5 ms·

Could someone explain, all hardware based around FIDO2 and U2F standards is equally compatible with software right? Put another way, Yubikey, Solokeys and other

Could someone explain, all hardware based around FIDO2 and U2F standards is equally compatible with software right? Put another way, Yubikey, Solokeys and others based on those standard should be equally compatible with gmail, SSH, VeraCrypt, sudo etc. and so interchangeable, is that correct? It all appears to be pretty far from being plug and play, often seeming to require a lot of additional software/modules to get specific things working. Is this because the standards don't go far enough or am I just way off the mark?

mlac 5y ago
The FIDO2 two factor auth portion is pretty seamless. It’s plug into USB port when the two factor prompt comes up, it will light up, touch the button, and good to go. Everything else - good luck. Proprietary apps. Each one is slightly different. I haven’t bothered to use it for key generation. To be fair, there are hardware design constraints (no clear UI) so it would be hard to get around the learning curve.
- Sporktacular 5y ago
  Okay, sorry if this is obvious. So FIDO is intended for authentication on the web/cloud only (and requires compatibility from both the website/site and the browser to work). So this is why when talking about using hardware keys to unlock local stuff, like a PC, or authenticate/decrypt SSH, GPG, bitlocker etc. this all gets so tricky and often needs extra software?
  - mlac 5y ago
    I’m by no means an expert in this area (and expect someone here could speak to it better than I can), but the Yubikeys have a lot of capability. From their website: “Support for WebAuthn, FIDO2, FIDO U2F, smart card (PIV), Yubico OTP, OpenPGP, OATH-TOTP, OATH-HOTP, and Challenge-Response” [1] So one key can do all of those things. How user friendly it is depends on the service you’re using and how that is configured. Logging into to a google account? Easy. Logging into Windows? Easy-Medium [2]. As more organizations support the tool, it becomes plug and play in a lot of areas (Okta, centrify, etc). Mac is more difficult with opportunity to lock yourself out [5]. Linux is… Linux. You can set more configurable options in the manager tool. [3] But it can get as complicated as you want it to with the developer tools [4]. I’ve been following this for years and have had keys, and I think we’re finally to the point where I could recommend it to a semi-technical person. Get 3 - 1 small form factor that stays in your main computer / pc / chromebook, one on your key ring with NFC, and a backup in a fireproof safe. That will stop any account takeover. If a key is lost or stolen, revoke and replace it. That will cover 99% of attack scenarios for the population. [1] https://www.yubico.com/product/yubikey-5-nfc/ https://www.yubico.com/product/yubikey-5-nfc/ [2] https://www.yubico.com/products/computer-login-tools/ https://www.yubico.com/products/computer-login-tools/ [3] https://www.yubico.com/support/download/yubikey-manager/ https://www.yubico.com/support/download/yubikey-manager/ [4] https://www.yubico.com/support/download/ https://www.yubico.com/support/download/ [5] https://support.yubico.com/hc/en-us/articles/360016649059-Using-Your-YubiKey-as-a-Smart-Card-in-macOS https://support.yubico.com/hc/en-us/articles/360016649059-Us...
    - Sporktacular 5y ago
      Sounds like a good option. I've been finding it hard to understand how this all fits together. For example, which of the standards listed above is the mechanism used to unlock a PC or a mac? Which one applies to allowing sudo? I guess that's the crux of it. I'd prefer to find an open hardware alternative if possible, and not have to trust additional software. I know my use case, but don't know which standards apply and are required to make it happen. Knowing that would allow me to pick an open hardware key that, by meeting those standards, would let me do what I need. It just seems even ticking those boxes isn't much of a guarantee when so much extra software appears to be needed. The alternative is to either find: - the open device with the most active developer community and hope the feature comes - the device that just meets the most standards (as you suggest, a Yubikey) If I sound confused it's just because I am.
      - tialaramex 5y ago
