4 ms·

What happens if I lose the key, I don't have it on me, or if I'm using a mobile UI? It seems like you need an identifier (email/username/etc) besides the hardwa

What happens if I lose the key, I don't have it on me, or if I'm using a mobile UI? It seems like you need an identifier (email/username/etc) besides the hardware key for this to be practical.

sneak 6y ago
U2F is a second factor, not a primary one.
- nerdwaller 6y ago
  While this is true, the spirit of the GP is correct. To login you will need both a username/password and the second factor. So losing the key is still relevant. In practice that means people really need to buy (at least) two yubikeys to register with services that allow it. Have one on something that’s always with you (such as keys) and the extra(s) as a backup somewhere secure. Unfortunately this works with most accounts except the big one I want it to... AWS. Some sites allow you to also register a standard MFA device as a fallback, and further still Google (as an example) allows you to use another device that’s already authenticated to get a one time use code (depending on your account security setup).
  - paulie_a 6y ago
    Also google also allows for a list of recovery codes.
  - sneak 6y ago
    To sidestep this, create a new AWS account to be your master SSO administration account (separate from whatever account you're already using), and enable "AWS Organizations" in it. Join the existing AWS accounts to the new "AWS Organization". Once you enable AWS SSO for the "organization", you can then set up SAML SSO to your existing identity provider (e.g. G Suite, which allows multiple hardware 2FA tokens per user). You do this in the new master organization account. You can create the corresponding users in AWS SSO, and grant them the appropriate permissions in the appropriate organization accounts. Then you do the 2FA auth to your IdP (G Suite, or selfhosted, or whatever) and then AWS just trusts the auth from the IdP, and you get to sidestep the terrible morass that is AWS MFA configuration. If you get stuck, email me.
    - nerdwaller 6y ago
      I’m going to have to take a look at this, this sounds awesome thank you!
- blibble 6y ago
  FIDO2 (effectively U2Fv2) can be used without a username or password
ecesena 6y ago
FIDO2 supports password-less and username-less authentication, both as a single factor, i.e. no passwords. Password-less is like 2FA but without the first factor. You type in your username, next you use the security key. Username-less is done via resident keys, that can also store the username at registration. The whole experience is just authenticating with the security key. If you use FIDO without a password (not as 2FA, but as single factor), you want to enable client-side protection like a PIN or biometric. These keys are introducing the biometric option so you can just tap, without entering a PIN. Edit: oh, this works already today, you can test it on Microsoft accounts, e.g. outlook.com
- hpfr 6y ago
  If you have two, say, Microsoft accounts, can you use the same FIDO2-capable authenticator for both, and can Microsoft correlate the accounts by authenticator? I know keys are unique per-site, but are they per-account? edit: The spec[1] is vague on this, but it looked like a Relying Party can't correlate accounts directly via some kind of identifier for the authenticator. It looks like individual key pairs are generated on the authenticator for each account and linked to the unique userEntity.ID given by the Relying Party. However, Mozilla warns you [2] when sites ask for additional information about your authenticator. I tested this with Yubico's demo [3]. Unfortunately, it looks like the field attestationObject.attStmt.x5c identifies the authenticator. Firefox prompts you when sites ask for the extended information and removes this field if you check a box. That's nice, I guess, but it still seems not so great. If you were to forget and use a user agent that didn't prompt you to anonymize this, the Relying Party would get the attStmt in the response and theoretically could store and correlate accounts. Interested to hear more about the reasoning behind this. edit 2: It looks like this field is necessary as a second factor when using passwordless login? On Yubico's playground [4], checking "Enable passwordless login with this key" and then checking Firefox's "Anonymize anyway" box results in no request made to the key. Without enabling passwordless login, the request still works after anonymizing. To be honest, it seems like sites should allow passwordless login without the x5c field. I don't see how an attacker couldn't come up with the x5c field if they could crack the key pair. Is my reasoning right here? 1: https://www.w3.org/TR/webauthn-1 https://www.w3.org/TR/webauthn-1 2: https://support.mozilla.org/en-US/kb/privacy-web-authentication https://support.mozilla.org/en-US/kb/privacy-web-authenticat... 3: https://demo.yubico.com/webauthn-technical https://demo.yubico.com/webauthn-technical 4: https://demo.yubico.com/playground https://demo.yubico.com/playground
jabroni_salad 6y ago
I currently use a yubikey for as much as I can, so here is what I have: 1) My yubikey has NFC and works fine with my phone. Even that webauthn website demo works in a mobile browser via NFC. 2) For TOTP secrets, I enroll them in both my yubikey and in the Aegis android app. I mainly use these with the Yubico Authenticator software for windows or linux, but I can pull out my phone if I need to. 3) For any account that is using U2F, I have a second backup key (the blue security key) that I also enroll for that account.
- Ottolay 6y ago
  U2F is freaking awesome. It's rare to have something which is both high security and not a pain to use. I just wish the banking and financial industry would get onboard. For customer accounts, they are mostly using SMS, but some of them are still using personal info question (e.g. what was your first pets name) as a second factor which is horrible.

