17 ms·
Biometric YubiKey
- antpls 7y agoThis is so cool. What I am worried about using fingerprint is that they are either stored on a laptop or a smartphone. You have to trust a lot of hardware, the whole software stack made by many third parties to protect that data. With this key, that's already many less parts to verify and trust. Let's hope it's not easily reverse-engineerable and the key is never shared with Yubikey.
- Yizahi 7y agoMeanwhile I just wish I could use my old Yubikey like everyone else. But it seems that outside of walled googlenet there is very low chance for it. It is now second year as yubikey is collecting dust in my drawer. Fuckyou very much google, I really appreciate this.
- icebraining 7y agoHow is it Google's fault that you can't use Yubikeys on non-Google sites?
- johntash 7y agoI'm not sure I understand what google has to do with it at all? There are a lot of non-google sites that support Yubikey (and others).
- jonplackett 7y agoWhat happens if you lose your yubikey? Are you then locked out of your accounts? Or is there a backup way to get in, and if so does that make the yubikey kinda pointless anyway?
- OJFord 7y agoYou can do either, whatever you prefer. You could generate keys off the device and keep a copy elswhere allowing you to revoke the device's sub key and generate a new one for a replacement device. You could have two, and only carry one. (Big downside is that you need to fish out the backup every time you register for something new.) You could use something else as a second factor as well, and just treat the device as a more convenient option than looking up and typing in an TOTP code, say.
- Dayshine 7y agoThe obvious solution to me (although I don't see it recommended on the yubikey website) is to buy 2 yubikeys and register both with services. Then put the 2nd in a locked safe or other location that requires someone to have absurd access. If you lose the 1st, use the 2nd to deregister the 1st and register a 3rd.
- laumars 7y agoUsually you'd have more than one sysadmin on the team so the 2nd guy could restore your access. Having a reliance on 1 individual creates a great deal of risk, not just in the case of lost YubiKeys.
- vzaliva 7y agoAny word how this will be supported on Linux? The article states: "In keeping with Yubico’s design philosophy, the YubiKey Bio will not require any batteries, drivers, or associated software."
- matheusmoreira 7y agoYubico has released open source programs to manage YubiKeys. https://github.com/Yubico/yubikey-manager/ https://github.com/Yubico/yubikey-manager/ For example, it is possible to configure whether user interaction is necessary before encrypting: ykman openpgp set-touch enc off The program will probably gain support for fingerprint configuration when the new YubiKeys are released.
- mrlambchop 7y agoYubikey's use the standard keyboard USB driver so they should be hot pluggable on any linux system that is configured to enable hotplug.
- matheusmoreira 7y agoOnly the static password and one time password modes though. In those modes, the YubiKey acts like a keyboard and literally types out the password when the user presses the button. The flagship YubiKeys can also act like a smart card. They are PIV compatible and support X.509 certificates. They can also store encryption, authentication and signing OpenPGP keys. GNU Privacy Guard opens the YubiKey as if it was a smart card.
- jolmg 7y agoI think vzaliva didn't quote the right part, and was referring to how the Yubikey is going to depend on Windows to enroll your fingerprint with it.
- deleted 7y ago[deleted]
- spuz 7y ago
- donpdonp 7y agoSounds like a creative new way to get locked out of your own keys.
- jolmg 7y agoYou mean if you get a cut on the finger you registered. On this page[1], though, it says it would support "[storing] multiple fingerprints", so that should help in that case. [1] https://www.yubico.com/products/yubikey-hardware/ https://www.yubico.com/products/yubikey-hardware/
- teekert 7y agoThat is a must, I recently started skateboarding and wipping it up and grabbing the sanding paper-like surface makes my fp scanner not work for about 2 days!
- cormacrelf 7y agoHot tip for guitarists: left thumb fluctuates least.
- bigiain 7y agoHmmm, I wonder if there's a way to set this up with a "duress" fingerprint, that'll unlock a special/different key and log you in to completely vanilla accounts instead of your real ones?
