4 ms·

Stealing Web Authentication keys from a hardware token is a significantly higher bar than phishing you or brute-forcing your password hash from a database leak.

Stealing Web Authentication keys from a hardware token is a significantly higher bar than phishing you or brute-forcing your password hash from a database leak. At the very _least_ the attacker would first have to compromise your machine with malware, at which point they could easily get access to all your password-protected accounts anyway with a simple keylogger.

dmortin 9y ago
What happens if you lose your hardware token (or it gets stolen, ec.)? Is there a way for then to access your accounts?
- gruez 9y ago
  backup/recovery codes and/or "forgot your password (authenticator)" recovery
- StavrosK 9y ago
  Ideally (and hopefully this will be doable, as I don't see any impediments), you can have Bitcoin-wallet-style seed generation that you can back up onto a piece of paper and store it somewhere safe. I really hope my Ledger Nano S becomes WebAuthN-compatible, as it can already be used as a U2F key.
  - tialaramex 9y ago
    Yes, for a device as complicated as the (~ $100) Ledger Nano S I don't see any reason they couldn't support that functionality. Most people will be using much cheaper, dumb authenticators which aren't going to have the capability to read and update the keys, they would be expected to replace their authenticator altogether, not try to clone it if there's a problem.
- ethagnawl 9y ago
  This could introduce latency and centralization to the authentication process, but perhaps there could be a public key server/service that would allow the user to issue a revocation certificate. This scenario could also be a legitimate use case for blockchain technology.
  - nfoz 9y ago
    If there isn't a solution in place for revocation, then it's not really an authentication solution, IMO. I would have thought this would be part of the proposed API. Do you think it belongs there?
    - tialaramex 9y ago
      This functionality is orthogonal to the API. If say my Gmail is configured to trust my awesome Darth Vader bobble head authenticator, the tiny one I keep on my keychain and one that's in my locked desk drawer with my cyanide pills and then I lose my keys somehow, I go home, use the Darth Vader to sign in, click for the account credentials page, pick the keychain one and pick remove. I can add another one when I buy it, using the ordinary enrollment step. No new API needed or desired. The trick to U2F and this whole family of technologies is that the devices are really dumb, your authenticator doesn't remember "I'm allowed to authenticate to Google, I picked this key" it just turns google.com into a number and uses that with some crypto arithmetic. If you never actually enrolled with Google, the results are worthless but it has no idea. If I try to sign into Mike's account with Sarah's authenticator, it doesn't work but there's no clue why. The authenticator doesn't even know it's Sarah's.

dmortin 9y ago

What happens if you lose your hardware token (or it gets stolen, ec.)? Is there a way for then to access your accounts?

gruez 9y ago
backup/recovery codes and/or "forgot your password (authenticator)" recovery
StavrosK 9y ago
Ideally (and hopefully this will be doable, as I don't see any impediments), you can have Bitcoin-wallet-style seed generation that you can back up onto a piece of paper and store it somewhere safe. I really hope my Ledger Nano S becomes WebAuthN-compatible, as it can already be used as a U2F key.
- tialaramex 9y ago
  Yes, for a device as complicated as the (~ $100) Ledger Nano S I don't see any reason they couldn't support that functionality. Most people will be using much cheaper, dumb authenticators which aren't going to have the capability to read and update the keys, they would be expected to replace their authenticator altogether, not try to clone it if there's a problem.
ethagnawl 9y ago
This could introduce latency and centralization to the authentication process, but perhaps there could be a public key server/service that would allow the user to issue a revocation certificate. This scenario could also be a legitimate use case for blockchain technology.
- nfoz 9y ago
  If there isn't a solution in place for revocation, then it's not really an authentication solution, IMO. I would have thought this would be part of the proposed API. Do you think it belongs there?
  - tialaramex 9y ago
    This functionality is orthogonal to the API. If say my Gmail is configured to trust my awesome Darth Vader bobble head authenticator, the tiny one I keep on my keychain and one that's in my locked desk drawer with my cyanide pills and then I lose my keys somehow, I go home, use the Darth Vader to sign in, click for the account credentials page, pick the keychain one and pick remove. I can add another one when I buy it, using the ordinary enrollment step. No new API needed or desired. The trick to U2F and this whole family of technologies is that the devices are really dumb, your authenticator doesn't remember "I'm allowed to authenticate to Google, I picked this key" it just turns google.com into a number and uses that with some crypto arithmetic. If you never actually enrolled with Google, the results are worthless but it has no idea. If I try to sign into Mike's account with Sarah's authenticator, it doesn't work but there's no clue why. The authenticator doesn't even know it's Sarah's.