        For your "Unlock a PC" need you may be looking for the FIDO optional feature hmac-secret. e.g. one of the things Microsoft wants to unlock a (potentially offline) Windows 10 PC is hmac-secret and it is not an essential feature of FIDO since you wouldn't need it to e.g. sign in to Google, or GitHub or whatever. For products built by the community, you should be able to find someone who has tried your scenario (e.g. "Unlock a macOS 12 macBook") and can say it definitely works with the product before you buy one.
        Sporktacular 5y ago
        That (a feature name) is what I'm talking about. Thanks a lot. I guess another I noticed was PIV/Smartcard which seems to be kind of long in the tooth and not available on some newer hardware keys. I'm not sure if that's for security reasons and I start to wonder if multi-protocol hardware is more open to a wider array of attacks. But thanks again.
      - mlac 5y ago
        It’s not easy and there may be a solution out there that I’m not aware of, but yubico met my needs (and Feitan) so I stopped. The principle I keep in mind here is that the implementation is the weakest part of crypto and has the most room for error. For me personally, it requires too much time and energy to roll my own, especially knowing I’ll likely screw something up. If it was a side project, slightly different, but I want something I can forget about for a year and come back and it just works. In my case, the risk of an overly complicated setup locking me out is higher than any risk from using yubicos hardware and setting things up. But I would start with getting a key, playing around, and doing what they other commenter suggested.
  - tialaramex 5y ago
    This guide mostly isn't about FIDO. It's about the however many other features a Yubikey carries. One of those fancy pocket knives with sixteen tools is also a bit of a handful to work with, and if you've used one and relied on its specialist tool for cracking walnuts, you may be disappointed by a cheap four way multitool that does not crack walnuts. However, it would be wrong to say "Why are knives so tricky to use?" when it's not really the knife's fault.
upofadown 5y ago
The stuff the article is talking about is based on the OpenPGP smartcard standard, not FIDO2 or U2F. Basically what is happening here (when thought about in messaging terms) is that the YubiKey is being used as a portable air gapped system. When shopping for a suitable device you look for OpenPGP compatibility on the list of features. You can even still get it in smartcard format[1]. Integrated USB devices like the YubiKey that support OpenPGP are effectively emulating a smartcard and a USB smartcard reader. [1] https://www.floss-shop.de/en/security-privacy/smartcards/13/openpgp-smart-card-v3.4 https://www.floss-shop.de/en/security-privacy/smartcards/13/...
- eadmund 5y ago
  > … the YubiKey is being used as a portable air gapped system. If it’s plugged into a networked system, it's not air-gapped. And if an air-gapped system is connected to any device which has previously been connected to a non-air-gapped system, it's no longer air-gapped. I hate to nitpick, but this is really, really important.
  - upofadown 5y ago
    Well, it is an air gapped system that depends on a possibly insecure input and output device. The decryption and signing is done exclusively on the device under the physical control of the user. No one has access to the secret key material, not even the user. Every air gapped system has the weakness that you have to eventually get material on and off the system. That connection can be used to attack the air gapped system. The smartcard interface used here to isolate the systems might be considered weaker than other methods but it is intended to provide this sort of isolation.
    - eadmund 5y ago
      > Well, it is an air gapped system that depends on a possibly insecure input and output device. No, an air gap means that there is a gap of air between the system and any insecure network. By definition, a YubiKey plugged into a networked laptop is not airgapped because there is a direct electrical connexion to the laptop’s USB controller, which has either an electrical or an RF connexion to one or more networks. > Every air gapped system has the weakness that you have to eventually get material on and off the system. I really think that you misunderstand what an air-gapped system is. A desktop not connected to a network is an air-gapped system, and can be very useful. For years we computer enthusiasts used non-networked — air-gapped — computers and loved them. An air-gapped desktop publishing system would be very useful for producing samizdat in a repressive regime, for example. I imagine folks did exactly that in the late 80s in the Soviet Union. In my youth, all video game consoles were air-gapped, and they were very useful.

