5 ms·

This is underwhelming. - Requiring the attestation cert and not accepting a self-signed one—which U2F devices will magically not work? I don’t know, but appare

by lvh 8y ago

This is underwhelming. - Requiring the attestation cert and not accepting a self-signed one—which U2F devices will magically not work? I don’t know, but apparently it’s strictly Yubikeys now. - Still not convinced anyone seriously uses the console except for root accounts, where AWS forces you to. - Only one U2F key? Bad. Only one U2F key and overall only one MFA method at all, disabling MFA where it matters most? Baffling. - The legacy U2F API instead of just using WebAuthn already? This is one of those things where I keep thinking I should just open source the SAML thing that safely gets an assertion to your CLI where you can assume-role with it, but who knows when AWS is going to decide to reimplement your project.

p0rkbelly 8y ago
How is U2F considered legacy already? It's still fairly the most modern way for a 2nd factor. WebAuthn just came outmonths ag and most of the Yubikeys - as well as apps/sites/services -- don't support it.
- lvh 8y ago
  Yes, they do. WebAuthn is the modern API, but it’s backwarss compatible with every U2F device. You don’t need a WebAuthn key to use the WebAuthn API.
  - p0rkbelly 8y ago
    Gotcha. I guess I was thinking about the new FIDO standard on the new Yubis.
deleted 8y ago
[deleted]
hrez 8y ago
It seems ironic that Universal 2nd Factor apparently means Yubikey only.
holstvoogd 8y ago
> which U2F devices will magically not work? Atleast Krypton doesnt' work, neither do Titan keys it seems. I would consider they did that on purpose in some kind of deal with yubico. But given the general level of 'buring-pile-of-failure' AWS manages to produce around the console, it is probably just that they didn't know
- tialaramex 8y ago
  If they require attestation that's one more reason I won't be using this, sadly. I always block attestation because there's no need for it when you're supposedly offering an optional second factor, even though I actually do own a Yubico product. It makes no security sense to check attestation if your second factor is optional. How could a non-Yubico second factor make things worse compared to not using one? It couldn't. If you really, really care then store the attestations so that when fifty customers claim their U2F was broken into you can show that they all have Crap Co. FIDO tokens and point the finger at Crap Co. that's the absolute most that makes any sense with attestation. Now, if second factor is _mandatory_ then it could make sense to decide OK, we trust Mattel, Apple and LexCorp but not HP, Tyrell Corp, or Weyland-Yutani. It's anticipated that banks (in fifty years when they hear about this new-fangled FIDO technology) would want that, giving customers their own tokens with their own attestation certs. But for an outfit like AWS this option makes no sense, so the correct design is to Never Ask, and if some higher-up insists on asking, just store the answer (including "No, fuck off") with the user's account and press on anyway.
- lvh 8y ago
  I'm hearing confirmations that it's just Yubico, yes.

by lvh 8y ago

p0rkbelly 8y ago

How is U2F considered legacy already? It's still fairly the most modern way for a 2nd factor. WebAuthn just came outmonths ag and most of the Yubikeys - as well as apps/sites/services -- don't support it.

lvh 8y ago
Yes, they do. WebAuthn is the modern API, but it’s backwarss compatible with every U2F device. You don’t need a WebAuthn key to use the WebAuthn API.
- p0rkbelly 8y ago
  Gotcha. I guess I was thinking about the new FIDO standard on the new Yubis.

deleted 8y ago

[deleted]

hrez 8y ago

It seems ironic that Universal 2nd Factor apparently means Yubikey only.

holstvoogd 8y ago

> which U2F devices will magically not work? Atleast Krypton doesnt' work, neither do Titan keys it seems. I would consider they did that on purpose in some kind of deal with yubico. But given the general level of 'buring-pile-of-failure' AWS manages to produce around the console, it is probably just that they didn't know

tialaramex 8y ago
If they require attestation that's one more reason I won't be using this, sadly. I always block attestation because there's no need for it when you're supposedly offering an optional second factor, even though I actually do own a Yubico product. It makes no security sense to check attestation if your second factor is optional. How could a non-Yubico second factor make things worse compared to not using one? It couldn't. If you really, really care then store the attestations so that when fifty customers claim their U2F was broken into you can show that they all have Crap Co. FIDO tokens and point the finger at Crap Co. that's the absolute most that makes any sense with attestation. Now, if second factor is _mandatory_ then it could make sense to decide OK, we trust Mattel, Apple and LexCorp but not HP, Tyrell Corp, or Weyland-Yutani. It's anticipated that banks (in fifty years when they hear about this new-fangled FIDO technology) would want that, giving customers their own tokens with their own attestation certs. But for an outfit like AWS this option makes no sense, so the correct design is to Never Ask, and if some higher-up insists on asking, just store the answer (including "No, fuck off") with the user's account and press on anyway.
lvh 8y ago
I'm hearing confirmations that it's just Yubico, yes.