Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FIDO2 security key company releases hardware that's open source and uses Rust

solokeys.com

Post reply on HN
Print view View original

91–100 of 160 posts

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#91

Post by vladvasiliu »

l0b0 wrote: post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

As others have said, the key not being easy to clone is a feature.

While I understand why this is and which threat models this addresses, I still think that this shouldn't be an all or nothing proposition.

In the general case, meaning not for people with access to "secure systems" (corporate) or who are high-profile enough to have reason to believe that they themselves may be a target, I think that having "less secure" keys which can be cloned by "non-techies" might still be an improvement to the overall security of the internet.

I didn't do any research, but according to the linked Kickstarter page:

Solo V2 greatly reduces the risk of security breaches, as over 80% of all breaches are caused by passwords compromised through phishing email attacks.

So physically stealing credentials isn't as widespread a risk as phishing, which doesn't really surprise me. Therefore I think Webauthn with "cloneable" keys would be a net positive for "regular people".

This wouldn't preclude "techies" from using more secure, unclonable keys like the Yubikey & friends. But my grandma could also use a "less secure" one without the risk of having to go through resetting 100 different sites and would be able to setup a new key just by having me walk her through the process of restoring a key from a backup. I'm a "techie" and even I would like such a key for use on random "must absolutely register" websites.

Of course there's the issue that if the key is lost you can't easily revoke it. But even with the proposed system of having a backup key registered or going through the recover account process, as long as you don't actively go unregister the lost key it's still registered and working. So if the authentication is based on some sort of counter, the process of effectively disabling the lost token shouldn't be any harder in this configuration.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#92

Post by tialaramex »

l0b0 wrote: post #76
l0b0 wrote: post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

Thank you all so much for the answers! Sorry for my ignorance (or laziness, since I haven't read up on this and don't know of a disinterested guide for techies) about backups; not allowing it is a completely understandable trade-off between security and convenience. It sounds like this is a perfect solution for people at high risk of phishing, a good solution for somewhat technical laypeople with something important…

I guess. However, I'd add that it's also definitely a sensible thing to require of people, however non-technical, where you've got some out-of-band way to issue and re-issue these authenticators to those people.

Suppose you're Twitter. If every Twitter employee has a FIDO2 device and they need to tap it to begin their work day, and to confirm any important actions like "Block YetAnotherNazi" or "Validate that this Twitter account really does represent Jim's 24 hour Celery and Dog Collar Deliveries" then instantly a bunch of your security problems disappear, and all you need are your existing procedures that stop random people walking into your offices off the street and pretending to be employees, which, I'm going to guess, is already a problem you've got at Twitter.

I can't see any reason a university wouldn't do this for its students for example. Or a hospital for its medical staff. Or a police force for... all the cops. These are very easy to use, with that one sharp edge of "What if I lose it?" which is not a problem if your organisation already has procedures to ensure only the right people get physical ID.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#93

Post by sammorrowdrums »

_trampeltier wrote: post #53
stouset wrote: post #39

Earlier quoted context omitted.

> Some (like Yubico) let you purchase a "cloned" set of devices Wait, they do? How? I would love to do this, but I can't find anything relevant on their website.

The same for me. I bought 2 keys and the idea was to have one as a backup key. But I did not find a way to do it. Anyway, even after read about how it works on some websites and watched some videos, the whole things is still a bit of a black box for me. I have no idea how a non-techie at moment a such device can use safe.

I just bought two keys and most services let me enroll two devices or can use Yubico Authenticator, so I scan the OTP barcode twice, and tap each key one time on phone.

Then I'm going to sit with my wife and do that for some of her accounts and she will hold my backup.

edit for clarification, you really do need to have two devices with you to safely enough register 2fa, but obiously it is not safe to keep them both with you after initial setup, in case you lose them both. For the most part you just switch it on for everything with dual keys somehow (even if one registered key plus one Yubi Authenticator OTP).

For services that only actually enable one key, if they have emergency backup codes keep them in password manager, physical safe or a somewhere in your home depending on your threat level and the risks of the particular service being compromised.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#94

Post by boris »

nickray wrote: post #56
_abox wrote: post #46

Nice, I'd love this as an open source yubikey replacement. But it doesn't do OpenPGP, I rely on that way too much sadly. Not just for SSH which supports fido2 now but also for file encryption and my password manager. If they add that in the future I might jump ship.

We hope and think that PIV can replace all the practical use cases for PGP. Specifically among those mentioned, `age` for file encryption, and either FIDO resident keys with hmac-secret for password managers, or something like `passage` (fork of `pass` using, again, `age` for encryption). For SSH you can use FIDO for newer OpenSSH, and either `pivy` or `yubikey-agent` via PIV. Cheers!

Another thing to keep in mind about PIV is that it's currently limited (at the standard level) to RSA-2048 max.

Would it be possible to make a custom firmware that support RSA-4096 PIV?

