4 ms·

Wide Web Authn[1] adoption can't come soon enough! This is so stupid! All I need is a single private key to login to all the websites! I personally like to kee

by msoad 5y ago

Wide Web Authn[1] adoption can't come soon enough! This is so stupid! All I need is a single private key to login to all the websites! I personally like to keep it in my iCloud account because I don't trust myself with keeping a private key for too long. [1] https://webauthn.io https://webauthn.io

dorianmariefr 5y ago
OTP is much simpler, I still don't know how I will be able to implement Webauthn for rubygems on the command line
- msoad 5y ago
  for command line stuff you should be using public key actually
  - dorianmariefr 5y ago
    Webauthn works with public keys, but how can I get the public key of the Touch ID sensor and actually I would need the private key to sign the challenge
- tialaramex 5y ago
  What is "rubygems on the command line" ? From the replies it sounds like this is talking about client software? An unattended client should not be able to do WebAuthn as the whole point is that a human is present and authorising the authentication step - this is part of its defence against remote attackers, if I have 100% full of Bob's device I still can't touch the sensor or button to authenticate as Bob. However, if you mean the human is present and running command line apps, that's fine, definitely possible. The authenticator is typically a USB device, it speaks HID (like a USB keyboard or mouse) but a specific custom HID protocol for this purpose, you can get a library to help talk to it, and that's how OpenSSH works with Yubikeys. Now, OpenSSH is specifically telling the authenticator "I'm SSH, not the Web" but for "Rubygems on the command line" you could choose either to say "I'm a web browser" or, you could say "I'm this custom rubygems on the command line thing" and that gets you public key signed messages that are unique to your thing, verifiable by a remote system as not "WebAuthn" but "Custom rubygem thing". Apple and Google (for the Android ecosystem) actually do all this today for phones, if you use a Web browser you get WebAuthn, but from a normal phone app you can do the exact same Usernameless/ Passwordless login like WebAuthn, but using a custom per-app message that can't be impersonated by other apps on the same phone.
  - dorianmariefr 5y ago
    See https://github.com/rubygems/rubygems.org/pull/2865 https://github.com/rubygems/rubygems.org/pull/2865 for the web part > From the replies it sounds like this is talking about client software? Yes the command line is a client to the rubygems server > An unattended client should not be able to do WebAuthn as the whole point is that a human is present and authorising the authentication step You either need a PIN, a fingerprint, a press, or no action just owning the device or the software. > if I have 100% full of Bob's device I still can't touch the sensor or button to authenticate as Bob. If you have a perfect copy of a Yubikey or the same fingerprint you should be able to authenticate I think > OpenSSH works with Yubikeys Nice, I will look into it
    - tialaramex 5y ago
      > You either need a PIN, a fingerprint, a press, or no action just owning the device or the software. The latter option shouldn't work for WebAuthn. The authenticator signs a message, saying basically "I promise I'm still me, whoever that is" and although it is nowhere near smart enough to understand the whole message (your browser wrote big parts of the message and it's just signing) it does understand a handful of bitflags it is signing. One of those flags is named UP (User Present) and the hardware should refuse to sign this flag unless it has seen some sign (like a touch sensor) that a human is present. UP is mandatory in WebAuthn, the remote server will (should) check it, and even though it's a single bit it was signed, so you can't change it. However even if you don't want to actually do WebAuthn, most Security Keys always do UP, there is no way to tell them "Don't check your sensor", it's just mandatory. I think this is even true with the relatively expensive Yubico devices (but I only own some cheaper ones) The next flag, UV, you can avoid, that's User Verified, which means a PIN, or a fignerprint sensor or something that demonstrates it wasn't just any old human it was apparently our owner, you don't need to require that and cheaper devices generally can't do it anyway. > If you have a perfect copy of a Yubikey There's no reason to be able to copy them. They're not intended to be able to be copied. You'll notice (if you have one) that there is only a "reset to factory" type feature, which randomises the guts. So, probably Yubico can't do it. Now, maybe if you've got a micro-electronics lab, the sort of place that reverse engineers modern chips to figure out how Intel or Apple or whoever did it, you could take a Yubikey to pieces, get the data out, and then make two clones that way, but first you need to steal the real one, for some period of time, and then put back one of the duplicates. Makes a good Hollywood plot, not sure it's realistic. > or the same fingerprint you should be able to authenticate I think You can't send the fingerprint over the network, the device looks at it locally, and only checks "Yup, that's the one I expected" before signing UV. So you need to send the actual finger. Now, maybe your attacker has a drone carrying a severed finger or something but we're getting pretty far away from teenager hacking thousands of accounts from their bedroom here.

