9 ms·

Any word how this will be supported on Linux? The article states: "In keeping with Yubico’s design philosophy, the YubiKey Bio will not require any batteries,

Any word how this will be supported on Linux? The article states: "In keeping with Yubico’s design philosophy, the YubiKey Bio will not require any batteries, drivers, or associated software."

matheusmoreira 7y ago
Yubico has released open source programs to manage YubiKeys. https://github.com/Yubico/yubikey-manager/ https://github.com/Yubico/yubikey-manager/ For example, it is possible to configure whether user interaction is necessary before encrypting: ykman openpgp set-touch enc off The program will probably gain support for fingerprint configuration when the new YubiKeys are released.
mrlambchop 7y ago
Yubikey's use the standard keyboard USB driver so they should be hot pluggable on any linux system that is configured to enable hotplug.
- matheusmoreira 7y ago
  Only the static password and one time password modes though. In those modes, the YubiKey acts like a keyboard and literally types out the password when the user presses the button. The flagship YubiKeys can also act like a smart card. They are PIV compatible and support X.509 certificates. They can also store encryption, authentication and signing OpenPGP keys. GNU Privacy Guard opens the YubiKey as if it was a smart card.
- jolmg 7y ago
  I think vzaliva didn't quote the right part, and was referring to how the Yubikey is going to depend on Windows to enroll your fingerprint with it.
  - deleted 7y ago
    [deleted]
spuz 7y ago
I believe the device performs it's biometric verification entirely on device. The operating system should see the key no differently that a regular non-biometric key.
- jolmg 7y ago
  The biometric verification, yes, but you need to somehow register/enroll a fingerprint with it. The article says that it's going to depend on Windows' native biometric enrollment and management for that.
  - tialaramex 7y ago
    Enrollment is a FIDO thing. If you have a FIDO key then you've done enrollment, it was that first time you had to press the button when you'd already signed in and were adding it as a second factor. For a fingerprint (or like, I dunno, a pinprick blood sample, or maybe they'll make one that requires a freshly plucked hair from your head) that enrollment step just adds a boolean flag saying the Relying Party demands the user's identity be verified by the device during enrollment and any subsequent authorisations. It's sort of on the honour system, except, if you actually demanded this (maybe in a corporate environment?) FIDO has a mechanism for devices to provide a certificate proving which batch of devices they're from, so you could say OK, I trust Yubico's BioKey 4.1 and BioKey 4.2 and the FooCorp EyeBallSlicer 1000 but any other devices aren't allowed to enroll. If you then found out the BioKey 4.1 can be fooled by breathing on it instead of a fingerprint you'd remove that from your whitelist. Firefox (and maybe Chrome?) let you blank this out basically, so sites can either accept that you won't tell them what device it is or they can refuse to let you enroll. I can imagine _maybe_ making an exception for my bank or government, but any other site can fuck right off.
    - jolmg 7y ago
      Hopefully the fingerprint is not limited to FIDO. I'm hoping I can use it in place of the button confirmation when using it as an OpenPGP smartcard.
    - ComputerGuru 7y ago
jolmg 7y ago
I was going to say how associated software is not required to use some features, but I see that what you quoted continues with: > The key seamlessly integrates with the native biometric enrollment and management features supported in the latest versions of Windows 10 and Azure Active Directory, making it quick and convenient for users to adopt a phishing-resistant passwordless login flow. So I'm also curious if this indicates that biometric enrollment is not going to be added to yubikey-manager or yubico-pam.
- amluto 7y ago
  I would guess this means that the Yubikey is enrolled with Windows via Windows software, but your finger is enrolled on the key by the key itself.
  - jolmg 7y ago
    > by the key itself I think the concern is how would you tell the key that you want to enroll a fingerprint with it? On Windows, you'd use Windows software, but Linux has no such biometric management software as far as I know.
    - amluto 7y ago
      Probably a PDU telling the key to do it. Think: $ ykmgr bio enroll This will surely need enough computer help to initiate the process, but the actual biometric data is likely on the dongle itself. Alternatively, the dongle could produce a wrapped key blob that contains a fingerprint. This would look almost like a normal FIDO enrollment and would allow multiple users to share one dongle with access to different keys.
      - jolmg 7y ago
        > Probably Hopefully. The concern is if what the article says is indication that they won't, or at least not for some time. Does "does not require associated software because Windows doesn't need it" mean that they didn't see a point in making the associated software for a user minority? That's what I think the concern is.
tialaramex 7y ago
This is a FIDO2 device. It's actually easier to support this in Linux than a "conventional" PIN-based FIDO2 token because the Linux system doesn't need to arrange to read a PIN from the user and send that to the token, the token is going to read the user's fingerprint instead. If you just want a second factor, it'll work like an old FIDO device, which you might be familiar with for U2F - everything is already in place, loads of people are doing this including with Yubico's existing FIDO2 (pin-based) product. If you want this to be the sole factor (as in the Windows demos or for a site where the convenience of one touch login is good but you don't need MFA security) that ought to work with WebAuthn out of the box, but I actually haven't seen a demo, so I can't say this from personal experience even though I own a FIDO2 token.
- xaduha 7y ago
  > Linux system doesn't need to arrange to read a PIN from the user Is that a problem now?
  - tialaramex 7y ago
    I /presume/ that no Linux desktop setups today actually support this workflow for user login, which is one of the things touted for Windows. For Firefox since they advertise support for WebAuthn I /presume/ that the browser will do all the PIN prompts and so on to make this work, but again I have never seen this even _demonstrated_ let alone used in anger. The browser feature doesn't help you if the PC has booted and is at the login screen though, no browser there (yet?). I own a device (Yubico's own "Security Key 2") which supports this workflow and I've played with it on a demo Windows setup, and though I'd probably never use it to sign into my Linux PCs I'd try it out because I'm a nerd. This device works fine as a FIDO key for my WebAuthn accounts and is enrolled at GitHub etcetera for that purpose but then so does my much cheaper Key-ID FIDO key. Edited to add: There are a couple of replies now talking about non-FIDO flows like Smartcards or whatever. Some of Yubico's other devices can do these, but we're talking about FIDO2 like this new Yubikey, those flows aren't relevant.
    - xaduha 7y ago
ShakataGaNai 7y ago
If you wanted the absolutely easiest possible option, you can have yubikey's act as a HID and dump a string of text (password) out. Any machine, without any additional software, that can support a USB keyboard... could then use this.
pastorhudson 7y ago
It works fine currently in Linux. I can’t imagine this would be any different.
munchbunny 7y ago
It uses a standard protocol (CTAP2 - https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-client-to-authenticator-protocol-v2.0-rd-20170927.html https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-cl...) that's part of the standards for FIDO2. IIRC as long as your OS lets your application speak to the YubiKey over USB, you should be able to use this in the application. In the browser, you can just use WebAuthn. If you want to see how a native app can talk to the YubiKey, you can play with Yubico's own implementation: https://github.com/Yubico/python-fido2/ https://github.com/Yubico/python-fido2/ For browser based code, you can use WebAuthn and leave the device communication to the browser and OS: https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...