- xahrepap 7y agoI currently have multiple keys. One I carry on me and one I locked in our firesafe with other important documents. The way I see it, I would want the bio version to be the one on my person. I still have the other put away where it won't be lost. I lose my hand? Still have a backup. I lose my key? Backup and maybe I have a little bit of extra time to update my bank MFA while the thief figures out the fingerprint situation.
- Someone1234 7y ago
- paggle 7y agoI can't stand fingerprint readers. My skin for whatever reason tends to get only about a 20% success ration over three attempts.
- Someone1234 7y agoDitto. I have found that it has improved slowly over the years as fingerprint readers' sensors have become more advanced. My Pixel 3 gets it almost 60%~70% of the time now (unless my fingers are wet).
- RachelF 7y agoI've done a bit of IT support for old folks. People over 70 typically battle to register their fingerprints and get them working on Apple and Samsung devices.
- ShakataGaNai 7y agoEczema on my hands. One pointer finger's print is totally unreadable to anything. So I get you on that one. But this device is a simply a step up from the non-biometric enabled units which you can buy today.
- munchbunny 7y agoI have mixed feelings about this. The form factor is great as a second factor, but I don’t trust fingerprints as a primary auth factor due to (1) existing precedent of bugs in fingerprint recognition (2) that you can’t revoke your fingerprint, and (3) that Yubikeys are somewhat easy to lose.
- jolmg 7y agoWhat I'm hoping is that it can be used as a more secure version of the button that the other keys have. That is, if I get this, I wouldn't use the fingerprint without the PIN. I hope I can use both for a single authentication.
- CraftThatBlock 7y agoThis is strictly an upgrade from the old button though, as this is a single form of physical security vs zero. If used with a password, the key is only secure in computers with the password, AND it has to be you pressing. Fingerprint are not very secure, but as this is meant to be only for physical access with the password, it's much better than before.
- munchbunny 7y agoThat's not the whole story. The use case we're all familiar with is that the YubiKey acts as the second (physical) factor. In that use case, this is great, because now you can opt to make the login three-factor: something you know (password), something you have (the fob), and something you are (your fingerprint). However, Yubico has also been pushing the password-less login angle. If you look at the FIDO 2/WebAuthn standards and the new capabilities in the current generation of YubiKeys (YubiKey 5's), there's a new capability called a resident key. This removes the dependence on passwords entirely. Currently you can protect that key with a password. I believe this new thumbprint reader allows you to unlock the resident key with a thumbprint. That's what would bring it to parity with built-in thumbprint readers on laptops. Passwordless login currently exists in the form of thumbprint readers (like on Thinkpads and those Samsung phones that recently showed they had a major flaw) and face recognition (laptops and phones). In the case of facial recognition, I think the convenience benefit is worth the security tradeoff. However, I'd be nervous about using passwordless fingerprint authentication on my YubiKey because that thing is so much easier to lose track of, and I don't trust fingerprint recognition.
- JoeAltmaier 7y agoAgain: fingerprints are absolutely unsuitable as 'passwords'. They are at most, usernames. Because they cant be changed regularly, are left around for people to find (on the yubikey device itself!), are readily connected to you as a person, have terrible entropy (a few bits).
- theptip 7y agoThis product does not make your fingerprint into a password. The fingerprint is a third factor. Your password is the first. The physical key is the second. And the fingerprint is the third. If your fingerprint is compromised, this system reverts to the security of a 2FA system with a normal physical token (i.e. very strong).
- tialaramex 7y agoYour understand that in this flow the password isn't used right? You plug the key into the Windows PC, and you put your fingertip on the sensor and you're signed in. That's two factors, "Something you have" and "Something you are" not three.
- djsumdog 7y agoBut that's not how must Yubikey flows are implemented. For an AWS console, you sign in with a username and password, then tap the contact on your Yubikey. The only difference here is that the key now only works with your finger print and not any random person's.
