16 ms·

Getting a biometric security key right

130 points by tiziano88 6y ago

Ottolay 6y ago
The key in the video was flexing from being pressed for the fingerprint. Hopefully that does not cause longevity issues. My USB-A yubikey has proven durable so far, but it only requires a very light touch to activate.
- Donald 6y ago
  It's more likely to break your usb port if it's like the standard yubikey
- marcolussetti 6y ago
  I think that's just on first enrollment, you likely can use much lighter touch in normal day to day use.
- vel0city 6y ago
  At least for the USB-A versions, the flexing is almost by design. Since it doesn't have the full housing around the USB-A connector, it tends to have a bit of motion in the port. Its not even that the device is flexing, its pushing on the pins on the USB port more or less as it moves. I can't speak for the USB-C version, as I don't have one and I don't suppose it has that same thing going on.
- encom 6y ago
  I've had one of the very first Yubikeys on my keychain for about 10 years now, which is a very rough place to be, and it still works fine.
deleted 6y ago
[deleted]
xaduha 6y ago
There are plenty of fingerprint readers on the market, doesn't really excite me because it just makes it 2-in-1. What does excite me? Smart rings like https://store.nfcring.com/products/omni https://store.nfcring.com/products/omni
- paxys 6y ago
  Funny enough their own demo (from the parent article) is on a MacBook Air with built-in Touch ID.
  - OJFord 6y ago
    Yes but any MacBook Air, not just one you've previously provisioned to recognise your fingerprint. The selling point here isn't 'yet another external fingerprint reader', it's 'portable fingerprint-authenticated OpenPGP smart card'.
    - Boulth6 6y ago
      The press release mentions only FIDO2. Where did you get the OpenPGP smart card bit?
      - michaelt 6y ago
        If they're releasing a fingerprint-scanning version, I'd be surprised if it wasn't available with all the capabilities of the YubiKey 5 (which has OpenPGP support) for people willing to pay.
      - OJFord 6y ago
        I just assumed, but I think you're right that it doesn't. (Though I wouldn't be surprised if it followed, Yubikey's first FIDO key was also just that, but now they all do it.) My main point though was that it's not a device-specific authentication, or even an external reader for unlocking a secret provisioned onto one or many devices, it is the sole thing needed, so you can walk up to a new device and use it without provisioning it with secrets. An OpenPGP one would be cool though - replace passphrase with fingerprint.
  - tiziano88 6y ago
    this is a "roaming authenticator", meaning it is meant to be used across devices. After enrolling it, it may be stored away safely, e.g. in a safe, or used on other devices to log in (or perform crypto operations) with the same credentials.
dheera 6y ago
A true biometric key would allow authentication from any key and not just a registered key, otherwise it just degrades into a possession authentication factor. A true biometric key would allow you to walk around with absolutely nothing, and doing 2FA using only what you know (password) and what you are (your finger). Is that possible with this? Could I e.g. pass 2FA on my accounts on a friend's computer using their key with my finger?
- viraptor 6y ago
  You'd have to trust their key in that case. Otherwise they could be collecting your biometrics for reuse later on. Between trusted friends - probably ok. Secure facility - probably also ok (we already share the fingerprint readers). For public use... I wouldn't touch that.
  - deleted 6y ago
    [deleted]
- temp667 6y ago
  Scary - you would have to trust EVERY fingerprint reader not to capture your fingerprint AND you have to trust that you don't leave it anywhere for pickup. It's very hard to change your fingerprint as well, so having images of it out there is not good in general.
- Ottolay 6y ago
  The problem is that your fingerprint is really just a set of information attached your body, similar to a long static password. Not very secure and you can't change it if it was compromised. The fingerprint on the yubikey is really just a possession check for the yubikey in case it was stolen. The main protection comes from the asymmetric cryptography inside the yubikey.
  - nullc 6y ago
    > The fingerprint on the yubikey is really just a possession check for the yubikey in case it was stolen. And one that only depends on the tamper-resistance of the hardware. It's possible to use error correcting codes to extract deterministic secrets from fuzzy data like fingerprints, but no one (virtually no one?) implements that. Instead, the fingerprinte reader has some cleartext fingerprint fingerprints that it compares the fingerprint to and just makes an accept/reject decision. Extract that data and you can make an acceptable input, or glitch the processing and you can just bypass it. Presumably it's better than the button that literally any touch activates, but I think a conservative security analysis would pretty much just treat it like a button.
fastest963 6y ago
What happens if I lose the key, I don't have it on me, or if I'm using a mobile UI? It seems like you need an identifier (email/username/etc) besides the hardware key for this to be practical.
- sneak 6y ago
  U2F is a second factor, not a primary one.
  - nerdwaller 6y ago
    While this is true, the spirit of the GP is correct. To login you will need both a username/password and the second factor. So losing the key is still relevant. In practice that means people really need to buy (at least) two yubikeys to register with services that allow it. Have one on something that’s always with you (such as keys) and the extra(s) as a backup somewhere secure. Unfortunately this works with most accounts except the big one I want it to... AWS. Some sites allow you to also register a standard MFA device as a fallback, and further still Google (as an example) allows you to use another device that’s already authenticated to get a one time use code (depending on your account security setup).
