13 ms·
AWS now supports U2F/Yubikeys
- bigiain 8y ago:sigh: The same week I ditched Chrome in favour Safari...
- mtgx 8y agoYou can toggle security.webauth.u2f to true in about:config on Firefox.
- Operyl 8y agoGP is using Safari, which has no native u2f support. I'm assuming the user isn't using Firefox for similar reasons to I (and many others) have thrown around: it's fan spinning almost immediately on Macbooks.
- tareqak 8y agoThanks! I didn't know that at all. It was actually my one of my reasons to use Chrome for Gmail before I switched.
- deleted 8y ago[deleted]
- atonse 8y agoTry using Brave. It probably supports U2F, without all the privacy invasion of Google.
- pat2man 8y agoWhile we wait for Webauthn support in WebKit, try https://github.com/Safari-FIDO-U2F/Safari-FIDO-U2F https://github.com/Safari-FIDO-U2F/Safari-FIDO-U2F
- robbiet480 8y agoKey note: U2F isn't currently supported in the API, CLI or mobile apps. Docs are unclear as to what the fallback 2FA is, if there is one. Also, as before, you can only have one 2FA method configured at a time, so say goodbye to your hardware tokens or TOTP configurations for AWS if you switch to U2F. EDIT: "Fallback" is to have root account remove your IAM user 2FA. If root account 2FA is lost they have a few alternative verification options like email or phone call. [1] 1: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broken.html https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credenti...
- jchw 8y agoI find this annoying. I'd like to use U2F for my AWS accounts, but it seems like the drawbacks are pretty hard to deal with. With TOTP, you could still use API keys to interact with the API. Is that also true of U2F?
- ummonk 8y agoUggh. That makes it useless if you require mfa for command-line access (using assume-role).
- technion 8y agoAs annoying as that is, if I can run U2F on the root account and the few console accounts I have, I'll feel like we've covered thing most likely to be phished. People are unlikely to type API keys into a phishing site.
- Alex3917 8y ago> Also, as before, you can only have one 2FA method configured at a time, so say goodbye to your hardware tokens or TOTP configurations for AWS if you switch to U2F AWS makes it super quick and easy to remove lost 2FA devices using the root account, so it doesn't really matter as much as losing your 2FA for a crypto exchange or whatever where it's going to take at least a week or two to reset. Just keep TOTP on the root account, since you shouldn't be logging into that on a regular basis anyway.
- illumin8 8y ago
- barryp 8y agoCan you have more than one YubiKey associated with an AWS account? Or also setup TOTP, or have a set of backup codes in case you lost your hardware device? Seems kind of dangerous if you can only have one MFA method setup
- robbiet480 8y agoNo. But you also couldn't have a TOTP + Hardware token previously to U2F introduction [1]. AWS has also never had backup codes to my knowledge, other than saving the secret key used to generate TOTP codes. The "backup" has always been maintaining access to the root account to allow that to reset 2FA as needed. 1: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_u2f.html https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credenti... ("You can enable one MFA device (of any kind) per root user or IAM user.")
- chiefalchemist 8y agoThat can't last (i.e., not more than one). The main reason being you can lose a key, forget it, have it stolen, break it, etc. Without a second you'll be living on the edge. They're gonna have to support more than one. I have a Yubikey for my LastPass. I lived with a single key for over a year. I finally got two more. I'm not sure why I made myself so nervous / stressed those 12+ months.
- robbiet480 8y agoI can't be sure without reading the docs, and I don't care to at the moment TBQH, but it may be possible to remove MFA via API keys for the account.
- pentestercrab 8y agoThe Trezor [1] hardware device supports backing up (at initialization) and restoring of the secret seed which is quite useful. It can also be used as a password manager [2]. [1] https://blog.trezor.io/secure-two-factor-authentication-with-trezor-u2f-e940fd5a60af https://blog.trezor.io/secure-two-factor-authentication-with... [2] https://trezor.io/passwords/ https://trezor.io/passwords/
- mimming 8y agoThey mention Yubikey a lot by name in the post. Has anyone tried a U2F device from a different manufacturer?
- robbiet480 8y agoThey specifically only support YubiCo at the moment, to the point that Chrome asked me if AWS could read my Security Key manufacturer and model when I pressed the button on my 4C Nano.
- pg_bot 8y agoThe manufacturer is irrelevant to the protocol, they may have asked you for these details but they do not matter. You can even emulate the key in software if you wanted.