- tialaramex 7y agoYou're correct, that's not how most flows are implemented. But it is the new flow enabled by this device. For your AWS sign in obviously it won't need a fingerprint and so it'd be kind of silly for the demo to be "this more expensive product works like the older cheaper product you already have" they wanted to show off the new feature which is the "resident credential" user verification mode.
- 7y ago
- SloopJon 7y agoI've read several articles and discussions about the topic, but I'm still a little fuzzy on where biometrics fit in the context of authentication: username, password, just another factor? What is the role of the fingerprint in the case of this key?
- kovek 7y ago"Something I know, something I have, something I am". I think "something I am" is difficult to achieve.
- jolmg 7y agoSomething I know: The PIN (password) Something I have: The Yubikey (hardware key) Something I am: The fingerprint (biometrics) So this Yubikey enables 3FA.
- xaduha 7y agoPINs and passwords are not the same though, PINs are for devices and usually not intended to be sent anywhere else, unlike passwords. PINs are also protected from bruteforce, that's why they are usually just 4 numbers.
- jolmg 7y agogpg and the OpenPGP card spec calls it PIN, but it's not restricted to numbers and can be quite long, though I don't remember the limit. Passwords are normally also protected from bruteforce. Many places lock you out for some time after many failed attempts. The "PINs are for devices" seems kind of arbitrary.
- xaduha 7y agoYet nobody uses 4 digit passwords. https://en.wikipedia.org/wiki/Personal_identification_number https://en.wikipedia.org/wiki/Personal_identification_number
- phillipseamore 7y ago1) This is an upgrade to the touch sensitive button that's on all YubiKeys today. The reason you have to touch the key is so that if an attacker gains access to your computer with an attached Yubikey, they will not be able to use it (it requires physical presence). Now that touch sensitive button becomes a fingerprint reader, so it can't be activated by just anyone. 2) The computer/OS doesn't have to support anything for this added feature.
- Leace 7y ago> 1) This is an upgrade to the touch sensitive button that's on all YubiKeys today. The reason you have to touch the key is so that if an attacker gains access to your computer with an attached Yubikey, they will not be able to use it (it requires physical presence). Now that touch sensitive button becomes a fingerprint reader, so it can't be activated by just anyone. I'd like it to work that way but when I'm reading the article it doesn't explicitly say that (only mentioning integration with Azure that's not interesting for me). Is there any authoritative info that the fingerprint reader will work as touch button but with verification of fingerprints in all scenarios? (like touch-to-use on OpenPGP applet, U2F applet etc.)
- deleted 7y ago[deleted]
- brazzy 7y ago> The reason you have to touch the key is so that if an attacker gains access to your computer with an attached Yubikey, they will not be able to use it (it requires physical presence). Additionally, it prevents brute force attacks on the hardware.
- penagwin 7y agoOnly If you keep your key and computer hardware separate and kept separate. Some hardware keys are being built into devices, or are left in them semi-perminately (to be fair, physical attacks arent a real concern for most people)
- sahaskatta 7y agoThis is pretty neat. I wish there was a USB-C model.
- seized 7y agoYubikey has USB-C touch models so likely a USB-C bio version is next on the list.
- ShakataGaNai 7y agoI'd love a model that supported both USB-A, USB-C and NFC. I realize it wouldn't be nearly as small, but that would certainly cover all the bases.
- nixpulvis 7y agoheh, just build a little facade for it.
- schmichael 7y agoYou forgot BLE! Then you could actually use it across all of your devices.
- astrea 7y agoThe same BLE with known vulnerabilities?
- hwillis 7y ago
- drannex 7y agoI am just imagining how insane this would have been if it were released 20 years ago, or ten years ago, or even as recent as five years ago.
- oxplot 7y agoWhat most comments are missing here is that webauth is a replacement for passwords. You know the "123456789", "jim1966", "monkey123", etc. With this key, remote attackers are completely neutralized. That's the bulk if not almost all attacks usually.