    - paulie_a 6y ago
      Also google also allows for a list of recovery codes.
    - sneak 6y ago
      To sidestep this, create a new AWS account to be your master SSO administration account (separate from whatever account you're already using), and enable "AWS Organizations" in it. Join the existing AWS accounts to the new "AWS Organization". Once you enable AWS SSO for the "organization", you can then set up SAML SSO to your existing identity provider (e.g. G Suite, which allows multiple hardware 2FA tokens per user). You do this in the new master organization account. You can create the corresponding users in AWS SSO, and grant them the appropriate permissions in the appropriate organization accounts. Then you do the 2FA auth to your IdP (G Suite, or selfhosted, or whatever) and then AWS just trusts the auth from the IdP, and you get to sidestep the terrible morass that is AWS MFA configuration. If you get stuck, email me.
deleted 6y ago
[deleted]
xaduha 6y ago
With Yubico I always get a feeling that if they could breakaway from all this legacy smartcard stuff and lock everyone in, they would. But they can't yet, so they distanced themselves from it and were keeping it on the down-low ever since. I would really like if they made a wearable without any ports like a NFC ring, but that would mean either keeping it tied to phones only with an app or selling their own NFC/contactless reader, most likely with some proprietary bent.
- tarasmatsyk 6y ago
  yep, wearable, like a ring would be a clincher. I really like Yubico and fingerpring scanner is an awesome idea, would be really happy to bring my fingerprint instead of relying on laptops. On the other hand, a wearable would be a whole new level, like thinking 2 steps ahead
  - Ottolay 6y ago
    I could see Yubikey going to a NFC ring at some point. For PCs all they would have to offer is a USB NFC transceiver. There are probably still some engineering challenges getting all the cryptographic functions and NFC power transfer into the form factor, but it seems like those will get easier over time.
nocodelowcode 6y ago
Could someone ELI5 the security benefits of Yubikey over Apple's finger print sensor?
- xaduha 6y ago
  In terms of system login stuff (at least on Windows and macOS) I think it would work exactly the same as any other supported 3rd party fingerprint sensor.
NiceWayToDoIT 6y ago
Does it worth repeating that "fingerprints are usernames, not passwords"? It is straightforward to copy someone's fingerprint. If technology does not include some additional biometric property (blood vessel arrangement, unique capacitance?!, unique heat signature that will not change over time?! ...) that is hard to obtain, it is pretty much useless, especially if someone is really keen to hack you ...
- tiziano88 6y ago
  Just getting the fingerprint of someone else does not allow you to log in as them. The fingerprint is only used as a presence check by the security key, which digitally signs a challenge using its own internal non-exportable key material. So you would have to both steal someone else's security key (note you cannot "clone" it, at least not trivially), and also get their fingerprint, if you wanted to "hack" them.
  - NiceWayToDoIT 6y ago
    So, device is password generator, and fingerprint is the username. What happens when you lose or brake your security key, is your PC locked forever, or it will stay that way until they send you replacement? But if they can send you replacement, that means that "the company" (read government services) have sort off master key for your PC (they have fingerprint database) and they can get access to inside hardware depending on deal they have with technology maker (I am thinking China)... I had a chat with a spokesman from a bank they had similar technology for a credit card, basically what he said is that key factor is time. That is, if someone steal your card in bar and takes fingerprint from a glass you were drinking, only things that will protect you is time you will notice that your card is missing and reporting it to the bank. As person hacking will need a bit of time to replicate fingerprint. Which is about between 15 - 30 min with proper tools...
    - xaduha 6y ago
      > What happens when you lose or brake your security key, is your PC locked forever Not sure about macOS, but on Windows it would most likely use Windows Hello, even though they didn't mention it once in that blogpost. It doesn't allow you to have biometrics as the only method of logging in. You would have to setup a PIN too and the usual password will always be available. On Linux anything goes, depends on how you set it up. All that FIDO2 stuff is for browsers mainly, unless MS would meet them in the middle and allow FIDO2 without AD for system logins in upcoming updates. EDIT: This old preview shows Windows Hello https://www.youtube.com/watch?v=L2y3g_094TI https://www.youtube.com/watch?v=L2y3g_094TI
appleflaxen 6y ago
Serious question that sounds dumb: what happens if you lose your finger?
- hashworks 6y ago
  The worst case would be loosing the whole YubiKey. In that case you need some backups to access your accounts, for example another YubiKey.
- remus 6y ago
  From the article, there's a backup PIN.
abdullahkhalids 6y ago
What's the most open security key right now? Best experience?
- _golgo13_ 6y ago
  you may be interested in: https://solokeys.com/ https://solokeys.com/
Sami_Lehtinen 6y ago
I'm wondering if people know that Android phones already provide the FIDO2 / WebAuthn authentication. There is no need for additional hardware for mobile use.
gnyman 6y ago
If you have a macbook with touchId you can use that as webauthn/u2f already with softu2f, I've been doing this for some time and it's really smooth, much prefer it to OTP. Rough instructions here https://twitter.com/gnyman/status/1217797385184841734 https://twitter.com/gnyman/status/1217797385184841734