- robbiet480 8y agoYeah I knew that it didn't matter to the protocol, I only made my comment because I could've absolutely sworn I read in docs or their UI that literally _only_ YubiCo was supported, as in no other U2F would work. Can't find it now, so my bad!
- jiveturkey 8y agoIt does matter. You need an attested cert which only yubico can provide.
- pg_bot 8y agoIncorrect - everything related to the protocol, including becoming a compatible vendor, is managed by the fido alliance which Yubico is a member of. The U2F specification requires you to parse the certificate, and verify the response message against the cert's public key when registering the device with your application. You can choose to only accept certificates whose public key comes from a certain manufacturer, but that is up to the discretion of the implementer and is not required. If you want to read a full overview of the specification you can read the following document https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fido-u2f-overview-v1.2-ps-20170411.pdf https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fid...
- cespare 8y agoIt's frustrating that they only allow a single key. I use 4 different hardware U2F devices. Google, GitHub, Dropbox, and every other service on which I've set up U2F have always allowed me to attach all of my security keys. It seems like AWS is about 3 years behind on this stuff.
- asprouse 8y agoDoes the Node.js SDK support U2F?
- robbiet480 8y agoThe docs say that U2F isn't currently supported via any method other than the AWS Console. No API, no CLI, no mobile apps.
- closeparen 8y agoCould it be? It’s a browser-based protocol.
- kam 8y agoSure. The CLI or SDK could talk to the USB device directly, like the browser does. e.g. https://developers.yubico.com/libu2f-host/ https://developers.yubico.com/libu2f-host/
- pg_bot 8y agoWhile this is a great step forward for U2F adoption, AWS made the same mistake several other online services have made by only allowing a single key per account. The typical U2F user carries at least two keys. (one on their person and one stored securely for backup) I hope they decide to change this because it will cause a ton of customer support problems in their future.
- cmurf 8y agoWhen I had 2FA enabled, using Google Authenticator, and had to reset my phone, I was locked out of AWS. No backup codes. No texting. Nothing. Had to send in a ticket and get a callback.
- bdcravens 8y agoFWIW, Authy does let you store and recover TOTP accounts via password.
- lrvick 8y agoAnd this is also what makes Authy a terrible 2FA tool no one should use ever. It stores your secrets in plain text on the phone without any secure enclave. If your backup password is sniffed or there is a flaw in Authy or your mobile OS sandboxing fails you are toast.
- bluesign 8y agoIf your mobile os sandboxing fails, you are toast in any scenario. I think every authenticator app is toast as long as mobile sandbox is comprised.
- foobarbazetc 8y ago1Password can store/generate TOTP codes.
- movedx 8y ago
- m-p-3 8y agoNow if corporate banks could support this instead of those awful card readers that use browser plugins that doesn't work in anything else than IE7.
- aasasd 8y agoToo bad I can't pay for AWS through my bank because my bank doesn't allow payments without CVC for their insecurity. As do almost all banks in the country.
- nhumrich 8y agoSo, what i never understood about this flow is that only admins can set up mfa. A non admin (any account without IAM permissions) has no way to set up mfa unless an admin does it for them. Currently, I have to have the person tell me their mfa codes next to me, so I van type them in and set it up. How does this work for U2F? Do I have to use their usb device on my computer to allow them to have MFA? It's such a chicken and egg problem.
- bdcravens 8y agoAbility to set one's MFA is something you'd set in IAM, as opposed to a truly permissionless account. https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_users-self-manage-mfa-and-creds.html https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_us...
- akerl_ 8y agoYou can give IAM users permission to add their own MFA device. I’d recommend requiring MFA to remove the device to prevent an attacker from doing so
- nodesocket 8y agoWhat's the best hardware key to buy for native MacBook Pro USB-C support these days? Is it the YubiKey 5C [1]? [1] https://www.yubico.com/product/yubikey-5c/#yubikey-5c https://www.yubico.com/product/yubikey-5c/#yubikey-5c
- Operyl 8y agoYep!
- tptacek 8y agoBear in mind that probably as many AWS accounts are popped by losing access keys as IAM logins (if you're logging in to the root account, stop doing that). For the access keys, you should look into things like aws-vault, which wrap the STS so that your shell is only ever handling temporary session-bound keys.
- jiveturkey 8y agoHadn’t heard of aws-vault, awesome! egg on my face as i consider myself an expert
- outworlder 8y agoThis will keep happening unless you drop the label. AWS is quite vast. Add all possible usage patterns and there's no way you can know it all.
