4 ms·
In essence, you require both the Yubikey in question, and the information supplied by the fingerprint reader to the Yubikey, in order to abuse this system. Fro
by g_p 5y ago
In essence, you require both the Yubikey in question, and the information supplied by the fingerprint reader to the Yubikey, in order to abuse this system.
From the perspective of a U2F token, which uses a regular button, this is an increase in security for most users -- if their token is lost or stolen, or left in their device, someone cannot use their token by tapping the button.
This doesn't address the inherent problem of irrevocability/unchangeability of biometrics, but it presents an interesting usability trade-off that could help non-technical users to keep their systems more secure.
If you capture the wire signal between the fingerprint reader sensor and the module, it is likely that you could replay a valid authentication. If not, you could delve deeper into the sensor until eventually you are able to inject capacitive data from the sensing surface itself, and do this.
In this case, by combining the use of a biometric with strong cryptographic authentication through the token, you require both to compromise the user -- no biometrics are shared with a server, it's all local. However if you lose either the token, or the ability to use that fingerprint (i.e. scratch or damage), you will lose access to the key the Yubikey has protected, absent some kind of backup password. For many users, that backup password will be the weak link, but a Yubikey should at least be able to rate limit attempts and erase its internal state if there are too many attempts.
- tialaramex 5y agoFor the WebAuthn scenario there is no inherent backup, there's deliberately no way to export the keys. For a random web site, they're likely going to offer some way back in - albeit Google is content to make that quite hard if you choose their "Advanced Protection" scheme (and I think one of the free Git offerings just says too bad, you gave us no money, you're locked out but you lost nothing of value), but an employer might very reasonably issue employees a Security Key and say something like, look, if you lose it that sucks but go to Front Desk with your Line Manager, and they can issue you a new one, there is no bypass. As a user, it also makes sense (particularly if you know you're a real target, e.g. a political journalist, politician, activist) to just own more than one. > Yubikey should at least be able to rate limit attempts and erase its internal state if there are too many attempts. On the previous generation with a PIN as second factor, if you guess the PIN wrong repeatedly it locks you out.
- g_p 5y agoIndeed - the lack of backups in WebAuthn is a design feature (although I can see credible usability issues in online services where users should really enrol several, but struggle to keep them in different locations and ensure they register their off-site backup key to each service etc.) I presume (but haven't reviewed in detail) that these bio keys will have a backup PIN in the same way previous models had the PIN available for management and WebAuthn modes of operation - there are some real-world failure modes where wet hands or a bandaged finger may be an issue, but the user still wants to keep using it. I do agree the best solution is to get several tokens, enrol them all for each service, and just keep them as safe as you realistically can.
- psanford 5y agoIdeally, I'd have 2 webauthn tokens, one that I keep on myself, and one that I have at a secure, off site location (like a safe deposit box, if you consider that secure). The problem is you need to physically posses the backup key to register it to any new services you might sign up for. Yubikey has proposed a webauthn extension to support this usecase[0]. Unfortunately it requires both changes to both hardware and server side webauthn libraries, so it will likely be years before this would actually be a viable solution. [0]: https://www.yubico.com/blog/yubico-proposes-webauthn-protocol-extension-to-simplify-backup-security-keys/ https://www.yubico.com/blog/yubico-proposes-webauthn-protoco...
- staticassertion 5y agoThe backup would be another hardware token, ideally. Just one that isn't biometric. You would guard physical access to that token more closely. Google's Advanced Protection Program enforces two keys, since they also make recovery much stricter.