130 points by tiziano88 6y ago

The key in the video was flexing from being pressed for the fingerprint. Hopefully that does not cause longevity issues. My USB-A yubikey has proven durable so far, but it only requires a very light touch to activate.

Donald 6y ago
It's more likely to break your usb port if it's like the standard yubikey
marcolussetti 6y ago
I think that's just on first enrollment, you likely can use much lighter touch in normal day to day use.
vel0city 6y ago
At least for the USB-A versions, the flexing is almost by design. Since it doesn't have the full housing around the USB-A connector, it tends to have a bit of motion in the port. Its not even that the device is flexing, its pushing on the pins on the USB port more or less as it moves. I can't speak for the USB-C version, as I don't have one and I don't suppose it has that same thing going on.
encom 6y ago
I've had one of the very first Yubikeys on my keychain for about 10 years now, which is a very rough place to be, and it still works fine.

deleted 6y ago

[deleted]

xaduha 6y ago

There are plenty of fingerprint readers on the market, doesn't really excite me because it just makes it 2-in-1. What does excite me? Smart rings like https://store.nfcring.com/products/omni https://store.nfcring.com/products/omni

paxys 6y ago
Funny enough their own demo (from the parent article) is on a MacBook Air with built-in Touch ID.
- OJFord 6y ago
  Yes but any MacBook Air, not just one you've previously provisioned to recognise your fingerprint. The selling point here isn't 'yet another external fingerprint reader', it's 'portable fingerprint-authenticated OpenPGP smart card'.
  - Boulth6 6y ago
    The press release mentions only FIDO2. Where did you get the OpenPGP smart card bit?
    - michaelt 6y ago
      If they're releasing a fingerprint-scanning version, I'd be surprised if it wasn't available with all the capabilities of the YubiKey 5 (which has OpenPGP support) for people willing to pay.
    - OJFord 6y ago
      I just assumed, but I think you're right that it doesn't. (Though I wouldn't be surprised if it followed, Yubikey's first FIDO key was also just that, but now they all do it.) My main point though was that it's not a device-specific authentication, or even an external reader for unlocking a secret provisioned onto one or many devices, it is the sole thing needed, so you can walk up to a new device and use it without provisioning it with secrets. An OpenPGP one would be cool though - replace passphrase with fingerprint.
- tiziano88 6y ago
  this is a "roaming authenticator", meaning it is meant to be used across devices. After enrolling it, it may be stored away safely, e.g. in a safe, or used on other devices to log in (or perform crypto operations) with the same credentials.

