5 ms·

I keep asking this on every key thread and don't get great answers - shouldn't we care which ones are actually audited by a 3rd party? Should we bother at all i

I keep asking this on every key thread and don't get great answers - shouldn't we care which ones are actually audited by a 3rd party? Should we bother at all if they aren't? It appears that most aren't, yubikey and nitrokey are the two that are.

Tomte 9y ago
I think U2F keys either work (obviously) or don't. How could they fail silent? Bind to another URL? No, that's a functional failure. Leak cryptographic material to an attacker? I guess not, unless the attacker controls the web browser, and then all bets are off. I'm not a security expert, so take with heaps of salt, but I can't see much exposure here.
- icebraining 9y ago
  I guess not, unless the attacker controls the web browser, and then all bets are off. The point of U2F is to avoid trusting the system, including the browser. Otherwise, what's the point over using just a password manager?
  - Tomte 9y ago
    No, that's obviously not the point, because U2F cannot do that. The point is to combat phishing.
    - icebraining 9y ago
      Ok, fair enough; then what was the point of TOTP?
      - pfg 9y ago
        TOTP keeps authentication secure in the face of password reuse/compromise. If you add a password manager to the mix, it keeps you safe in the event that only your password manager is compromised, unless you're storing your TOTP secrets in it. (All of this applies to U2F too, of course.)
    - mcpherrinm 9y ago
      Then why not use a software token built into the browser or OS? Having a hardware dongle is absolutely about preventing malware on the PC from making off with your key material. That's also why you usually have to press a button to complete the U2F flow.
      - pfg 9y ago
        You're not wrong, but for most sites, there is very little difference between extracting the U2F key and a session key, from the victim's point of view. Exceptions to that rule include sites that do things like what GitHub calls "sudo mode", where you have to confirm certain security-sensitive actions with another U2F confirmation. This would require more effort on the attacker's side, as they'd have to trick the victim into performing a U2F confirmation. More effort, but far from impossible: simply display a fake login prompt for the victim, but instead of logging in, perform whatever malicious action you want to perform. Session keys might also be less persistent (they're limited to something like 30 days on Gmail, for example), so that's another small advantage if the attacker wants to keep their access over long periods of time. Still, for the vast majority of sites and threat models, hardware keys aren't a whole lot better. If it's easier to get adoption for soft keys, that might be a worthwhile trade-off. Natively supported TPM/SEP-backed keys would probably hit the security/UX sweet-spot.
  - arnarbi 9y ago
    That is incorrect. U2F relies on the browser to correctly report the domain you are signing into. If your browser is compromised, you can be phished. But it would have your cookies/tokens already, so probably no need to.
jlgaddis 9y ago
Of course we should. I'd also prefer that the code/firmware was open as well. I would hope there are specific requirements in the spec/standard WRT protecting the keys and such but I haven't checked to see if that's the case. Yubico is, according to their website, working towards FIPS 140-2 validation for at least a few of their devices if that has any value to you (no idea about any of the others).

Tomte 9y ago

I think U2F keys either work (obviously) or don't. How could they fail silent? Bind to another URL? No, that's a functional failure. Leak cryptographic material to an attacker? I guess not, unless the attacker controls the web browser, and then all bets are off. I'm not a security expert, so take with heaps of salt, but I can't see much exposure here.

icebraining 9y ago
I guess not, unless the attacker controls the web browser, and then all bets are off. The point of U2F is to avoid trusting the system, including the browser. Otherwise, what's the point over using just a password manager?
- Tomte 9y ago
  No, that's obviously not the point, because U2F cannot do that. The point is to combat phishing.
  - icebraining 9y ago
    Ok, fair enough; then what was the point of TOTP?
    - pfg 9y ago
      TOTP keeps authentication secure in the face of password reuse/compromise. If you add a password manager to the mix, it keeps you safe in the event that only your password manager is compromised, unless you're storing your TOTP secrets in it. (All of this applies to U2F too, of course.)
  - mcpherrinm 9y ago
    Then why not use a software token built into the browser or OS? Having a hardware dongle is absolutely about preventing malware on the PC from making off with your key material. That's also why you usually have to press a button to complete the U2F flow.
    - pfg 9y ago
      You're not wrong, but for most sites, there is very little difference between extracting the U2F key and a session key, from the victim's point of view. Exceptions to that rule include sites that do things like what GitHub calls "sudo mode", where you have to confirm certain security-sensitive actions with another U2F confirmation. This would require more effort on the attacker's side, as they'd have to trick the victim into performing a U2F confirmation. More effort, but far from impossible: simply display a fake login prompt for the victim, but instead of logging in, perform whatever malicious action you want to perform. Session keys might also be less persistent (they're limited to something like 30 days on Gmail, for example), so that's another small advantage if the attacker wants to keep their access over long periods of time. Still, for the vast majority of sites and threat models, hardware keys aren't a whole lot better. If it's easier to get adoption for soft keys, that might be a worthwhile trade-off. Natively supported TPM/SEP-backed keys would probably hit the security/UX sweet-spot.
- arnarbi 9y ago
  That is incorrect. U2F relies on the browser to correctly report the domain you are signing into. If your browser is compromised, you can be phished. But it would have your cookies/tokens already, so probably no need to.

jlgaddis 9y ago

Of course we should. I'd also prefer that the code/firmware was open as well. I would hope there are specific requirements in the spec/standard WRT protecting the keys and such but I haven't checked to see if that's the case. Yubico is, according to their website, working towards FIPS 140-2 validation for at least a few of their devices if that has any value to you (no idea about any of the others).