3 ms·

See https://github.com/rubygems/rubygems.org/pull/2865 https://github.com/rubygems/rubygems.org/pull/2865 for the web part > From the replies it sounds like th

See https://github.com/rubygems/rubygems.org/pull/2865 https://github.com/rubygems/rubygems.org/pull/2865 for the web part > From the replies it sounds like this is talking about client software? Yes the command line is a client to the rubygems server > An unattended client should not be able to do WebAuthn as the whole point is that a human is present and authorising the authentication step You either need a PIN, a fingerprint, a press, or no action just owning the device or the software. > if I have 100% full of Bob's device I still can't touch the sensor or button to authenticate as Bob. If you have a perfect copy of a Yubikey or the same fingerprint you should be able to authenticate I think > OpenSSH works with Yubikeys Nice, I will look into it

tialaramex 5y ago
> You either need a PIN, a fingerprint, a press, or no action just owning the device or the software. The latter option shouldn't work for WebAuthn. The authenticator signs a message, saying basically "I promise I'm still me, whoever that is" and although it is nowhere near smart enough to understand the whole message (your browser wrote big parts of the message and it's just signing) it does understand a handful of bitflags it is signing. One of those flags is named UP (User Present) and the hardware should refuse to sign this flag unless it has seen some sign (like a touch sensor) that a human is present. UP is mandatory in WebAuthn, the remote server will (should) check it, and even though it's a single bit it was signed, so you can't change it. However even if you don't want to actually do WebAuthn, most Security Keys always do UP, there is no way to tell them "Don't check your sensor", it's just mandatory. I think this is even true with the relatively expensive Yubico devices (but I only own some cheaper ones) The next flag, UV, you can avoid, that's User Verified, which means a PIN, or a fignerprint sensor or something that demonstrates it wasn't just any old human it was apparently our owner, you don't need to require that and cheaper devices generally can't do it anyway. > If you have a perfect copy of a Yubikey There's no reason to be able to copy them. They're not intended to be able to be copied. You'll notice (if you have one) that there is only a "reset to factory" type feature, which randomises the guts. So, probably Yubico can't do it. Now, maybe if you've got a micro-electronics lab, the sort of place that reverse engineers modern chips to figure out how Intel or Apple or whoever did it, you could take a Yubikey to pieces, get the data out, and then make two clones that way, but first you need to steal the real one, for some period of time, and then put back one of the duplicates. Makes a good Hollywood plot, not sure it's realistic. > or the same fingerprint you should be able to authenticate I think You can't send the fingerprint over the network, the device looks at it locally, and only checks "Yup, that's the one I expected" before signing UV. So you need to send the actual finger. Now, maybe your attacker has a drone carrying a severed finger or something but we're getting pretty far away from teenager hacking thousands of accounts from their bedroom here.

tialaramex 5y ago

> You either need a PIN, a fingerprint, a press, or no action just owning the device or the software. The latter option shouldn't work for WebAuthn. The authenticator signs a message, saying basically "I promise I'm still me, whoever that is" and although it is nowhere near smart enough to understand the whole message (your browser wrote big parts of the message and it's just signing) it does understand a handful of bitflags it is signing. One of those flags is named UP (User Present) and the hardware should refuse to sign this flag unless it has seen some sign (like a touch sensor) that a human is present. UP is mandatory in WebAuthn, the remote server will (should) check it, and even though it's a single bit it was signed, so you can't change it. However even if you don't want to actually do WebAuthn, most Security Keys always do UP, there is no way to tell them "Don't check your sensor", it's just mandatory. I think this is even true with the relatively expensive Yubico devices (but I only own some cheaper ones) The next flag, UV, you can avoid, that's User Verified, which means a PIN, or a fignerprint sensor or something that demonstrates it wasn't just any old human it was apparently our owner, you don't need to require that and cheaper devices generally can't do it anyway. > If you have a perfect copy of a Yubikey There's no reason to be able to copy them. They're not intended to be able to be copied. You'll notice (if you have one) that there is only a "reset to factory" type feature, which randomises the guts. So, probably Yubico can't do it. Now, maybe if you've got a micro-electronics lab, the sort of place that reverse engineers modern chips to figure out how Intel or Apple or whoever did it, you could take a Yubikey to pieces, get the data out, and then make two clones that way, but first you need to steal the real one, for some period of time, and then put back one of the duplicates. Makes a good Hollywood plot, not sure it's realistic. > or the same fingerprint you should be able to authenticate I think You can't send the fingerprint over the network, the device looks at it locally, and only checks "Yup, that's the one I expected" before signing UV. So you need to send the actual finger. Now, maybe your attacker has a drone carrying a severed finger or something but we're getting pretty far away from teenager hacking thousands of accounts from their bedroom here.