dheera 6y ago

A true biometric key would allow authentication from any key and not just a registered key, otherwise it just degrades into a possession authentication factor. A true biometric key would allow you to walk around with absolutely nothing, and doing 2FA using only what you know (password) and what you are (your finger). Is that possible with this? Could I e.g. pass 2FA on my accounts on a friend's computer using their key with my finger?

viraptor 6y ago
You'd have to trust their key in that case. Otherwise they could be collecting your biometrics for reuse later on. Between trusted friends - probably ok. Secure facility - probably also ok (we already share the fingerprint readers). For public use... I wouldn't touch that.
- deleted 6y ago
  [deleted]
temp667 6y ago
Scary - you would have to trust EVERY fingerprint reader not to capture your fingerprint AND you have to trust that you don't leave it anywhere for pickup. It's very hard to change your fingerprint as well, so having images of it out there is not good in general.
Ottolay 6y ago
The problem is that your fingerprint is really just a set of information attached your body, similar to a long static password. Not very secure and you can't change it if it was compromised. The fingerprint on the yubikey is really just a possession check for the yubikey in case it was stolen. The main protection comes from the asymmetric cryptography inside the yubikey.
- nullc 6y ago
  > The fingerprint on the yubikey is really just a possession check for the yubikey in case it was stolen. And one that only depends on the tamper-resistance of the hardware. It's possible to use error correcting codes to extract deterministic secrets from fuzzy data like fingerprints, but no one (virtually no one?) implements that. Instead, the fingerprinte reader has some cleartext fingerprint fingerprints that it compares the fingerprint to and just makes an accept/reject decision. Extract that data and you can make an acceptable input, or glitch the processing and you can just bypass it. Presumably it's better than the button that literally any touch activates, but I think a conservative security analysis would pretty much just treat it like a button.

fastest963 6y ago

What happens if I lose the key, I don't have it on me, or if I'm using a mobile UI? It seems like you need an identifier (email/username/etc) besides the hardware key for this to be practical.

sneak 6y ago
U2F is a second factor, not a primary one.
- nerdwaller 6y ago
  While this is true, the spirit of the GP is correct. To login you will need both a username/password and the second factor. So losing the key is still relevant. In practice that means people really need to buy (at least) two yubikeys to register with services that allow it. Have one on something that’s always with you (such as keys) and the extra(s) as a backup somewhere secure. Unfortunately this works with most accounts except the big one I want it to... AWS. Some sites allow you to also register a standard MFA device as a fallback, and further still Google (as an example) allows you to use another device that’s already authenticated to get a one time use code (depending on your account security setup).
  - paulie_a 6y ago
    Also google also allows for a list of recovery codes.
  - sneak 6y ago
    To sidestep this, create a new AWS account to be your master SSO administration account (separate from whatever account you're already using), and enable "AWS Organizations" in it. Join the existing AWS accounts to the new "AWS Organization". Once you enable AWS SSO for the "organization", you can then set up SAML SSO to your existing identity provider (e.g. G Suite, which allows multiple hardware 2FA tokens per user). You do this in the new master organization account. You can create the corresponding users in AWS SSO, and grant them the appropriate permissions in the appropriate organization accounts. Then you do the 2FA auth to your IdP (G Suite, or selfhosted, or whatever) and then AWS just trusts the auth from the IdP, and you get to sidestep the terrible morass that is AWS MFA configuration. If you get stuck, email me.

