11 ms·

Show HN: A virtual Yubikey device for 2FA/WebAuthN

166 points by cmdli 4y ago

iudqnolq 4y ago
I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen of any of my devices either. Edit: There is a way to use a Yubikey to decrypt Linux full-disk encryption. It relies on an abandoned personal GitHub project. Sounds fun, but not sufficiently secure it's worth spending more than $100 to allegedly improve my security with it.
- warent 4y ago
  I think a huge benefit of 2fa, one of the main purposes of it, was for securing accounts with weak passwords. Back in the days before password managers etc. I think these days password managers actually deprecate the need for 2fa
  - TrueGeek 4y ago
    Every now and then you hear about a leak at some company that was storing passwords in clear text. Thanks to password managers this only affects that one site, but it still makes me thankful for 2FA.
    - iudqnolq 4y ago
      I don't understand the threat model there. Wouldn't nearly all hacks that lead to plain text passwords also allow the hacker to access all the login-protected data, making a more secure login process pointless?
      - bb88 4y ago
        Not necessarily. It's common practice for a hacker to break into a site, grab the passwords, then sell them or release them on the dark web. The methods they used to break into the site are often considered "trade secrets".
  - askvictor 4y ago
    Multiple layers are always better. If your computer or browser is compromised, then your password manager's secrets have been pwned, but with 2FA your accounts are still safe (assuming the 2FA is on a separate device, which it really should be) There's also non-tech users to consider. It's pretty hard to convince users to use a password manager; plenty of people still re-use the same password across sites. It's impossible to prevent that. But it is possible to enforce 2FA for _your_ site.
    - iudqnolq 4y ago
      Your first example is interesting, but it's much more limited than you describe. The attacker can't use your credentials to authenticate their own session, but they have complete control over the authenticated session on your laptop. I can't think of an account I have where that would be meaningfully less bad.
      - askvictor 4y ago
        The attacker has access to all of your authenticated sessions on your compromised laptop. They don't have access to any un-authenticated accounts which have 2FA enabled.
        bb88 4y ago
        Further because 2FA is simpler, a session can time out in a shorter amount of time.
  - dilyevsky 4y ago
    Wrong - mfa is to prevent credentials stuffing mostly
  - bb88 4y ago
    Passwords are an antipattern. Password managers are just a crutch to make it less painful. Password recovery is often done through the phone via SMS (health care/banking) when a 2FA hardware key would be safer. And since you're implementing 2FA, just remove the password, and ask the user to use the 2FA key.
    - smeej 4y ago
      I think my favorite example of using SMS in the least sane way possible is PayPal. I have a hardware key AND an authenticator app active for the account, but they STILL won't let me send transactions without entering a code sent to my phone number. And actually, not even then, because even though I receive the code fine, they say they can't authenticate me and don't give me a chance to enter it. Yes, it's a VOIP number, but it's been the same VOIP number for the 10 years I've had the account. It's not like it's new.
      - bb88 4y ago
        I needed to recover my user account / password through Voya recently for a corporate 401k. They needed to send me 3(!) SMS messages in the process. One to get the username (with a valid email address). One more to request to change the password. And one more to actually change the password.
- ivanhoe 4y ago
  Can you define what do you mean by sufficient support?
  - iudqnolq 4y ago
    Sure: Enough support so that my life becomes sufficiently easier or more secure to be worth the cost. I know that's a bit wishy-washy, but for example I think I could replace my memorized 1password password with something longer if I never had to enter it from memory, which would only be the case if I could use the Yubikey on all my devices.
    - akerl_ 4y ago
      I use a yubikey with x509 cert and PIN for local auth to my Mac, and I use it for FIDO2 MFA everywhere that supports it, which includes my email account. That makes my email credentials radically more resistant to phishing, which is huge given that email is part of the recovery story for every other account. If those aren’t enough, I guess yubikeys aren’t the right call for your threat model, which is fine.
      - iudqnolq 4y ago
        I'd love to have that setup. The only problem is insufficiently mature support for the devices I use, Linux and Android. As I mentioned in an edit Yubikey local auth on Linux relies on a personal GitHub project abandoned years ago.
        jklfhfyhjlo 4y ago
        Bah, everything the GP described works perfectly in Linux. Yubikey local auth isn't just one Yubikey specific project. The Yubikey implements a fuckload of open protocols, the vast majority of which work perfectly in Linux. Want local authentication? pam_u2f, pam_gpg, pam_x509 are all maintained.
        akerl_ 4y ago
        The other person who replied to this seems to have gotten up on the wrong side of the bed, but the core of their suggestion is one I’d likewise recommend. I’m doing the yubikey local auth using the yubikey’s PIV applet, which holds standard x509 certs that can be used via pkcs11. You should be able to set up PAM to use them in that way, without needing any yubikey-specific hijinks. Something like https://discourse.ubuntu.com/t/smart-card-authentication/26009 https://discourse.ubuntu.com/t/smart-card-authentication/260...