by msoad 5y ago

dorianmariefr 5y ago

OTP is much simpler, I still don't know how I will be able to implement Webauthn for rubygems on the command line

msoad 5y ago
for command line stuff you should be using public key actually
- dorianmariefr 5y ago
  Webauthn works with public keys, but how can I get the public key of the Touch ID sensor and actually I would need the private key to sign the challenge
tialaramex 5y ago
What is "rubygems on the command line" ? From the replies it sounds like this is talking about client software? An unattended client should not be able to do WebAuthn as the whole point is that a human is present and authorising the authentication step - this is part of its defence against remote attackers, if I have 100% full of Bob's device I still can't touch the sensor or button to authenticate as Bob. However, if you mean the human is present and running command line apps, that's fine, definitely possible. The authenticator is typically a USB device, it speaks HID (like a USB keyboard or mouse) but a specific custom HID protocol for this purpose, you can get a library to help talk to it, and that's how OpenSSH works with Yubikeys. Now, OpenSSH is specifically telling the authenticator "I'm SSH, not the Web" but for "Rubygems on the command line" you could choose either to say "I'm a web browser" or, you could say "I'm this custom rubygems on the command line thing" and that gets you public key signed messages that are unique to your thing, verifiable by a remote system as not "WebAuthn" but "Custom rubygem thing". Apple and Google (for the Android ecosystem) actually do all this today for phones, if you use a Web browser you get WebAuthn, but from a normal phone app you can do the exact same Usernameless/ Passwordless login like WebAuthn, but using a custom per-app message that can't be impersonated by other apps on the same phone.
- dorianmariefr 5y ago
  See https://github.com/rubygems/rubygems.org/pull/2865 https://github.com/rubygems/rubygems.org/pull/2865 for the web part > From the replies it sounds like this is talking about client software? Yes the command line is a client to the rubygems server > An unattended client should not be able to do WebAuthn as the whole point is that a human is present and authorising the authentication step You either need a PIN, a fingerprint, a press, or no action just owning the device or the software. > if I have 100% full of Bob's device I still can't touch the sensor or button to authenticate as Bob. If you have a perfect copy of a Yubikey or the same fingerprint you should be able to authenticate I think > OpenSSH works with Yubikeys Nice, I will look into it
  - tialaramex 5y ago
    > You either need a PIN, a fingerprint, a press, or no action just owning the device or the software. The latter option shouldn't work for WebAuthn. The authenticator signs a message, saying basically "I promise I'm still me, whoever that is" and although it is nowhere near smart enough to understand the whole message (your browser wrote big parts of the message and it's just signing) it does understand a handful of bitflags it is signing. One of those flags is named UP (User Present) and the hardware should refuse to sign this flag unless it has seen some sign (like a touch sensor) that a human is present. UP is mandatory in WebAuthn, the remote server will (should) check it, and even though it's a single bit it was signed, so you can't change it. However even if you don't want to actually do WebAuthn, most Security Keys always do UP, there is no way to tell them "Don't check your sensor", it's just mandatory. I think this is even true with the relatively expensive Yubico devices (but I only own some cheaper ones) The next flag, UV, you can avoid, that's User Verified, which means a PIN, or a fignerprint sensor or something that demonstrates it wasn't just any old human it was apparently our owner, you don't need to require that and cheaper devices generally can't do it anyway. > If you have a perfect copy of a Yubikey There's no reason to be able to copy them. They're not intended to be able to be copied. You'll notice (if you have one) that there is only a "reset to factory" type feature, which randomises the guts. So, probably Yubico can't do it. Now, maybe if you've got a micro-electronics lab, the sort of place that reverse engineers modern chips to figure out how Intel or Apple or whoever did it, you could take a Yubikey to pieces, get the data out, and then make two clones that way, but first you need to steal the real one, for some period of time, and then put back one of the duplicates. Makes a good Hollywood plot, not sure it's realistic. > or the same fingerprint you should be able to authenticate I think You can't send the fingerprint over the network, the device looks at it locally, and only checks "Yup, that's the one I expected" before signing UV. So you need to send the actual finger. Now, maybe your attacker has a drone carrying a severed finger or something but we're getting pretty far away from teenager hacking thousands of accounts from their bedroom here.