Any word how this will be supported on Linux? The article states: "In keeping with Yubico’s design philosophy, the YubiKey Bio will not require any batteries, drivers, or associated software."

matheusmoreira 7y ago

Yubico has released open source programs to manage YubiKeys. https://github.com/Yubico/yubikey-manager/ https://github.com/Yubico/yubikey-manager/ For example, it is possible to configure whether user interaction is necessary before encrypting: ykman openpgp set-touch enc off The program will probably gain support for fingerprint configuration when the new YubiKeys are released.

mrlambchop 7y ago

Yubikey's use the standard keyboard USB driver so they should be hot pluggable on any linux system that is configured to enable hotplug.

matheusmoreira 7y ago
Only the static password and one time password modes though. In those modes, the YubiKey acts like a keyboard and literally types out the password when the user presses the button. The flagship YubiKeys can also act like a smart card. They are PIV compatible and support X.509 certificates. They can also store encryption, authentication and signing OpenPGP keys. GNU Privacy Guard opens the YubiKey as if it was a smart card.
jolmg 7y ago
I think vzaliva didn't quote the right part, and was referring to how the Yubikey is going to depend on Windows to enroll your fingerprint with it.
- deleted 7y ago
  [deleted]

spuz 7y ago

I believe the device performs it's biometric verification entirely on device. The operating system should see the key no differently that a regular non-biometric key.

jolmg 7y ago
The biometric verification, yes, but you need to somehow register/enroll a fingerprint with it. The article says that it's going to depend on Windows' native biometric enrollment and management for that.
- tialaramex 7y ago
  Enrollment is a FIDO thing. If you have a FIDO key then you've done enrollment, it was that first time you had to press the button when you'd already signed in and were adding it as a second factor. For a fingerprint (or like, I dunno, a pinprick blood sample, or maybe they'll make one that requires a freshly plucked hair from your head) that enrollment step just adds a boolean flag saying the Relying Party demands the user's identity be verified by the device during enrollment and any subsequent authorisations. It's sort of on the honour system, except, if you actually demanded this (maybe in a corporate environment?) FIDO has a mechanism for devices to provide a certificate proving which batch of devices they're from, so you could say OK, I trust Yubico's BioKey 4.1 and BioKey 4.2 and the FooCorp EyeBallSlicer 1000 but any other devices aren't allowed to enroll. If you then found out the BioKey 4.1 can be fooled by breathing on it instead of a fingerprint you'd remove that from your whitelist. Firefox (and maybe Chrome?) let you blank this out basically, so sites can either accept that you won't tell them what device it is or they can refuse to let you enroll. I can imagine _maybe_ making an exception for my bank or government, but any other site can fuck right off.
  - jolmg 7y ago
    Hopefully the fingerprint is not limited to FIDO. I'm hoping I can use it in place of the button confirmation when using it as an OpenPGP smartcard.
  - ComputerGuru 7y ago

