5 ms·

I believe the device performs it's biometric verification entirely on device. The operating system should see the key no differently that a regular non-biometri

• jolmg 7y ago
  The biometric verification, yes, but you need to somehow register/enroll a fingerprint with it. The article says that it's going to depend on Windows' native biometric enrollment and management for that.
  • tialaramex 7y ago
    Enrollment is a FIDO thing. If you have a FIDO key then you've done enrollment, it was that first time you had to press the button when you'd already signed in and were adding it as a second factor. For a fingerprint (or like, I dunno, a pinprick blood sample, or maybe they'll make one that requires a freshly plucked hair from your head) that enrollment step just adds a boolean flag saying the Relying Party demands the user's identity be verified by the device during enrollment and any subsequent authorisations. It's sort of on the honour system, except, if you actually demanded this (maybe in a corporate environment?) FIDO has a mechanism for devices to provide a certificate proving which batch of devices they're from, so you could say OK, I trust Yubico's BioKey 4.1 and BioKey 4.2 and the FooCorp EyeBallSlicer 1000 but any other devices aren't allowed to enroll. If you then found out the BioKey 4.1 can be fooled by breathing on it instead of a fingerprint you'd remove that from your whitelist. Firefox (and maybe Chrome?) let you blank this out basically, so sites can either accept that you won't tell them what device it is or they can refuse to let you enroll. I can imagine _maybe_ making an exception for my bank or government, but any other site can fuck right off.
    • jolmg 7y ago
      Hopefully the fingerprint is not limited to FIDO. I'm hoping I can use it in place of the button confirmation when using it as an OpenPGP smartcard.
    • ComputerGuru 7y ago
      Doesn’t that imply that each fingerprint registration becomes per website? So if you want to add a second finger to the device after the fact, you can’t just add it globally to the device but need to do that on a per-credential basis?
  • xienze 7y ago
    I’d be very surprised if anything, including the enrollment, happened off the device. Likely all it involves is sending a “register my fingerprint now” message being sent to the YK, you touch it, then the YK works as expected. They already provide a Linux-native “YK management” program, presumably it just needs to be updated.
    • ComputerGuru 7y ago
      I would imagine it definitely isn’t that simple as otherwise anyone could add their fingerprint when you weren’t looking.