Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FIDO Alliance

fidoalliance.org

Post reply on HN
Print view View original

51–57 of 57 posts

Re: FIDO Alliance

#51

Post by supertrope »

eikenberry wrote: post #23
drdaeman wrote: post #5

Earlier quoted context omitted.

The only real problem with passwords is that humans are extremely bad at those without an aid of a password manager (when they’re no longer words but turn into pre-shared tokens). There are more, of course, but not as important. So people invented OpenID and OAuth and stuff, but all those things are fundamentally flawed because users were no longer a source of their “own” identifies. Their identities became provided…

It is implicitly centralized if the user doesn't have a means to control the secret key themselves. The minimally need to be able to import new keys into a device to keep control. Otherwise whoever owns those keys is really the one in control, which is really what the higher FIDO levels are about (as they are targeting enterprise customers that want central control). L1 (software based) obviously fits this requiremen…

That's the trade-off between security for the masses and savvy individuals having more control. A person can't get phished for their credentials if they can't access the private key. Journalists have emailed their GPG private key when learning how to use it. Even TOTP can be beat with fake webpages or a social engineer who asks for the code.

Re: FIDO Alliance

#52

Post by pornel »

tjoff wrote: post #36
jaredhanson wrote: post #31

Earlier quoted context omitted.

Attestation is an option in the FIDO ecosystem, and it is up to each website whether or not attestation is needed. Attestation is often required in enterprise settings. While consumer adoption of WebAuthn is incredibly low, the introduction of passkeys and multi-device credentials looks poised to change that. For consumer scenarios, attestation is often not a requirement. In that case, FIDO offers the "none" and "sel…

Well, cloudfare seems to be doing it to combat bots. We actually managed to invent something even worse than passwords. Incredible.

Why are you so negative about this? It works pretty well as an authentication mechanism. Unlike passwords, it can't be leaked or phished.

As for Cloudflare use, it's an experimental hack. An option to avoid filling in a CAPTCHA in case you have a compatible hardware key. You don't have to have one, and you don't have to use it for this if you don't want to.

Re: FIDO Alliance

#53

Post by bradstewart »

magicalhippo wrote: post #33
eikenberry wrote: post #30

Earlier quoted context omitted.

Various strategies that trade off security vs. convenience. Most secure is probably something simple like printing it out and putting that in a fire-proof safe. But there are lots of options. For the non-tech parents or some such, a nice pass-phrase would probably work well as the secret.

How do you get this pass-phrase from paper onto the yubikey without an adversary getting hold of it? I'm not trying to be pedantic here, I'm just failing to see how this can be realistically implemented without significantly lowing the overall security. But this is also not my domain, so I'd like to learn.

Importing keys into an HSM/key storage device is not an uncommon exercise.

If you're asking about the structure of the bits you'd need to move into the device in a verifiable way, there are standard APIs like PKCS #11 for interacting with HSMs.

You would then need a computer and a PKCS #11 client application. If you don't have a computer you can trust to pass keyboard inputs to a USB port without being intercepted, you've got problems that a yubikey will not solve.

Re: FIDO Alliance

#54

Post by magicalhippo »

bradstewart wrote: post #53
magicalhippo wrote: post #33

Earlier quoted context omitted.

How do you get this pass-phrase from paper onto the yubikey without an adversary getting hold of it? I'm not trying to be pedantic here, I'm just failing to see how this can be realistically implemented without significantly lowing the overall security. But this is also not my domain, so I'd like to learn.

Importing keys into an HSM/key storage device is not an uncommon exercise. If you're asking about the structure of the bits you'd need to move into the device in a verifiable way, there are standard APIs like PKCS #11 for interacting with HSMs. You would then need a computer and a PKCS #11 client application. If you don't have a computer you can trust to pass keyboard inputs to a USB port without being intercepted, y…

> there are standard APIs like PKCS #11 for interacting with HSMs

Thanks, that was the piece I was missing.

Re: FIDO Alliance

#55

Post by yaaligator »

supertrope wrote: post #48
yaaligator wrote: post #16

The problem with the FIDO "alliance" is who runs it, which is corporate America and megabanks if you check the site. They are basically trying to be the arbiters of online identity, gaining more power than they already have. Many of these companies are also in surveillance tech. That it may or may not be more secure than existing practices is merely a side effect. Don't be fooled by the term "alliance" because you ar…

They're just trying to replace the current system of password reset calls, SMS two factor, credential stuffing, password database breaches, and a general wild wild west feeling on the Internet. Of course it'll take more than public key authentication itself. For example in a enterprise businesses employees aren't allowed to install software, and there are procedures (however bad) to vet individuals.

No post body was provided.

Re: FIDO Alliance

#56

Post by dwaite »

Zamicol wrote: post #28

FIDO does some dirty things: >FIDO requires an attestation private key, which must be shared between a batch of at least 100,000 security keys. Using a DIY or cli app solution (application running on the host) will likely mean you'll be generating that private key yourself, this makes you identifiable across registrations. >Some sites (Cloudflare) may reject the use of attestation keys which are not found on the Fido…

> ... will likely mean you'll be generating that private key yourself, this makes you identifiable across registrations.

DIY/CLI apps have no reason to include a legitimate attestation - attestations are used to convey trust in the implementation, such as 'This is a Yubikey 5i'. The public key is usable to look up additional metadata, such as passing conformance and security implementation tests.

>Some sites (Cloudflare) may reject the use of attestation keys which are not found on the Fido Alliance Metadata Service. This precludes the use of any DIY solution.

The feature is meant for higher security environments (say workforce and government employee/contractor) to reject a home-grown implementation.

Cloudflare's (beta experiment) usage is a special case because they are using attestations to show that it is real hardware with a real financial cost. They are experimenting with using that as a replacement for captcha entering (while also experimenting with other technologies like privacypass to limit the number of times they ask for captchas).

The alternative to attestations in both of these use cases is that FIDO is not acceptable at all, not that a DIY implementation would become accepted.

Re: FIDO Alliance

#57

Post by billdietrich1 »

Please check my reasoning; I don't want hardware keys doing FIDO or something because:

- would have to have 2 or 3, in case of loss

- would have to register each key separately to each account

- when traveling, probably would have just 1 key with me, so if I lose it, I'm totally locked out until I can get home and get to a backup key

- even at home, if I lose a key, backup key should be somewhere safe off-site, so getting it would be a bit of a pain/delay

A hardware key just typing passwords or displaying 6-digit TOTP would be different. But not as secure as FIDO.

So, I think I'd like to have software TOTP everywhere. Vulnerable to phishing, and not a "something you have" second factor. But seems a good tradeoff of security/convenience/resilience for me.

Post reply on HN