Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless Logins with Yubikey

adl1995.github.io

Post reply on HN
Print view View original

51–60 of 66 posts

Re: Passwordless Logins with Yubikey

#51

Post by jka »

mabbo wrote: post #19

True security is using both "something you know" and "something you have". Something you have can be stolen, and something you know can be tricked out of you. But stealing both is difficult and far more obvious. To login to my work VPN, the password is " ". Our SSO system requires both once per day as well. It's a great system and I highly recommend it.

> Something you have can be stolen, and something you know can be tricked out of you.

Yep, it's generally been a useful combination. The "something you know" part could risk becoming a lower barrier the more that data breaches occur, and the more that people share and can infer about each other on public social media.

At the moment we tend to be very focused on securing individual identities and then assuring that what we say, do and write corresponds to those identities.

Perhaps a longer-term strategy is to care a bit less about the identity and be able to accept (and reject) content regardless of source.

Re: Passwordless Logins with Yubikey

#52

Post by ecesena »

CameronBanga wrote: post #23

This is a complete aside, but last year I purchased a keychain YubiKey 5, that supported USB-C and Lightning. I attached it to my key ring, and within about 8 weeks, the device was destroyed through the general wear and tear of being in my pocket. The plastic started chipping at one end of the device, and before the long the entire plastic shell shattered off completely exposing the board underneath. Was a pretty big…

USB-C is a bad beast as the connector is really poorly designed from a mechanical point of view.

If you want to check it out, we just pre-launched Solo v2 [1]. The USB-A version is a solid block of pcb. The USB-C has extra soldering between the connector and the external pcb shield. It's "metal solid", vs plastic around the connector.

[1] https://solokeys.com/v2

Re: Passwordless Logins with Yubikey

#53

Post by [deleted] »

mabbo wrote: post #19

True security is using both "something you know" and "something you have". Something you have can be stolen, and something you know can be tricked out of you. But stealing both is difficult and far more obvious. To login to my work VPN, the password is " ". Our SSO system requires both once per day as well. It's a great system and I highly recommend it.

[deleted]

Re: Passwordless Logins with Yubikey

#54

Post by mikeiz404 »

taeric wrote: post #50
mabbo wrote: post #19

True security is using both "something you know" and "something you have". Something you have can be stolen, and something you know can be tricked out of you. But stealing both is difficult and far more obvious. To login to my work VPN, the password is " ". Our SSO system requires both once per day as well. It's a great system and I highly recommend it.

This is a bit muddied when talking about securing access to something you also have. That is, you aren't securing your vpn with two factors. You are securing access to your vpn. It is different. Similarly, for your computer, it is already something you have. Such that the password to login to the machine can already be seen as a second factor. My home password, as an example, is worthless to you without me home compu…

Interesting point. I never really thought of the laptop as something you have but it certainly is.

I will say that a security key is far easier to carry on you in more situations than say a laptop is and certainly a desktop. And the key, depending on how it is used to secure the device, may help mitigate brute force password attacks in the event that the device is stolen.

An argument could be made for defense in depth but for most people I would guess the amount of added security is probably not super beneficial and for those where it truly does matter then securing physical access to the device is probably more important any way.

Re: Passwordless Logins with Yubikey

#56

Post by v7p1Qbt1im »

ta89489544 wrote: post #42
v7p1Qbt1im wrote: post #39

Earlier quoted context omitted.

Ideally something you „are“ as well. Though in practice this might be overkill for most. I believe there‘s a new biometric yubikey in the works. A fingerprint version of the 5C NFC would be cool.

I get the sense that biometrics are not very future proof. People leave fingerprints and DNA on everything they touch and faces and eyes are seen by cameras all the time. Biometrics work now, but in the near future I suspect the technology to take images of peoples faces/fingerprints and reproduce their likeness to fool a biometric sensor will be a commodity. Once that happens biometrics will be near useless because…

Possible yeah. Though I don‘t see this happening for a while yet. It‘s certainly marginally more secure than not having biometrics (3 instead of 2 elements).

Re: Passwordless Logins with Yubikey

#57

Post by v7p1Qbt1im »

ymbeld wrote: post #48
ta89489544 wrote: post #42

Earlier quoted context omitted.

I get the sense that biometrics are not very future proof. People leave fingerprints and DNA on everything they touch and faces and eyes are seen by cameras all the time. Biometrics work now, but in the near future I suspect the technology to take images of peoples faces/fingerprints and reproduce their likeness to fool a biometric sensor will be a commodity. Once that happens biometrics will be near useless because…

Aah, but will the cameras get enough shots of my tongue? Linguametrics, you heard it here first, folks.

Also genital scan.

Re: Passwordless Logins with Yubikey

#58

Post by nyuszika7h »

xaduha wrote: post #41

If you have nothing better to do: 1. Get a smart ring like OMNI 2. Shove a USB hub and a contactless reader into your mouse, so if on the next poll your hand with a ring isn't on it - lock it all Seriously though, if someone would start selling mice with contactless readers built-in, I'd buy a few.

How would that work if you're typing on the keyboard?

Re: Passwordless Logins with Yubikey

#59

Post by SahAssar »

taeric wrote: post #50
mabbo wrote: post #19

True security is using both "something you know" and "something you have". Something you have can be stolen, and something you know can be tricked out of you. But stealing both is difficult and far more obvious. To login to my work VPN, the password is " ". Our SSO system requires both once per day as well. It's a great system and I highly recommend it.

This is a bit muddied when talking about securing access to something you also have. That is, you aren't securing your vpn with two factors. You are securing access to your vpn. It is different. Similarly, for your computer, it is already something you have. Such that the password to login to the machine can already be seen as a second factor. My home password, as an example, is worthless to you without me home compu…

The reason a computer usually isn't considered "something you have" is that malware can clone them or they can be configured for remote access. Half the point of a yubikey or other hardware token is that they are supposed to be unclonable (and hence tied to a single physical device). Some of that can be replicated with a TPM I'm guessing but that isn't the norm yet.

Re: Passwordless Logins with Yubikey

#60

Post by taeric »

SahAssar wrote: post #59
taeric wrote: post #50

Earlier quoted context omitted.

This is a bit muddied when talking about securing access to something you also have. That is, you aren't securing your vpn with two factors. You are securing access to your vpn. It is different. Similarly, for your computer, it is already something you have. Such that the password to login to the machine can already be seen as a second factor. My home password, as an example, is worthless to you without me home compu…

The reason a computer usually isn't considered "something you have" is that malware can clone them or they can be configured for remote access. Half the point of a yubikey or other hardware token is that they are supposed to be unclonable (and hence tied to a single physical device). Some of that can be replicated with a TPM I'm guessing but that isn't the norm yet.

Sorta. The "cookie" in your browser is often enough to pin your computer as "something you have" for access to services. Gmail, in particular. (Similar for the security enclave on your phone.)

As I understand it, a yubikey is '"something you have" that we can reasonably verify as unique based on a shared secret with a third party.' That is, the algorithm that the yubikey is using to verify that it is something you have, is predicated on other knowledge, correct?

(I know I have one question mark up there. But I intend all of these assertions as a question. I'm not positive on this stuff.)

Post reply on HN