jolmg 7y ago

I was going to say how associated software is not required to use some features, but I see that what you quoted continues with: > The key seamlessly integrates with the native biometric enrollment and management features supported in the latest versions of Windows 10 and Azure Active Directory, making it quick and convenient for users to adopt a phishing-resistant passwordless login flow. So I'm also curious if this indicates that biometric enrollment is not going to be added to yubikey-manager or yubico-pam.

amluto 7y ago
I would guess this means that the Yubikey is enrolled with Windows via Windows software, but your finger is enrolled on the key by the key itself.
- jolmg 7y ago
  > by the key itself I think the concern is how would you tell the key that you want to enroll a fingerprint with it? On Windows, you'd use Windows software, but Linux has no such biometric management software as far as I know.
  - amluto 7y ago
    Probably a PDU telling the key to do it. Think: $ ykmgr bio enroll This will surely need enough computer help to initiate the process, but the actual biometric data is likely on the dongle itself. Alternatively, the dongle could produce a wrapped key blob that contains a fingerprint. This would look almost like a normal FIDO enrollment and would allow multiple users to share one dongle with access to different keys.
    - jolmg 7y ago
      > Probably Hopefully. The concern is if what the article says is indication that they won't, or at least not for some time. Does "does not require associated software because Windows doesn't need it" mean that they didn't see a point in making the associated software for a user minority? That's what I think the concern is.

tialaramex 7y ago

This is a FIDO2 device. It's actually easier to support this in Linux than a "conventional" PIN-based FIDO2 token because the Linux system doesn't need to arrange to read a PIN from the user and send that to the token, the token is going to read the user's fingerprint instead. If you just want a second factor, it'll work like an old FIDO device, which you might be familiar with for U2F - everything is already in place, loads of people are doing this including with Yubico's existing FIDO2 (pin-based) product. If you want this to be the sole factor (as in the Windows demos or for a site where the convenience of one touch login is good but you don't need MFA security) that ought to work with WebAuthn out of the box, but I actually haven't seen a demo, so I can't say this from personal experience even though I own a FIDO2 token.

xaduha 7y ago
> Linux system doesn't need to arrange to read a PIN from the user Is that a problem now?
- tialaramex 7y ago
  I /presume/ that no Linux desktop setups today actually support this workflow for user login, which is one of the things touted for Windows. For Firefox since they advertise support for WebAuthn I /presume/ that the browser will do all the PIN prompts and so on to make this work, but again I have never seen this even _demonstrated_ let alone used in anger. The browser feature doesn't help you if the PC has booted and is at the login screen though, no browser there (yet?). I own a device (Yubico's own "Security Key 2") which supports this workflow and I've played with it on a demo Windows setup, and though I'd probably never use it to sign into my Linux PCs I'd try it out because I'm a nerd. This device works fine as a FIDO key for my WebAuthn accounts and is enrolled at GitHub etcetera for that purpose but then so does my much cheaper Key-ID FIDO key. Edited to add: There are a couple of replies now talking about non-FIDO flows like Smartcards or whatever. Some of Yubico's other devices can do these, but we're talking about FIDO2 like this new Yubikey, those flows aren't relevant.
  - xaduha 7y ago

ShakataGaNai 7y ago

If you wanted the absolutely easiest possible option, you can have yubikey's act as a HID and dump a string of text (password) out. Any machine, without any additional software, that can support a USB keyboard... could then use this.

pastorhudson 7y ago

It works fine currently in Linux. I can’t imagine this would be any different.

munchbunny 7y ago

It uses a standard protocol (CTAP2 - https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-client-to-authenticator-protocol-v2.0-rd-20170927.html https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-cl...) that's part of the standards for FIDO2. IIRC as long as your OS lets your application speak to the YubiKey over USB, you should be able to use this in the application. In the browser, you can just use WebAuthn. If you want to see how a native app can talk to the YubiKey, you can play with Yubico's own implementation: https://github.com/Yubico/python-fido2/ https://github.com/Yubico/python-fido2/ For browser based code, you can use WebAuthn and leave the device communication to the browser and OS: https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...