Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless Logins with Yubikey

adl1995.github.io

Post reply on HN
Print view View original

61–66 of 66 posts

Re: Passwordless Logins with Yubikey

#61

Post by taeric »

mikeiz404 wrote: post #54
taeric wrote: post #50

Earlier quoted context omitted.

This is a bit muddied when talking about securing access to something you also have. That is, you aren't securing your vpn with two factors. You are securing access to your vpn. It is different. Similarly, for your computer, it is already something you have. Such that the password to login to the machine can already be seen as a second factor. My home password, as an example, is worthless to you without me home compu…

Interesting point. I never really thought of the laptop as something you have but it certainly is. I will say that a security key is far easier to carry on you in more situations than say a laptop is and certainly a desktop. And the key, depending on how it is used to secure the device, may help mitigate brute force password attacks in the event that the device is stolen. An argument could be made for defense in dept…

Agreed, I wasn't trying to say that your computer counts as enough of "what you have" to third parties. Is why I don't think it counts for most accounts you have access to.

That said, your phone is growing to take that privilege.

Re: Passwordless Logins with Yubikey

#62

Post by SahAssar »

taeric wrote: post #60
SahAssar wrote: post #59

Earlier quoted context omitted.

The reason a computer usually isn't considered "something you have" is that malware can clone them or they can be configured for remote access. Half the point of a yubikey or other hardware token is that they are supposed to be unclonable (and hence tied to a single physical device). Some of that can be replicated with a TPM I'm guessing but that isn't the norm yet.

Sorta. The "cookie" in your browser is often enough to pin your computer as "something you have" for access to services. Gmail, in particular. (Similar for the security enclave on your phone.) As I understand it, a yubikey is '"something you have" that we can reasonably verify as unique based on a shared secret with a third party.' That is, the algorithm that the yubikey is using to verify that it is something you ha…

The cookie can be easily cloned since it has to be readable to the browser so it can be sent to the service. Also the cookie is issued to the browser after presenting other credentials to login like password, 2fa and magic links so it does not fill the same role at all. Cookies make a very bad "something you have" factor since they are constantly sent over the network, so at any point there are many different load balancers, application servers and so on that could reasonably claim to be the "thing you have". Cookies are also (usually) issued by the service, not by the client so by definition they have been on some other device that is not the device you want to prove you have before landing on the device you want to prove ownership of.

What makes hardware tokens (like the yubikey) fill this role better is that the algorithm (which is really pretty standard crypto) runs on the device and the device is specifically designed to not reveal its keys, so it's easier to assume that anyone that can present proof of the keys also has the physical object.

Secure enclave (and that is why I mentioned TPMs in the previous post although it seems like it would require a TEE) could fill the same role as a yubikey, but is often not used that way except for the device vendors login (like apple id). Even if your password is encrypted in a way that only the secure enclave can unlock if you can get it out of there then it is not as secure as something that you can only prove possession of (and not extract).

Re: Passwordless Logins with Yubikey

#63

Post by xaduha »

nyuszika7h wrote: post #58
xaduha wrote: post #41

If you have nothing better to do: 1. Get a smart ring like OMNI 2. Shove a USB hub and a contactless reader into your mouse, so if on the next poll your hand with a ring isn't on it - lock it all Seriously though, if someone would start selling mice with contactless readers built-in, I'd buy a few.

How would that work if you're typing on the keyboard?

Configure it how you want, e.g. 3-5 minute interval should do it. I don't think I type anything for more than 5 minutes without touching a mouse, I don't use vim that much nowadays.

Re: Passwordless Logins with Yubikey

#64

Post by parliament32 »

mabbo wrote: post #19

True security is using both "something you know" and "something you have". Something you have can be stolen, and something you know can be tricked out of you. But stealing both is difficult and far more obvious. To login to my work VPN, the password is " ". Our SSO system requires both once per day as well. It's a great system and I highly recommend it.

Sounds like our setup, OpenVPN + LinOTP? Pin + HOTP in a password field is a nice way to force 2FA into applications that don't support it natively.

Re: Passwordless Logins with Yubikey

#65

Post by glsdfgkjsklfj »

SahAssar wrote: post #62
taeric wrote: post #60

Earlier quoted context omitted.

Sorta. The "cookie" in your browser is often enough to pin your computer as "something you have" for access to services. Gmail, in particular. (Similar for the security enclave on your phone.) As I understand it, a yubikey is '"something you have" that we can reasonably verify as unique based on a shared secret with a third party.' That is, the algorithm that the yubikey is using to verify that it is something you ha…

The cookie can be easily cloned since it has to be readable to the browser so it can be sent to the service. Also the cookie is issued to the browser after presenting other credentials to login like password, 2fa and magic links so it does not fill the same role at all. Cookies make a very bad "something you have" factor since they are constantly sent over the network, so at any point there are many different load ba…

> and the device is specifically designed to not reveal its keys,

Just want to take this moment to remind everyone that the yubikey have a protocol to configure it. Nobody knows the code that runs that prototocol. Nobody knows the full capabilities of said prototocol. the best hint we have is the semi-opensource configurator python/cli utilities which are just a bitmashing client of the published capabilities.

thank you.

Re: Passwordless Logins with Yubikey

#66

Post by SahAssar »

glsdfgkjsklfj wrote: post #65
SahAssar wrote: post #62

Earlier quoted context omitted.

The cookie can be easily cloned since it has to be readable to the browser so it can be sent to the service. Also the cookie is issued to the browser after presenting other credentials to login like password, 2fa and magic links so it does not fill the same role at all. Cookies make a very bad "something you have" factor since they are constantly sent over the network, so at any point there are many different load ba…

> and the device is specifically designed to not reveal its keys, Just want to take this moment to remind everyone that the yubikey have a protocol to configure it. Nobody knows the code that runs that prototocol. Nobody knows the full capabilities of said prototocol. the best hint we have is the semi-opensource configurator python/cli utilities which are just a bitmashing client of the published capabilities. thank…

I was just about to say that they still sell the neo which runs opensource firmware. Seems like they don't though and have discontinued that line.

Still the idea of hardware tokes, u2f, WebAuthN is not at all tied to yubikeys and there are implementations of it that are software-opensource like solokeys.

I think the security of a yubikey is likely better than most alternatives even if it is not open to scrutiny anymore.

I'm also guessing this is the point where it would be good to mention that WebUSB was a vulnerability for u2f hardware tokens (if you gave sites permission to interact with USB devices): https://www.wired.com/story/chrome-yubikey-phishing-webusb/

Post reply on HN