FIDO2 security key company publishes results of internal security audit • Hacker News Board

Re: FIDO2 security key company publishes results of internal security audit

#61

Post by tialaramex » Fri, Feb 21, 2020, 7:33 PM UTC

throw7 wrote: post #57

tialaramex wrote: post #42

Earlier quoted context omitted.

So the reason for the usernameless / passwordless distinction goes like this: U2F was explicitly designed only as a second factor. ("Universal 2nd Factor") but WebAuthn is not. Even with U2F you could (it wasn't recommended) just not actually have passwords. Use their second factor as your only factor. In this scenario the user needs to provide their username (email address, whatever you're using) because their FIDO…

Is this right... so in FIDO2, the website only has to store the public key of the token (which will get sent on registration/signup and mapped to a userid)?

Not the public key, that would violates FIDO's design requirement forbidding correlation. A key pair is minted during registration and the relying party (web site) remembers that specific public key. The FIDO2 device remembers which site it was and its corresponding private key.

That's why it needs storage for each such resident credential on the FIDO2 token.

Re: FIDO2 security key company publishes results of internal security audit

#62

Post by subleq » Fri, Feb 21, 2020, 10:12 PM UTC

StavrosK wrote: post #47

I see a lot of confusion in this thread (warranted, because it's a confusing subject), and I want to clarify a few things: U2F is the old standard, it is only meant be used as a second factor. WebAuthn is the new standard, it has different modes for usage as a second factor, first factor and single factor (usernameless). Only the usernameless mode requires state on the client side. Usernameless strikes me as the holy…

When I try to create an account, I get an error message:

> Your security key can't be used with this site

> www.deadmansswitch.net may require a newer or different kind of security key

This is with a Yubico Security Key 2 which I thought supported FIDO2.

Re: FIDO2 security key company publishes results of internal security audit

#63

Post by StavrosK » Fri, Feb 21, 2020, 11:46 PM UTC

subleq wrote: post #62

StavrosK wrote: post #47

I see a lot of confusion in this thread (warranted, because it's a confusing subject), and I want to clarify a few things: U2F is the old standard, it is only meant be used as a second factor. WebAuthn is the new standard, it has different modes for usage as a second factor, first factor and single factor (usernameless). Only the usernameless mode requires state on the client side. Usernameless strikes me as the holy…

When I try to create an account, I get an error message: > Your security key can't be used with this site > www.deadmansswitch.net may require a newer or different kind of security key This is with a Yubico Security Key 2 which I thought supported FIDO2.

You can't create an account with a key on that site, you can only use it to log in after you associate it to the site.

Re: FIDO2 security key company publishes results of internal security audit

#64

Post by SahAssar » Sun, Feb 23, 2020, 2:48 PM UTC

toastal wrote: post #34

moooo99 wrote: post #28

Physical hardware seems like a promising replacement for passwords. But is there any real adoption in consumer services right now? The only two services I know that suppport Fido2 are Google and GitHub. Are there any other big services I'm missing here?

Amazon Web Services supports it

But still only a single key, right? That basically means that you always need to have a second way to 2FA instead of just having registered two keys (primary and backup).