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#95

Post by sammorrowdrums »

l0b0 wrote: post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

No drivers were needed for my Ubuntu setup or phone, but to have desktop Yubi authenticator app and turn on Linux hardware auth for sudo, login, TTY, I did add a ppa. There instructions for that were good though.

And when setting up any 2fa, need to have two keys and enroll them both, to give a chance of account recovery.

edit I purchased one for my wife and only properly understood when it arrived that it would need to be first used for all my 2fa, and then when helping her get setup I would need to have mine handy as her backup too.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#96

Post by tialaramex »

t0astbread wrote: post #69
nickray wrote: post #57

Earlier quoted context omitted.

No, they cannot. This is an explicit design goal of FIDO ( https://fidoalliance.org/specs/fido-security-requirements/fi... ). The actual public key used for logging in to a specific site is completely random. Optionally, the website can ask for "attestation", which is intended to prove that the public key is from a specific vendor/model. To make this also unlinkable, devices are supposed to share attestation keys in…

Ah, I see! So cross-site (across multiple relying parties) linking is prevented but if I have multiple accounts within one relying party they can be linked?

FIDO (except in resident mode which we'll ignore here) requires the site requesting you authenticate to hand over a large opaque blob called an ID that your authenticator gave it when you enrolled the authenticator. This ID will be different for every time you enrolled an authenticator, and it can recognise its own IDs (using modern cryptography). To prevent you enrolling the same one twice, sites hand over a list of the ones you already enrolled and your authenticators say "I'm already enrolled here" if they recognise the ID.

So somesite.example if it suspects Jim and Candy are the same person, or at least, using the same FIDO authenticator, could do this:

When Jim signs in, they present Candy's ID. If they're right, Jim's authenticator goes "Oh I recognise this, signed". If they're wrong, Jim gets an error. Weird. Presumably on a second try they give Jim's ID and it works so that Jim isn't too suspicious.

So this attack would allow a site that strongly suspects you're doing this to prove it, to their own satisfaction anyway. But it doesn't offer any practical way for a site with more than a handful of users to just match all the users.

In resident mode, you have to admit who you are as part of signing in - you're not separately typing in an email address or username or whatever, you just press the button on your authenticator (or touch the sensor on your phone, or whatever) and you're in. This obviously means it doesn't make sense for Jim and Candy to use one device for two users on the site, and most likely their device will prohibit them from trying to enroll the second user this way.

Edited to add: If someothersite.example plays Jim or Candy's IDs from somesite.example (may it's secretly run by the same people, or they stole a database backup) to Jim (or Candy) they don't work, the IDs are bound to the domain, so these don't match.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#97

Post by brewdad »

kelnos wrote: post #82
tialaramex wrote: post #43

Earlier quoted context omitted.

> Some sites will allow you to simultaneously enroll two devices, so you can keep one as a backup For WebAuthn (the actual standard for how to do this which is what you should be rolling out if you have a greenfield authentication environment that doesn't already do U2F today) the specification explicitly says: > Relying Parties SHOULD allow and encourage users to register multiple credentials to the same account. Re…

That's good to hear! I was under the impression that it was much more common for sites to not support a second device. Glad to know most do.

In my experience every site I set up a physical device with offered either multiple device support or a secondary method like TOTP as a backup. Not as secure, but much more user friendly, recognizing that we are all only human.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#98

Post by dheera »

kelnos wrote: post #31
l0b0 wrote: post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

Others have answered most of your questions, but there's something I think deserves emphasizing: In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doin…

The way this should be solved is for everyone to enable multiple U2F keys in every site and de-register any device or key that is stolen.

Unfortunately many sites suck at this. AWS, Twilio, PayPal all suck.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#99

Post by IgorPartola »

ohazi wrote: post #85
IgorPartola wrote: post #75

Earlier quoted context omitted.

What would be your choice of microcontroller?

I don't actually think it's a bad choice... but that may say more about the state of what's available than about this particular chip. The Cortex-M version of TrustZone is still fairly new, and these M33 devices are some of the first that implement it. You need a lot of care to use it correctly, but it has the potential to reduce the attack surface significantly. Crypto operations and key memory can live in the trust…

Thank you for the info!

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#100

Post by Dylan16807 »

ericseppanen wrote: post #78
_underfl0w_ wrote: post #15

Earlier quoted context omitted.

The hardware is open-source, you can theoretically update the firmware so you're not vulnerable if a researcher finds a bug after your purchase, there's currently no support for getting it to act as a keyboard and type the password for you AFAICT, to name a few.

I don't think this is true in the general case. Most Solokeys come in a "locked" form-- they will only accept firmware updates that are signed by the manufacturer. You can buy a "hacker" variant that is unlocked (meant for those that want to tinker with the firmware), but if you were to use one of those you're giving up security against someone loading malicious firmware onto your device. This is probably the right t…

> You can buy a "hacker" variant that is unlocked (meant for those that want to tinker with the firmware), but if you were to use one of those you're giving up security against someone loading malicious firmware onto your device.

You can't set it to wipe when updated?

Post reply on HN