mlac 5y ago

The FIDO2 two factor auth portion is pretty seamless. It’s plug into USB port when the two factor prompt comes up, it will light up, touch the button, and good to go. Everything else - good luck. Proprietary apps. Each one is slightly different. I haven’t bothered to use it for key generation. To be fair, there are hardware design constraints (no clear UI) so it would be hard to get around the learning curve.

Sporktacular 5y ago
Okay, sorry if this is obvious. So FIDO is intended for authentication on the web/cloud only (and requires compatibility from both the website/site and the browser to work). So this is why when talking about using hardware keys to unlock local stuff, like a PC, or authenticate/decrypt SSH, GPG, bitlocker etc. this all gets so tricky and often needs extra software?
- mlac 5y ago
  I’m by no means an expert in this area (and expect someone here could speak to it better than I can), but the Yubikeys have a lot of capability. From their website: “Support for WebAuthn, FIDO2, FIDO U2F, smart card (PIV), Yubico OTP, OpenPGP, OATH-TOTP, OATH-HOTP, and Challenge-Response” [1] So one key can do all of those things. How user friendly it is depends on the service you’re using and how that is configured. Logging into to a google account? Easy. Logging into Windows? Easy-Medium [2]. As more organizations support the tool, it becomes plug and play in a lot of areas (Okta, centrify, etc). Mac is more difficult with opportunity to lock yourself out [5]. Linux is… Linux. You can set more configurable options in the manager tool. [3] But it can get as complicated as you want it to with the developer tools [4]. I’ve been following this for years and have had keys, and I think we’re finally to the point where I could recommend it to a semi-technical person. Get 3 - 1 small form factor that stays in your main computer / pc / chromebook, one on your key ring with NFC, and a backup in a fireproof safe. That will stop any account takeover. If a key is lost or stolen, revoke and replace it. That will cover 99% of attack scenarios for the population. [1] https://www.yubico.com/product/yubikey-5-nfc/ https://www.yubico.com/product/yubikey-5-nfc/ [2] https://www.yubico.com/products/computer-login-tools/ https://www.yubico.com/products/computer-login-tools/ [3] https://www.yubico.com/support/download/yubikey-manager/ https://www.yubico.com/support/download/yubikey-manager/ [4] https://www.yubico.com/support/download/ https://www.yubico.com/support/download/ [5] https://support.yubico.com/hc/en-us/articles/360016649059-Using-Your-YubiKey-as-a-Smart-Card-in-macOS https://support.yubico.com/hc/en-us/articles/360016649059-Us...
  - Sporktacular 5y ago
    Sounds like a good option. I've been finding it hard to understand how this all fits together. For example, which of the standards listed above is the mechanism used to unlock a PC or a mac? Which one applies to allowing sudo? I guess that's the crux of it. I'd prefer to find an open hardware alternative if possible, and not have to trust additional software. I know my use case, but don't know which standards apply and are required to make it happen. Knowing that would allow me to pick an open hardware key that, by meeting those standards, would let me do what I need. It just seems even ticking those boxes isn't much of a guarantee when so much extra software appears to be needed. The alternative is to either find: - the open device with the most active developer community and hope the feature comes - the device that just meets the most standards (as you suggest, a Yubikey) If I sound confused it's just because I am.
    - tialaramex 5y ago
      For your "Unlock a PC" need you may be looking for the FIDO optional feature hmac-secret. e.g. one of the things Microsoft wants to unlock a (potentially offline) Windows 10 PC is hmac-secret and it is not an essential feature of FIDO since you wouldn't need it to e.g. sign in to Google, or GitHub or whatever. For products built by the community, you should be able to find someone who has tried your scenario (e.g. "Unlock a macOS 12 macBook") and can say it definitely works with the product before you buy one.
      - Sporktacular 5y ago
        That (a feature name) is what I'm talking about. Thanks a lot. I guess another I noticed was PIV/Smartcard which seems to be kind of long in the tooth and not available on some newer hardware keys. I'm not sure if that's for security reasons and I start to wonder if multi-protocol hardware is more open to a wider array of attacks. But thanks again.
    - mlac 5y ago
      It’s not easy and there may be a solution out there that I’m not aware of, but yubico met my needs (and Feitan) so I stopped. The principle I keep in mind here is that the implementation is the weakest part of crypto and has the most room for error. For me personally, it requires too much time and energy to roll my own, especially knowing I’ll likely screw something up. If it was a side project, slightly different, but I want something I can forget about for a year and come back and it just works. In my case, the risk of an overly complicated setup locking me out is higher than any risk from using yubicos hardware and setting things up. But I would start with getting a key, playing around, and doing what they other commenter suggested.
- tialaramex 5y ago
  This guide mostly isn't about FIDO. It's about the however many other features a Yubikey carries. One of those fancy pocket knives with sixteen tools is also a bit of a handful to work with, and if you've used one and relied on its specialist tool for cracking walnuts, you may be disappointed by a cheap four way multitool that does not crack walnuts. However, it would be wrong to say "Why are knives so tricky to use?" when it's not really the knife's fault.

upofadown 5y ago

The stuff the article is talking about is based on the OpenPGP smartcard standard, not FIDO2 or U2F. Basically what is happening here (when thought about in messaging terms) is that the YubiKey is being used as a portable air gapped system. When shopping for a suitable device you look for OpenPGP compatibility on the list of features. You can even still get it in smartcard format[1]. Integrated USB devices like the YubiKey that support OpenPGP are effectively emulating a smartcard and a USB smartcard reader. [1] https://www.floss-shop.de/en/security-privacy/smartcards/13/openpgp-smart-card-v3.4 https://www.floss-shop.de/en/security-privacy/smartcards/13/...

eadmund 5y ago
> … the YubiKey is being used as a portable air gapped system. If it’s plugged into a networked system, it's not air-gapped. And if an air-gapped system is connected to any device which has previously been connected to a non-air-gapped system, it's no longer air-gapped. I hate to nitpick, but this is really, really important.
- upofadown 5y ago
  Well, it is an air gapped system that depends on a possibly insecure input and output device. The decryption and signing is done exclusively on the device under the physical control of the user. No one has access to the secret key material, not even the user. Every air gapped system has the weakness that you have to eventually get material on and off the system. That connection can be used to attack the air gapped system. The smartcard interface used here to isolate the systems might be considered weaker than other methods but it is intended to provide this sort of isolation.
  - eadmund 5y ago
    > Well, it is an air gapped system that depends on a possibly insecure input and output device. No, an air gap means that there is a gap of air between the system and any insecure network. By definition, a YubiKey plugged into a networked laptop is not airgapped because there is a direct electrical connexion to the laptop’s USB controller, which has either an electrical or an RF connexion to one or more networks. > Every air gapped system has the weakness that you have to eventually get material on and off the system. I really think that you misunderstand what an air-gapped system is. A desktop not connected to a network is an air-gapped system, and can be very useful. For years we computer enthusiasts used non-networked — air-gapped — computers and loved them. An air-gapped desktop publishing system would be very useful for producing samizdat in a repressive regime, for example. I imagine folks did exactly that in the late 80s in the Soviet Union. In my youth, all video game consoles were air-gapped, and they were very useful.