- acheron9383 7y agoYeah, it may be a decent tradeoff for those who don't want the increased effort of entering 2-factors. Password + key. For those who don't trust the fingerprint reader that much, it does upgrade you to effectively 3 factors; password, key, and finger.
- zxcvbn4038 7y agoIt is not a password replacement, you still need multiple factors of authentication. Yubikey satisfies the “something you have” factor, your password is still the “something you know”. Your password can be learned but should not be usable without something you have. Your token can be taken but should not be usable without the something you know. Fingerprints are not infalable, it’s more confidence of a match then exact match - Samsung was just in the news because someone figured out how to trick their sensors to read a false positive. Having a password also would keep that from being exploitable. Also keep in mind that current school of legal thought in the US is that biometrics don’t qualify for 5th amendment protections whereas passwords do - police can force you to put your finger on a reader, but they can’t force you to give a password without judicial review.
- oxplot 7y agoYou missed my point entirely. So I repeat it here: most attacks are online attacks, remote in nature, so even a physical security key without fingerprint reader is still superior to passwords and would mitigate majority attacks. Webauthn [1] is not the same as 2FA. That's a different standard and it is meant to replace passwords. The fingerprint reader on this new yubikey is an additional measure against someone in close proximity of your physical key bring able to use it. [1]: https://en.m.wikipedia.org/wiki/WebAuthn https://en.m.wikipedia.org/wiki/WebAuthn
- 7y ago
- dzhiurgis 7y agoIs there any credit card size yubikeys yet? Also, how come macbooks don't come with nfc yet? Carrying keys is not something I've done for 10 years or so. What I'd really like to see is government ID that works somehow similarly how domain certificates work - you can either use your Id as yubikey or authorize/mint multiple additional keys using same certificate chain... My country Id has a chip that requires you to run java applet in browser. Nobody uses that shit. Other options are logging in via internet banking (people are flocking away from traditiona banks in europe to monese, revolut and the like) or via SMS while using special SIM card (requires paid membership from oligopolic mobile providers). It's so modern that you are locked out from your government digital services if you live abroad...
- throwaway9d0291 7y ago> Also, how come macbooks don't come with nfc yet? Are there _any_ laptops with NFC? What other uses would it have?
- Nextgrid 7y agoI remember having a Dell Latitude laptop with both a contacted smart card reader and an NFC reader near the trackpad. The uses would be bulletproof authentication with client certificates. Your identities can live on a physical card (instead of “hacks” like password managers which are a pain to sync, etc) which you can use on any machine (laptop, phone) and taking the card away inherently prevents the machine from using your credentials down the line no matter how evil it is. It also allows your identities to be carried over from the physical world to the internet - your existing bank card can be used for online banking instead of a separate login that can be reset by an attacker, and your biometric passport or national ID card allows you to login to pay tax or similar government tasks.
- greggman2 7y agoFelicia readers have been in Japanese laptops like Vaio since 2006. Not sure if that is NFC or not. it's the system the public transportation virtual cash cards use. They were added to let you make your expense reports by scanning your company provided transportation cards.
- killjoywashere 7y agoI've seen something similar done with a yubikey 5C nano + onboard biometric. I like that more than this because this is a giant dongle sticking out of my computer. Still better than the military's CAC card solution, which seems like the worst of all worlds.
- aloknnikhil 7y agoFunnily, this might actually stop the YubiKey from being triggered inadvertently by my lap. The number of times I have broadcasted OTP codes on Slack is embarrassing. If you're looking to fix this, you can use the guide below. > https://support.yubico.com/support/solutions/articles/15000006440-accidentally-triggering-otp-codes-with-your-nano-yubikey https://support.yubico.com/support/solutions/articles/150000...
- mgoetzke 7y agoI actually plug in my nano key upside down while I am not using it. Inadvertent texting aside, I had real issues when programs like Lightroom suddenly started acting on dozens of random text shortcuts.