- atonse 8y agoWow aws-vault looks awesome. Something I badly need so I can clear out my ~/.aws/credentials file. Thanks for the tip.
- lvh 8y agoThis is underwhelming. - Requiring the attestation cert and not accepting a self-signed one—which U2F devices will magically not work? I don’t know, but apparently it’s strictly Yubikeys now. - Still not convinced anyone seriously uses the console except for root accounts, where AWS forces you to. - Only one U2F key? Bad. Only one U2F key and overall only one MFA method at all, disabling MFA where it matters most? Baffling. - The legacy U2F API instead of just using WebAuthn already? This is one of those things where I keep thinking I should just open source the SAML thing that safely gets an assertion to your CLI where you can assume-role with it, but who knows when AWS is going to decide to reimplement your project.
- p0rkbelly 8y agoHow is U2F considered legacy already? It's still fairly the most modern way for a 2nd factor. WebAuthn just came outmonths ag and most of the Yubikeys - as well as apps/sites/services -- don't support it.
- deleted 8y ago[deleted]
- hrez 8y agoIt seems ironic that Universal 2nd Factor apparently means Yubikey only.
- holstvoogd 8y ago> which U2F devices will magically not work? Atleast Krypton doesnt' work, neither do Titan keys it seems. I would consider they did that on purpose in some kind of deal with yubico. But given the general level of 'buring-pile-of-failure' AWS manages to produce around the console, it is probably just that they didn't know
- deleted 8y ago[deleted]
- Scott_Sanderson 8y agoLove my yubikey
- atmosx 8y agoA bit off-topic but, how does a yubikey compare to a password manager (e.g. 1Password) + biometric auth? What are the pros/cons?
- sedatk 8y agoU2F literally stands for “Universal 2nd Factor” so it’s not a replacement for passwords (the first factor). They are not comparable. Not using a U2F key makes you susceptible to phishing attacks.
- snarf21 8y agoCan't you still be vulnerable to a MITM phishing attack?
- rejberg 8y agoWhat do you mean by a MITM phishing attack? U2F credentials are tied to a particular domain, and so do not rely on the user making sure they are on the correct website. As such, they are not susceptible to typical credential phishing attacks.
- snarf21 8y agoThings like this: https://security.stackexchange.com/questions/157756/mitm-attacks-on-fido-uaf-and-u2f https://security.stackexchange.com/questions/157756/mitm-att... This is assuming an owned machine. Not the easiest attack but still possible. Obviously things like Google Authenticator (while good) are even more susceptible to MITM phishing.
- scrollaway 8y agoIf the machine is owned it's trivial to dig the cookie jar once you're logged in.
- rthille 8y ago
- _Codemonkeyism 8y agoSooner or later I'll move away from Gmail b/c they make it hard to U2F be used with Firefox. More U2F is the way to go, hopefully everyone supports it in the not too distant future.
- guitarbill 8y agoRight? The only reason I can see for them making it so hard is to pimp Chrome. Firefox supports U2F, and they know I also have an authenticator app which works with any browser. But no, they have to make it awkward and shove a Chrome ad in my face. Very jarring, and yet another disgusting move from Google (one that has gotten very little press).
- emlun 8y agoGoogle did suddenly start supporting U2F in Firefox a few months ago!
- _Codemonkeyism 8y agoSomehow doesn't work for me :-(
- todd8 8y agoU2F is by default disabled in Firefox. You have to turn it on before using your Yubico (or other FIDO) key for a service being accessed though Firefox. It’s easy to enable. See https://www.trishtech.com/2018/07/enable-fido-u2f-security-key-yubikey-in-mozilla-firefox/ https://www.trishtech.com/2018/07/enable-fido-u2f-security-k...
- _Codemonkeyism 8y agoDid that some time ago already, doesn't work for me, I can't log in with my Yubikey, which at the same time works from Chrome.
- 8y ago
- 4real 8y agoI’m using the Google Authenticator for MFA today, but are soon travelling abroad for a week. Should I loose my phone on the trip, a (single) Yubikey would be my rescue, both regarding AWS and other services supporting Yubikey. Any thoughts?
- michaelanckaert 8y agoI don't find the lack multiple U2F keys a big problem. It would be a great feature but considering proper user management it's not a big fail in my opinion. In my case all AWS accounts have a root user that has MFA enabled and that secret key is stored in a password vault. When a root user login is needed the key is plugged into an OTP application, tasks are performed and then the key is removed from the application. I do however miss MFA when using the AWS CLI. A lot of my clients require MFA enabled when assuming a role in their account.