deleted 6y ago

[deleted]

xaduha 6y ago

With Yubico I always get a feeling that if they could breakaway from all this legacy smartcard stuff and lock everyone in, they would. But they can't yet, so they distanced themselves from it and were keeping it on the down-low ever since. I would really like if they made a wearable without any ports like a NFC ring, but that would mean either keeping it tied to phones only with an app or selling their own NFC/contactless reader, most likely with some proprietary bent.

tarasmatsyk 6y ago
yep, wearable, like a ring would be a clincher. I really like Yubico and fingerpring scanner is an awesome idea, would be really happy to bring my fingerprint instead of relying on laptops. On the other hand, a wearable would be a whole new level, like thinking 2 steps ahead
- Ottolay 6y ago
  I could see Yubikey going to a NFC ring at some point. For PCs all they would have to offer is a USB NFC transceiver. There are probably still some engineering challenges getting all the cryptographic functions and NFC power transfer into the form factor, but it seems like those will get easier over time.

nocodelowcode 6y ago

Could someone ELI5 the security benefits of Yubikey over Apple's finger print sensor?

xaduha 6y ago
In terms of system login stuff (at least on Windows and macOS) I think it would work exactly the same as any other supported 3rd party fingerprint sensor.

NiceWayToDoIT 6y ago

Does it worth repeating that "fingerprints are usernames, not passwords"? It is straightforward to copy someone's fingerprint. If technology does not include some additional biometric property (blood vessel arrangement, unique capacitance?!, unique heat signature that will not change over time?! ...) that is hard to obtain, it is pretty much useless, especially if someone is really keen to hack you ...

tiziano88 6y ago
Just getting the fingerprint of someone else does not allow you to log in as them. The fingerprint is only used as a presence check by the security key, which digitally signs a challenge using its own internal non-exportable key material. So you would have to both steal someone else's security key (note you cannot "clone" it, at least not trivially), and also get their fingerprint, if you wanted to "hack" them.
- NiceWayToDoIT 6y ago
  So, device is password generator, and fingerprint is the username. What happens when you lose or brake your security key, is your PC locked forever, or it will stay that way until they send you replacement? But if they can send you replacement, that means that "the company" (read government services) have sort off master key for your PC (they have fingerprint database) and they can get access to inside hardware depending on deal they have with technology maker (I am thinking China)... I had a chat with a spokesman from a bank they had similar technology for a credit card, basically what he said is that key factor is time. That is, if someone steal your card in bar and takes fingerprint from a glass you were drinking, only things that will protect you is time you will notice that your card is missing and reporting it to the bank. As person hacking will need a bit of time to replicate fingerprint. Which is about between 15 - 30 min with proper tools...
  - xaduha 6y ago
    > What happens when you lose or brake your security key, is your PC locked forever Not sure about macOS, but on Windows it would most likely use Windows Hello, even though they didn't mention it once in that blogpost. It doesn't allow you to have biometrics as the only method of logging in. You would have to setup a PIN too and the usual password will always be available. On Linux anything goes, depends on how you set it up. All that FIDO2 stuff is for browsers mainly, unless MS would meet them in the middle and allow FIDO2 without AD for system logins in upcoming updates. EDIT: This old preview shows Windows Hello https://www.youtube.com/watch?v=L2y3g_094TI https://www.youtube.com/watch?v=L2y3g_094TI

appleflaxen 6y ago

Serious question that sounds dumb: what happens if you lose your finger?

hashworks 6y ago
The worst case would be loosing the whole YubiKey. In that case you need some backups to access your accounts, for example another YubiKey.
remus 6y ago
From the article, there's a backup PIN.

abdullahkhalids 6y ago

What's the most open security key right now? Best experience?

_golgo13_ 6y ago
you may be interested in: https://solokeys.com/ https://solokeys.com/

Sami_Lehtinen 6y ago

I'm wondering if people know that Android phones already provide the FIDO2 / WebAuthn authentication. There is no need for additional hardware for mobile use.

gnyman 6y ago

If you have a macbook with touchId you can use that as webauthn/u2f already with softu2f, I've been doing this for some time and it's really smooth, much prefer it to OTP. Rough instructions here https://twitter.com/gnyman/status/1217797385184841734 https://twitter.com/gnyman/status/1217797385184841734