4 ms·

Thanks, that's very useful! I've been trying for ages to get my Yubikey to ask me for my PIN that I've set on it when authenticating, to no avail. It doesn't se

Thanks, that's very useful! I've been trying for ages to get my Yubikey to ask me for my PIN that I've set on it when authenticating, to no avail. It doesn't seem reasonable to have a site authenticate me with no PIN, since someone could just steal my yubikey and log in as me everywhere. Would anyone happen to know how I can force asking for a PIN?

lxgr 7y ago
Ultimately, this is up to the website (relying party): It can require or prefer user authentication during enrolment or authentication; if the key supports it, the site can then skip password creation. There doesn't seem to be anything in the spec preventing an authenticator from always asking for a PIN, but at least for the Yubikey, I'm not aware of a way to achieve that.
- StavrosK 7y ago
  This is true, but I'm asking for the opposite: the flag that asks the key to always enable auth. Would you happen to know it? I haven't been able to find it in the demos I tried.
tialaramex 7y ago
The flow you're asking for (PIN required to do ordinary FIDO not just for FIDO2 passwordless auth) seems like a weird choice and I doubt it's possible. This hypothetical person has to get your password from somewhere. The mode most (essentially all non-test sites I've seen) used has FIDO only as second factor, so the bad guy needs your first factor (invariably a password) as well as the stolen Yubikey. You're asking for a three factor system, with two factors you know, plus a final factor you have. The improvement in threat resistance is small and the added inconvenience is large.
- StavrosK 7y ago
  Oh no, sorry. I'm asking for FIDO2 passwordless. Right now I can do that (e.g. at https://www.passwordless.dev/passwordless https://www.passwordless.dev/passwordless), but the Yubikey doesn't ask for a PIN, which is insecure, since anyone stealing it can auth as me. I simply want passwordless auth to ask for my PIN. EDIT: It turns out Chrome does ask for the PIN (Firefox doesn't), but only when registering (not when logging in). This raises the question, why can the browser log me in without a PIN? Then the thief can simply use one of those browsers.
  - tialaramex 7y ago
    The site you're looking at offers a variety of different WebAuthn flows. I linked the one that behaves how you described, requiring a PIN (and yes it requires the PIN to log in) but now you've found and linked a different flow that doesn't require PINs and sure enough it doesn't require PINs. I guess you could say the site is badly labelled. The true FIDO2 flow that I linked you to above is labelled usernameless rather than passwordless. The flow they've called passwordless works with an ordinary FIDO key it doesn't need FIDO2. Because it simply doesn't have a password. Passwordless. Simple.
    - StavrosK 7y ago
      Trying it on Chrome, it works as you say. On Firefox it just failed to auth, I assumed it was because my Yubikey lacked onboard storage for storing the user details but it looks like it's because of the lack of PIN support. Thanks.
m-p-3 7y ago
The Yubikey with a fingerprint scanner might be a potential solution to your problem.
- StavrosK 7y ago
  In theory, my 5C should be good enough, I just need it to ask for the PIN when authenticating passwordlessly (it doesn't right now).

lxgr 7y ago

Ultimately, this is up to the website (relying party): It can require or prefer user authentication during enrolment or authentication; if the key supports it, the site can then skip password creation. There doesn't seem to be anything in the spec preventing an authenticator from always asking for a PIN, but at least for the Yubikey, I'm not aware of a way to achieve that.

StavrosK 7y ago
This is true, but I'm asking for the opposite: the flag that asks the key to always enable auth. Would you happen to know it? I haven't been able to find it in the demos I tried.

tialaramex 7y ago

The flow you're asking for (PIN required to do ordinary FIDO not just for FIDO2 passwordless auth) seems like a weird choice and I doubt it's possible. This hypothetical person has to get your password from somewhere. The mode most (essentially all non-test sites I've seen) used has FIDO only as second factor, so the bad guy needs your first factor (invariably a password) as well as the stolen Yubikey. You're asking for a three factor system, with two factors you know, plus a final factor you have. The improvement in threat resistance is small and the added inconvenience is large.

StavrosK 7y ago
Oh no, sorry. I'm asking for FIDO2 passwordless. Right now I can do that (e.g. at https://www.passwordless.dev/passwordless https://www.passwordless.dev/passwordless), but the Yubikey doesn't ask for a PIN, which is insecure, since anyone stealing it can auth as me. I simply want passwordless auth to ask for my PIN. EDIT: It turns out Chrome does ask for the PIN (Firefox doesn't), but only when registering (not when logging in). This raises the question, why can the browser log me in without a PIN? Then the thief can simply use one of those browsers.
- tialaramex 7y ago
  The site you're looking at offers a variety of different WebAuthn flows. I linked the one that behaves how you described, requiring a PIN (and yes it requires the PIN to log in) but now you've found and linked a different flow that doesn't require PINs and sure enough it doesn't require PINs. I guess you could say the site is badly labelled. The true FIDO2 flow that I linked you to above is labelled usernameless rather than passwordless. The flow they've called passwordless works with an ordinary FIDO key it doesn't need FIDO2. Because it simply doesn't have a password. Passwordless. Simple.
  - StavrosK 7y ago
    Trying it on Chrome, it works as you say. On Firefox it just failed to auth, I assumed it was because my Yubikey lacked onboard storage for storing the user details but it looks like it's because of the lack of PIN support. Thanks.

m-p-3 7y ago

The Yubikey with a fingerprint scanner might be a potential solution to your problem.

StavrosK 7y ago
In theory, my 5C should be good enough, I just need it to ask for the PIN when authenticating passwordlessly (it doesn't right now).