- bilalq 7y agoI've had vim open when on accidental presses before, and that always made me panic. The stuff on your screen can start jumping around like how movies always portray "hacking". If it wasn't for tools like gundo, I'd always be wondering if ran undo enough or if I went back too much. I now have long-press disabled by default, but I used to be in a state of constant worry.
- sbr464 7y agoOver time, The inadvertent social media/twitter & slack posts made by this are quite hilarious.
- sturmeh 7y agoYou can obstruct the lower contact (such that the metal is not exposed) by painting it, or covering it with a sticker. You can switch to the long press slot. You can remove the carriage return at the end of the sequence (so it doesn't hit ENTER for you). It's a bit silly that the default implementation is so non-user-friendly.
- ggm 7y agoJust to remind people who lie behind centrally administered distribution of keys, tokens, the authority can probably always add their thumbs to the prints on the key. So any belief this implies only your permission-ed access to your work is moot: If its not your computer, you probably don't have an implied right to privacy anyway, and a yubikey with bio isn't going to give you it either. (maybe a non sequiteur, but some people may be assuming this means your local U2F bearing host is YOUR host, but.. not always)
- wedn3sday 7y agoAs someone that does a lot of rock climbing, no finger print readers work for me. I lose skin off my hands on a daily basis, I know not all products are made for all people but if my (extremely security conscious) employer ever implements something like this Im screwed.
- pwlb 7y agoI'm rock climbing as well and I devleoped a similar biometric token for my company, my experience is that the thumb works best, as you usually don't use your thumb a lot for rock climbing compared to the other 4 fingertips
- sharpercoder 7y agoMy experience is that using Argan oil right after climbing solves this for the next day. The combination of a nights rest and Argan oil almost always does the trick. The times it did not work was when I had a more serious skin injury.
- foobarbecue 7y agoYou get flappers on your first pads or what? I'm also a climber and impressed with how consistently fingerprint login works on my phone no matter how much I climb.
- starpilot 7y agoYeah I'm calling BS on this. I climb a lot, after getting back from Bishop almost all of the skin on my pads sloughed off. It peeled off in big patches. iPhone home button recognition was unaffected. Might I add that, no one cares that you climb. Really, no one. This should be told to all new climbers. You are not cool because you like to crawl up a hardened dirt wall, and go back down.
- herohamp 7y agoWhy was this response warranted? He simply made a claim that when researched you find many people run into the same thing. Sources: https://www.google.com/amp/s/amp.reddit.com/r/climbing/comments/59030x/finger_print_unlocking_smartphones_and_climbing/ https://www.google.com/amp/s/amp.reddit.com/r/climbing/comme... https://www.reddit.com/r/climbing/comments/2ah692/fingerprint_readers_and_climbing/?utm_medium=android_app&utm_source=share https://www.reddit.com/r/climbing/comments/2ah692/fingerprin...
- xchaotic 7y agoCan someone point me to a similar MFA solution where I use my phone biometrics as the factor instead of yubikey? I have the Authenticator apps but it’d be nice if the phone and computer could exchange those numbers for me.
- coremoff 7y agonot exactly what you're asking for, but you could look at DUO. That can do a push notification to your phone, which would require you to unlock your phone to authorise, but doesn't require typing anything.
- p_o_t_a_t_o 7y agoIBM have a product that works like this. You get a prompt on your computer to check your phone, and then you use biometrics on your phone and the website logs you in. https://youtu.be/GMBL9bkboV4?t=25 https://youtu.be/GMBL9bkboV4?t=25 (Disclosure: I work at IBM, but not on this)
- icebraining 7y agoIf you use Android, Google is implementing that into the OS itself: https://krebsonsecurity.com/2019/04/android-7-0-phones-can-now-double-as-google-security-keys/ https://krebsonsecurity.com/2019/04/android-7-0-phones-can-n...