Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FIDO2 security key company releases hardware that's open source and uses Rust

solokeys.com

Post reply on HN
Print view View original

71–80 of 160 posts

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#71

Post by jabbany »

kelnos wrote: post #31
l0b0 wrote: post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

Others have answered most of your questions, but there's something I think deserves emphasizing: In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doin…

Yeah, this is a very good point.

I deal with this by always adding a second "cold" key when services allow multiple keys, and keeping this cold key somewhere secure as a backup spare. So if I do, say, lose my primary key, I can at least pull out the spare key to reset and de-associate the primary.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#72

Post by jabbany »

baby wrote: post #61
kelnos wrote: post #31

Earlier quoted context omitted.

Others have answered most of your questions, but there's something I think deserves emphasizing: In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doin…

Some websites also allow you to disable or rotate your 2FA creds if you're already logged in, without having to re-authenticate with your second authenticator.

This seems a little dangerous since now the logged in state (likely cookies but maybe also hashed with identifiers like IP etc.) becomes considerably more valuable to steal.

I actually see the opposite done, where any changes to login related things (passwords, 2fa keys) mandate a 2fa re-auth.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#73

Post by IgorPartola »

johncolanduoni wrote: post #58
t0astbread wrote: post #51

As someone who's not familiar with U2F or comparable standards I have a general question about the topic: When registering a key for multiple accounts (at the same site or at different sites) can website owners link those accounts by some common "key ID"? In the sense of: "Oh, this is Bob's key so this account must belong to Bob".

For U2F I don't believe that's the case for most devices. Yubikey outlines their method here[1]. They generate a different keypair for each website public key and have the server store an encrypted and authenticated copy of the private key using a single on-device key. So baring breaking the underlying primitives the server will only have a site-specific public key and a site-specific encrypted blob. [1]: https://dev…

They are asking about two user accounts on the same site, not with two websites on the same server. As in two GMail accounts.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#74

Post by IgorPartola »

georgyo wrote: post #62
nickray wrote: post #56

Earlier quoted context omitted.

We hope and think that PIV can replace all the practical use cases for PGP. Specifically among those mentioned, `age` for file encryption, and either FIDO resident keys with hmac-secret for password managers, or something like `passage` (fork of `pass` using, again, `age` for encryption). For SSH you can use FIDO for newer OpenSSH, and either `pivy` or `yubikey-agent` via PIV. Cheers!

What about code signing? People like to dislike PGP and replace it with a myriad of different solutions. But PGP is everywhere and awesome. It's very wide spread adoption is invaluable. I really don't want to see it replaced with zillions of different bespoke solutions.

Why do people like to hate on PGP? It’s a pretty great project.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#75

Post by IgorPartola »

ohazi wrote: post #8
Foxboron wrote: post #2

I'm still curious how the key is tamper resistent when filling it with transparent epoxy. I asked when the article was published on lobste.rs but never got an answer. It seems to me it should be fairly easy to remove the epoxy and refill after tampering. I should probably email them about this at this point, but I think it's weird they haven't explained the "tampering resistent" part in their marketing material in an…

FWIW, their choice of microcontroller (LPC55s, which is a Cortex-M33 w/ crypto peripherals and TrustZone) doesn't seem completely terrible. There's still a lot of things that need to go right for the whole system to be secure, but "everything happens inside one chip, and we cover it in epoxy" seems pretty reasonable. If you can get rid of the epoxy, the only tampering I'd be worried about is removing capacitors for p…

What would be your choice of microcontroller?

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#76

Post by l0b0 »

l0b0 wrote: post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

Thank you all so much for the answers! Sorry for my ignorance (or laziness, since I haven't read up on this and don't know of a disinterested guide for techies) about backups; not allowing it is a completely understandable trade-off between security and convenience.

It sounds like this is a perfect solution for people at high risk of phishing, a good solution for somewhat technical laypeople with something important to protect which supports this (like a bank account), and too much hassle/risk of losing access/lack of support for most people/use cases. Does that sound fair?

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#77

Post by sigmar »

t0astbread wrote: post #69
nickray wrote: post #57

Earlier quoted context omitted.

No, they cannot. This is an explicit design goal of FIDO ( https://fidoalliance.org/specs/fido-security-requirements/fi... ). The actual public key used for logging in to a specific site is completely random. Optionally, the website can ask for "attestation", which is intended to prove that the public key is from a specific vendor/model. To make this also unlinkable, devices are supposed to share attestation keys in…

Ah, I see! So cross-site (across multiple relying parties) linking is prevented but if I have multiple accounts within one relying party they can be linked?

Public key and key handle would still be unique and unlinkable for each account on the same site with the same u2f token. The yubico documentation is pretty good at explaining this https://developers.yubico.com/U2F/Protocol_details/Overview....

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#78

Post by ericseppanen »

_underfl0w_ wrote: post #15
leafmeal wrote: post #9

How does this compare to a Yubikey for example?

The hardware is open-source, you can theoretically update the firmware so you're not vulnerable if a researcher finds a bug after your purchase, there's currently no support for getting it to act as a keyboard and type the password for you AFAICT, to name a few.

I don't think this is true in the general case. Most Solokeys come in a "locked" form-- they will only accept firmware updates that are signed by the manufacturer. You can buy a "hacker" variant that is unlocked (meant for those that want to tinker with the firmware), but if you were to use one of those you're giving up security against someone loading malicious firmware onto your device.

This is probably the right tradeoff for most users. Solokeys has done a great job of providing continuous support for all of their products, and their software stack has been open source since the beginning. That (combined with the low price) makes them my first choice for a hardware security token.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#79

Post by kelnos »

stouset wrote: post #39
kelnos wrote: post #31

Earlier quoted context omitted.

Others have answered most of your questions, but there's something I think deserves emphasizing: In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doin…

> Some (like Yubico) let you purchase a "cloned" set of devices Wait, they do? How? I would love to do this, but I can't find anything relevant on their website.

After going through their "what do I need?" quiz, it seemed to indicate that was an option. It's possible that I misunderstood, and they just give you two independent keys.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#80

Post by kelnos »

vlovich123 wrote: post #40
kelnos wrote: post #31

Earlier quoted context omitted.

Others have answered most of your questions, but there's something I think deserves emphasizing: In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doin…

> On the flip side, if someone steals your backup key, it becomes harder to deal with the situation; with distinct keys, you can just revoke access to the stolen key. But with cloned keys, revoking access to the stolen key will also revoke the key you use daily. Get a new key, revoke old key, switch to new one?

Right, but the "get new key" bit means that your accounts are in a vulnerable state while you're getting the new key.

If you have two independent keys, and you learn that your backup key is compromised, you immediately revoke it with all services, and order a new one. When the new one arrives, it becomes your new backup, and you enroll that in everything. Your vulnerability to an attacker ends immediately after you find that your backup key has been stolen and you revoke it.

If you have two identical keys, and you learn your backup key is compromised, you order a new one (or pair, rather), but you can't revoke the old key until the new one arrives, when and you can (simultaneously) revoke the old and enroll the new.

Post reply on HN