Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

fidoalliance.org

Post reply on HN
Print view View original

521–525 of 525 posts

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#521

Post by Kelteseth »

lxgr wrote: post #321
vlan0 wrote: post #72

Earlier quoted context omitted.

>my threat model is me leaving my key in my pants pocket before putting it in the washing machine. "YubiKey Survives Ten Weeks in a Washing Machine" I think you'll be safe! :) https://www.yubico.com/press-releases/yubikey-survives-ten-w...

While I'm generally a fan of YubiKeys too, I've had one break without warning. Backups are highly recommended – you can lose them too, after all.

I wanted to enable YubiKey for my Bitwarden account and feared exactly this. Now I've spent 200€ for 4 YubiKeys, so if I ever miss or break one, I will hopefully be fine. But imagine telling your grandma to buy at least 2 YubiKeys for 100€ just to make your Facebook login more secure.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#522

Post by black_puppydog »

lrvick wrote: post #402
eikenberry wrote: post #296

Earlier quoted context omitted.

I have 100s of passwords and dozens of TOTP keys in my password manager. Logging into every one of these sites with 2 keys, and having to re-auth with all of them if you lose one of those is unworkable. It only really makes sense for centralized auth solutions like you'd have at work, not for day to day personal things. I want a FIDO key that I can use for day to day things.

Backup a 24 word seed phrase once on a FIDO device that supports BIP39. Now go enroll 100 sites in it and then lose or destroy the device. Enter the 24 word backup to a new device and access to your 100 sites is restored.

This sounds like what GGP would want. Does it exist?

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#523

Post by md_ »

dane-pgp wrote: post #515
md_ wrote: post #513

Earlier quoted context omitted.

Yet Google, one of the key participants in the FIDO alliance, has published an open source firmware! I agree the potential exists, in a hypothetical sense. But the dynamics are very different than you describe (with your analogy to the CA ecosystem, which, ironically, gives big platform owners far more power—yet has no evidence of such abuse!). Right now, there is just not that much use of WebAuthn and FIDO. You’re t…

I'm glad Google has published an open source firmware, and I hope that people will be able to independently verify that the hardware they use is genuinely running that firmware. Then I hope that hardware with such guarantees is not discriminated against by RPs. The important difference with the CA ecosystem is that (in the worst case) the big platform owners can put pressure on small websites to obtain a certificate…

But the big three can't do that, with FIDO. All they can do is influence the FIDO Alliance to add other SK manufacturers to the pseudo-CRL, which:

- is transparent

- is mediated by the FIDO Alliance; the platform makers cannot do it unilaterally, as they can with CAs in browsers

- is mediated by the RPs; even if the FIDO Alliance did do this for some reason, RPs could just ignore it with no ill effects, unlike with CA trust in browsers

- wouldn't have any effect today for the vast majority of RPs, since the vast majority do not even use attestation today

- honestly, isn't something they have any incentive to do; hardware security keys are not a meaningful source of revenue for someone like Apple, Microsoft, or Google

I'm guessing you've never worked in a big tech company before if you think they have an incentive to do that. :)

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#524

Post by danstiner »

password4321 wrote: post #508
danstiner wrote: post #286

Earlier quoted context omitted.

Thanks for the shout-out! I wrote that U2F implementation in software because I wanted phishing protection without needing to carry a hardware key. Well, and to learn Rust :) It's certainly a security trade-off to just store secrets in your keychain like I choose to, it is not meant to be a replacement for a hardware key and in fact I have a Yubikey I use when the situation calls for it. I'd love to use TPM and biome…

> relaying auth requests to your phone for approval and storing secrets in the Secure Enclave Like the acquired/abandoned https://github.com/kryptco/kr [key stored in a [...] mobile app] with iOS and Android apps all under an "All Rights Reserved"-source license? Also, newer Macs have a Secure Enclave (supports 256-bit secp256r1 ECC keys): https://github.com/maxgoedjen/secretive [storing and managing SSH keys in the…

Yep exactly, Krypton looked interesting, sorry to see it's dead.

And yep Apple is way ahead on this imo, the touch sensor securely communicates with the Secure Enclave, I'm not aware of other laptop hardware doing that. (https://support.apple.com/en-bh/guide/security/sec067eb0c9e/...)

I'd love to have something equivalent for Linux, but given that requires hardware support I think relaying auth requests to your phone is the closest equivalent.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#525

Post by 0daystock »

nmeagent wrote: post #443
0daystock wrote: post #370

Earlier quoted context omitted.

Society is replete with trade-offs sacrificing freedom for collective security. You can make moral judgements about this all day, but it won't change the dynamics of our lives.

Keep in mind that we do not have to cooperate with whatever invasive schemes you wish to inflict on us.

No post body was provided.
Post reply on HN