
Website can distinguish via the optional attestation key.
In terms of features, CTAP v2.1 (https://fidoalliance.org/specs/fido2/) is still draft only, but yes both v1 and v2 keys support hmac-secret and credential management. We could add authnSelection and authnConfig, but not clear if any browsers actually implement/use it.
The major new feature is PIV.