3 ms·

I was going to say how associated software is not required to use some features, but I see that what you quoted continues with: > The key seamlessly integrates

by jolmg 7y ago

I was going to say how associated software is not required to use some features, but I see that what you quoted continues with: > The key seamlessly integrates with the native biometric enrollment and management features supported in the latest versions of Windows 10 and Azure Active Directory, making it quick and convenient for users to adopt a phishing-resistant passwordless login flow. So I'm also curious if this indicates that biometric enrollment is not going to be added to yubikey-manager or yubico-pam.

amluto 7y ago
I would guess this means that the Yubikey is enrolled with Windows via Windows software, but your finger is enrolled on the key by the key itself.
- jolmg 7y ago
  > by the key itself I think the concern is how would you tell the key that you want to enroll a fingerprint with it? On Windows, you'd use Windows software, but Linux has no such biometric management software as far as I know.
  - amluto 7y ago
    Probably a PDU telling the key to do it. Think: $ ykmgr bio enroll This will surely need enough computer help to initiate the process, but the actual biometric data is likely on the dongle itself. Alternatively, the dongle could produce a wrapped key blob that contains a fingerprint. This would look almost like a normal FIDO enrollment and would allow multiple users to share one dongle with access to different keys.
    - jolmg 7y ago
      > Probably Hopefully. The concern is if what the article says is indication that they won't, or at least not for some time. Does "does not require associated software because Windows doesn't need it" mean that they didn't see a point in making the associated software for a user minority? That's what I think the concern is.
xienze 7y ago
I think they’re talking about Windows Hello in that blurb, not requiring some special Windows software to enable the fingerprint sensor. That would be very much against their philosophy of keeping all the processing on the device. FWIW, the current YubiKey does everything on the device, not much of a stretch for it to also do the fingerprint sensing there too.

by jolmg 7y ago

amluto 7y ago

I would guess this means that the Yubikey is enrolled with Windows via Windows software, but your finger is enrolled on the key by the key itself.

jolmg 7y ago
> by the key itself I think the concern is how would you tell the key that you want to enroll a fingerprint with it? On Windows, you'd use Windows software, but Linux has no such biometric management software as far as I know.
- amluto 7y ago
  Probably a PDU telling the key to do it. Think: $ ykmgr bio enroll This will surely need enough computer help to initiate the process, but the actual biometric data is likely on the dongle itself. Alternatively, the dongle could produce a wrapped key blob that contains a fingerprint. This would look almost like a normal FIDO enrollment and would allow multiple users to share one dongle with access to different keys.
  - jolmg 7y ago
    > Probably Hopefully. The concern is if what the article says is indication that they won't, or at least not for some time. Does "does not require associated software because Windows doesn't need it" mean that they didn't see a point in making the associated software for a user minority? That's what I think the concern is.

xienze 7y ago

I think they’re talking about Windows Hello in that blurb, not requiring some special Windows software to enable the fingerprint sensor. That would be very much against their philosophy of keeping all the processing on the device. FWIW, the current YubiKey does everything on the device, not much of a stretch for it to also do the fingerprint sensing there too.