8 ms·

I don't want to let the password go. It gives me the freedom to rightfully access my service if I just know the secret, without any entanglent to some app, devi

by Canada 8y ago

I don't want to let the password go. It gives me the freedom to rightfully access my service if I just know the secret, without any entanglent to some app, device, or other account.

rodorgas 8y ago
Passwords will continue to exist. But it has a lot of flaws, so it's nice have alternatives.
- ehsankia 8y ago
  Is there a solution for the fact that all of your accounts will be secured by the same "source"? Isn't this almost close to using the same password on every site? I realize a physical secret is better than a password, but if someone gets their hand on your little FIDO device, do they instantly get access to all your accounts?
  - AgentME 8y ago
    The big problem with using the same password on multiple sites is that if any of the sites record your password (because of maliciousness or incompetence), they can re-use your password to log in as you on any other site. Using a security token is more like a password manager with random passwords everywhere than that (the attacker needs to get access to your password manager to get access to your accounts; it's not enough for someone to hack a single site you use), but more secure because it's generally not copyable and the attacker needs physical access to use it. (A virus on your computer can't clone your security token, even if it's plugged in.)
    - ehsankia 8y ago
      That's fair. Although, for my password manager, you need both password and 2FA to access it, whereas a FIDO key would just require stealing the physical key. Does there exist FIDO key (other than phones) that require a password to "enable"? For example, when it's plugged into a new device, the key locks until you input some master password?
      - jontro 8y ago
        The Ledger Nano S requires you to enter a pin code at least
      - rkeene2 8y ago
        Most smartcards require you to authenticate to them before they will perform operations using their private cryptographic keys. I'm adding WebAuthn support to my smartcard middleware [0]. [0] https://cackey.rkeene.org/ https://cackey.rkeene.org/
    - forgotmypw7 8y ago
      Who said anything about using the same password on different sites?
      - MaulingMonkey 8y ago
        "Isn't this almost close to using the same password on every site?" is in the post AgentME is replying to.
  - MaulingMonkey 8y ago
    > Is there a solution for the fact that all of your accounts will be secured by the same "source"? 2FA is still an option (e.g. 1 thing that you have + 1 thing that you know), with the hardware token representing a more secure alternative to phone SMS messages. > Isn't this almost close to using the same password on every site? To get the a shared password, you have to hack one of hundreds of different services that password is used on, or phish the user, and penetration often goes undetected for years. To get the physical secret, you have to rob the user, who will notice they've been robbed the next time they attempt to login. Additionally, trying to login to a phishing website won't automatically auth them with the real website - I can't do secure key exchange algorithms in my head, but a hardware device can.
dontbenebby 8y ago
I've avoided getting a Yubikey because there's not an easy way to use it on my iPhone, sticking with TOTP. But that's a bit of an edge case. (iPhones lack NFC chips)
- ak217 8y ago
  I agree it's annoying. They're working on it, but they should have really enabled it sooner. There's no technical reason, iPhone has the necessary NFC hardware. https://www.wired.com/story/yubikey-lightning-ios-authentication-passwords/ https://www.wired.com/story/yubikey-lightning-ios-authentica...
  - dontbenebby 8y ago
    Interesting link, thanks! For the time being, passphrases + TOTP 2F are sufficient, but I will look forward to being able to use a security key instead.
    - ak217 8y ago
      U2F is fundamentally quite a bit more secure than TOTP - you probably already know this, but just to clarify for those reading.
      - dontbenebby 8y ago
        >U2F is fundamentally quite a bit more secure than TOTP - you probably already know this, but just to clarify for those reading. Yes, IIRC it's impossible (or nearly so) to phish U2F.
  - velosol 8y ago
    Their main page for mobile heavily implies they are already there with iPhone/NFC. https://www.yubico.com/products/yubikey-for-mobile/ https://www.yubico.com/products/yubikey-for-mobile/
    - 8y ago
zaarn 8y ago
In theory, password authentication can continue to exist by deriving a private-key in the browser from a password and using that to complete webauthn.
Existenceblinks 8y ago
> if I just know the secret Sure if one is minimalism (using a few services) Once a storage needed (load of brain, password manager, paper etc.), the "just" goes away. > without any entanglent to some app, device Again If said storage needed, this is not advantage anymore.

