3 ms·

Hardware tokens were commoditised by yubikey but they really should be TPM based, until there’s critical mass it’ll be a nuanced technology and Yubikey clearly

Hardware tokens were commoditised by yubikey but they really should be TPM based, until there’s critical mass it’ll be a nuanced technology and Yubikey clearly don’t have the clout.

md_ 5y ago
TPM-based like...Windows Hello? Both Windows and Mac support host-based FIDO keys. Of course, the downside here is that you...can't move them to a new computer. So they're sort of hard to use on their own, hence people still turn to portable (but less secure) solutions like TOTP and SMS.
- hsbauauvhabzb 5y ago
  Fair point, I’m not super familiar with hello. The problem of cross-computer access is solvable* - add cryptographic trusts to transport encrypted data across insecure hardware. *I didn’t say it’d be great user experience though.
  - md_ 5y ago
    Yep, Apple solves this by moving FIDO key material around via iCloud, I believe. But it requires a good syncing mechanism like that. In principle it's similar to the password manager problem, which is a bit ironic: if everyone used password managers, most of the same security issues would be resolved. (There are a few cases where a FIDO key is better than a password manager, but not many!)
chopin 5y ago
The Yubikey at least requires me to press it in an authentication process. If it's software only an attacker could gain access stealthily. It's already hard to trust OS and browser. Therefore I'd prefer a physical interaction on a device where the behavior cannot be altered.
- hsbauauvhabzb 5y ago
  TPM is a hardware chip which effectively implements the same concepts as yubikeys but predates them by about a decade.
  - zie 5y ago
    Yubico founded 2007 TPM(ISO/IEC 11889) started 2009 So your timing is off, but otherwise yes, TPM effectively can do what a yubikey can do, but it can also do more than that, especially in the TPM2 version.
CyberRage 5y ago
There's no need for yubikeys. we have the ultimate key, our phones. Most modern phones have SE(Secure Element) or virtualized secure zone(ARM Trustzone) which can act as de-facto key. Google already uses it to great success(most people are clueless to that though)

Hardware tokens were commoditised by yubikey but they really should be TPM based, until there’s critical mass it’ll be a nuanced technology and Yubikey clearly don’t have the clout.

md_ 5y ago

TPM-based like...Windows Hello? Both Windows and Mac support host-based FIDO keys. Of course, the downside here is that you...can't move them to a new computer. So they're sort of hard to use on their own, hence people still turn to portable (but less secure) solutions like TOTP and SMS.

hsbauauvhabzb 5y ago
Fair point, I’m not super familiar with hello. The problem of cross-computer access is solvable* - add cryptographic trusts to transport encrypted data across insecure hardware. *I didn’t say it’d be great user experience though.
- md_ 5y ago
  Yep, Apple solves this by moving FIDO key material around via iCloud, I believe. But it requires a good syncing mechanism like that. In principle it's similar to the password manager problem, which is a bit ironic: if everyone used password managers, most of the same security issues would be resolved. (There are a few cases where a FIDO key is better than a password manager, but not many!)

chopin 5y ago

The Yubikey at least requires me to press it in an authentication process. If it's software only an attacker could gain access stealthily. It's already hard to trust OS and browser. Therefore I'd prefer a physical interaction on a device where the behavior cannot be altered.

hsbauauvhabzb 5y ago
TPM is a hardware chip which effectively implements the same concepts as yubikeys but predates them by about a decade.
- zie 5y ago
  Yubico founded 2007 TPM(ISO/IEC 11889) started 2009 So your timing is off, but otherwise yes, TPM effectively can do what a yubikey can do, but it can also do more than that, especially in the TPM2 version.

CyberRage 5y ago

There's no need for yubikeys. we have the ultimate key, our phones. Most modern phones have SE(Secure Element) or virtualized secure zone(ARM Trustzone) which can act as de-facto key. Google already uses it to great success(most people are clueless to that though)