What happens if I lose the key, I don't have it on me, or if I'm using a mobile UI? It seems like you need an identifier (email/username/etc) besides the hardware key for this to be practical.

sneak 6y ago

U2F is a second factor, not a primary one.

nerdwaller 6y ago
While this is true, the spirit of the GP is correct. To login you will need both a username/password and the second factor. So losing the key is still relevant. In practice that means people really need to buy (at least) two yubikeys to register with services that allow it. Have one on something that’s always with you (such as keys) and the extra(s) as a backup somewhere secure. Unfortunately this works with most accounts except the big one I want it to... AWS. Some sites allow you to also register a standard MFA device as a fallback, and further still Google (as an example) allows you to use another device that’s already authenticated to get a one time use code (depending on your account security setup).
- paulie_a 6y ago
  Also google also allows for a list of recovery codes.
- sneak 6y ago
  To sidestep this, create a new AWS account to be your master SSO administration account (separate from whatever account you're already using), and enable "AWS Organizations" in it. Join the existing AWS accounts to the new "AWS Organization". Once you enable AWS SSO for the "organization", you can then set up SAML SSO to your existing identity provider (e.g. G Suite, which allows multiple hardware 2FA tokens per user). You do this in the new master organization account. You can create the corresponding users in AWS SSO, and grant them the appropriate permissions in the appropriate organization accounts. Then you do the 2FA auth to your IdP (G Suite, or selfhosted, or whatever) and then AWS just trusts the auth from the IdP, and you get to sidestep the terrible morass that is AWS MFA configuration. If you get stuck, email me.
  - nerdwaller 6y ago
    I’m going to have to take a look at this, this sounds awesome thank you!
blibble 6y ago
FIDO2 (effectively U2Fv2) can be used without a username or password

ecesena 6y ago

FIDO2 supports password-less and username-less authentication, both as a single factor, i.e. no passwords. Password-less is like 2FA but without the first factor. You type in your username, next you use the security key. Username-less is done via resident keys, that can also store the username at registration. The whole experience is just authenticating with the security key. If you use FIDO without a password (not as 2FA, but as single factor), you want to enable client-side protection like a PIN or biometric. These keys are introducing the biometric option so you can just tap, without entering a PIN. Edit: oh, this works already today, you can test it on Microsoft accounts, e.g. outlook.com

hpfr 6y ago
If you have two, say, Microsoft accounts, can you use the same FIDO2-capable authenticator for both, and can Microsoft correlate the accounts by authenticator? I know keys are unique per-site, but are they per-account? edit: The spec[1] is vague on this, but it looked like a Relying Party can't correlate accounts directly via some kind of identifier for the authenticator. It looks like individual key pairs are generated on the authenticator for each account and linked to the unique userEntity.ID given by the Relying Party. However, Mozilla warns you [2] when sites ask for additional information about your authenticator. I tested this with Yubico's demo [3]. Unfortunately, it looks like the field attestationObject.attStmt.x5c identifies the authenticator. Firefox prompts you when sites ask for the extended information and removes this field if you check a box. That's nice, I guess, but it still seems not so great. If you were to forget and use a user agent that didn't prompt you to anonymize this, the Relying Party would get the attStmt in the response and theoretically could store and correlate accounts. Interested to hear more about the reasoning behind this. edit 2: It looks like this field is necessary as a second factor when using passwordless login? On Yubico's playground [4], checking "Enable passwordless login with this key" and then checking Firefox's "Anonymize anyway" box results in no request made to the key. Without enabling passwordless login, the request still works after anonymizing. To be honest, it seems like sites should allow passwordless login without the x5c field. I don't see how an attacker couldn't come up with the x5c field if they could crack the key pair. Is my reasoning right here? 1: https://www.w3.org/TR/webauthn-1 https://www.w3.org/TR/webauthn-1 2: https://support.mozilla.org/en-US/kb/privacy-web-authentication https://support.mozilla.org/en-US/kb/privacy-web-authenticat... 3: https://demo.yubico.com/webauthn-technical https://demo.yubico.com/webauthn-technical 4: https://demo.yubico.com/playground https://demo.yubico.com/playground

jabroni_salad 6y ago

I currently use a yubikey for as much as I can, so here is what I have: 1) My yubikey has NFC and works fine with my phone. Even that webauthn website demo works in a mobile browser via NFC. 2) For TOTP secrets, I enroll them in both my yubikey and in the Aegis android app. I mainly use these with the Yubico Authenticator software for windows or linux, but I can pull out my phone if I need to. 3) For any account that is using U2F, I have a second backup key (the blue security key) that I also enroll for that account.

Ottolay 6y ago
U2F is freaking awesome. It's rare to have something which is both high security and not a pain to use. I just wish the banking and financial industry would get onboard. For customer accounts, they are mostly using SMS, but some of them are still using personal info question (e.g. what was your first pets name) as a second factor which is horrible.