by Canada 8y ago

I don't want to let the password go. It gives me the freedom to rightfully access my service if I just know the secret, without any entanglent to some app, device, or other account.

rodorgas 8y ago

Passwords will continue to exist. But it has a lot of flaws, so it's nice have alternatives.

ehsankia 8y ago
Is there a solution for the fact that all of your accounts will be secured by the same "source"? Isn't this almost close to using the same password on every site? I realize a physical secret is better than a password, but if someone gets their hand on your little FIDO device, do they instantly get access to all your accounts?
- AgentME 8y ago
  The big problem with using the same password on multiple sites is that if any of the sites record your password (because of maliciousness or incompetence), they can re-use your password to log in as you on any other site. Using a security token is more like a password manager with random passwords everywhere than that (the attacker needs to get access to your password manager to get access to your accounts; it's not enough for someone to hack a single site you use), but more secure because it's generally not copyable and the attacker needs physical access to use it. (A virus on your computer can't clone your security token, even if it's plugged in.)
  - ehsankia 8y ago
    That's fair. Although, for my password manager, you need both password and 2FA to access it, whereas a FIDO key would just require stealing the physical key. Does there exist FIDO key (other than phones) that require a password to "enable"? For example, when it's plugged into a new device, the key locks until you input some master password?
    - jontro 8y ago
      The Ledger Nano S requires you to enter a pin code at least
    - rkeene2 8y ago
      Most smartcards require you to authenticate to them before they will perform operations using their private cryptographic keys. I'm adding WebAuthn support to my smartcard middleware [0]. [0] https://cackey.rkeene.org/ https://cackey.rkeene.org/
  - forgotmypw7 8y ago
    Who said anything about using the same password on different sites?
    - MaulingMonkey 8y ago
      "Isn't this almost close to using the same password on every site?" is in the post AgentME is replying to.
- MaulingMonkey 8y ago
  > Is there a solution for the fact that all of your accounts will be secured by the same "source"? 2FA is still an option (e.g. 1 thing that you have + 1 thing that you know), with the hardware token representing a more secure alternative to phone SMS messages. > Isn't this almost close to using the same password on every site? To get the a shared password, you have to hack one of hundreds of different services that password is used on, or phish the user, and penetration often goes undetected for years. To get the physical secret, you have to rob the user, who will notice they've been robbed the next time they attempt to login. Additionally, trying to login to a phishing website won't automatically auth them with the real website - I can't do secure key exchange algorithms in my head, but a hardware device can.

dontbenebby 8y ago

I've avoided getting a Yubikey because there's not an easy way to use it on my iPhone, sticking with TOTP. But that's a bit of an edge case. (iPhones lack NFC chips)

ak217 8y ago
I agree it's annoying. They're working on it, but they should have really enabled it sooner. There's no technical reason, iPhone has the necessary NFC hardware. https://www.wired.com/story/yubikey-lightning-ios-authentication-passwords/ https://www.wired.com/story/yubikey-lightning-ios-authentica...
- dontbenebby 8y ago
  Interesting link, thanks! For the time being, passphrases + TOTP 2F are sufficient, but I will look forward to being able to use a security key instead.
  - ak217 8y ago
    U2F is fundamentally quite a bit more secure than TOTP - you probably already know this, but just to clarify for those reading.
    - dontbenebby 8y ago
      >U2F is fundamentally quite a bit more secure than TOTP - you probably already know this, but just to clarify for those reading. Yes, IIRC it's impossible (or nearly so) to phish U2F.
- velosol 8y ago
  Their main page for mobile heavily implies they are already there with iPhone/NFC. https://www.yubico.com/products/yubikey-for-mobile/ https://www.yubico.com/products/yubikey-for-mobile/
  - 8y ago

zaarn 8y ago

In theory, password authentication can continue to exist by deriving a private-key in the browser from a password and using that to complete webauthn.

Existenceblinks 8y ago

> if I just know the secret Sure if one is minimalism (using a few services) Once a storage needed (load of brain, password manager, paper etc.), the "just" goes away. > without any entanglent to some app, device Again If said storage needed, this is not advantage anymore.