- hamandcheese 4y ago
  > No 2fa device has sufficient support that it could be used to unlock the lockscreen of any of my devices either. Remember, 2fa is your second factor. It’s right there in the acronym. It is there to protect against a bad actor stealing your password. By definition, a second factor won’t improve the ergonomics of logging in.
  - iudqnolq 4y ago
    Not quite. A second factor would allow me to reduce the complexity of my password while retaining the same level of security. Without that the only benefit of a Yubikey over a strong password saved in a password manager is phishing protection, which I'm not willing to pay that amount of money for.
    - hamandcheese 4y ago
      Not just phishing - you could lose your password via malware, or if services store passwords in clear text and get hacked.
      - iudqnolq 4y ago
        I use different passwords for every service. Malware on a device where I'm logged into the service can use that authenticated session to access all the things I want protected. If the service is hacked, the hacker probably has direct access to everything the password was protecting.
        hamandcheese 4y ago
        > Malware on a device where I'm logged into the service can use that authenticated session to access all the things I want protected. Any well-secured service should protect critical actions with 2fa. “oh, are you sure you want to transfer all your funds? Please re-authenticate first”
        snadal 4y ago
- traceroute66 4y ago
  > I can't figure out why I'd want a Yubikey. Do you use SSH ? Yubikeys are a fabulous way to store SSH keys. Also bear in mind that aside from a secure storage mechanism, Yubkeys can also be configured to require pin and/or touch. Therefore no matter what gets onto your computer, the Yubikey won't provide the answer unless touched.
  - iudqnolq 4y ago
    > Do you use SSH Yes, but not for anything where keeping the SSH private key more secure than my AWS/DigitalOcean credentials would be useful. And I store those credentials in 1Password, which doesn't have a sufficiently mature integration with Yubikey on Linux or Android.
    - LelouBil 4y ago
      Use Bitwarden, it's a great password manager and it works with yubikey. You can also self host it fully.
- wyager 4y ago
  I use it for github, cloudflare, login.gov, etc.
- themagician 4y ago
  I love the Yubikey even if it only locks down a few important accounts. For me, that's Google Accounts and Microsoft Accounts. These are the accounts I worry about this most because they are linked to so many other things. I wish 1Password offered a high security, security key ONLY mode.
  - waynesonfire 4y ago
    I agree, I wish 1password had more native yubikey support.
- nick__m 4y ago
  I use 1Password and 2 Yubikey. Both yubikeys are configured to enter the same impossible to memorize password on a press to unlock 1Password, hid mode is supported by every device with a USB ports. I also use them as an otp second factor when a site requires it. Finally, they are configured with a x509 certificate that I use as my ssh keys. I generate one key per devices that way the secret never leaves it and I require a pin to unlock the key. For convenience, I use an ssh agent to cache the pin I could also use them for pgp signature and encryption but I have no use case for that.
  - taubek 4y ago
    How do you configure Yubikey to enter password for unlocking 1password? Is this a Yubikey feature or 1password feature? Does this also work with mobile devices (phones)?
    - loulouxiv 4y ago
      That is the hid mode parent is mentionning. With ykman you can configure the Yubikey to simulate being a USB keyboard (Human Interface Device) and then "type" a static password. The default setting is to type a Yubico specific OTP that can be checked by calling an API. The issue with the static password is that anybody getting near the yubikey with a device having a USB port can steal the password in seconds.
      - taubek 4y ago
        Thank you for explanation! I wasn't aware of this feature.
      - sig-io 4y ago
        And any accidental button-press while in a chat-app or website will leak your password. I've seen many yubikey otp's accidentally pasted into irc, if you set it to password, you just posted that. I'd never recommend using that mode.
        4y ago
- Ferret7446 4y ago
  Your phrasing is odd. 2FA devices do not support websites. Websites support 2FA options. The problem isn't 2FA devices, but services not supporting 2FA. U2F/FIDO are standard at this point and many tech-related services support them; certainly, effectively all 2FA devices support them. 2FA is redundant for unlocking physical devices. Access to the device itself is already a second factor. The point of 2FA is that someone MUST physically take something from you to gain access, which greatly limits attack vectors. If you use 2FA properly, the only thing you need to worry about for account security is whether you still have your 2FA key on you.
- 5d8767c68926 4y ago
  The thing that trips me up is the ability to make backups in the event it is lost/stolen. Seemingly not all services allow registering an additional key, and even if they do, the practicalities of juggling redundant fobs would be cumbersome.
  - Semaphor 4y ago
    > Seemingly not all services allow registering an additional key I’ve only ever encountered that braindead design with AWS, every other place allows multiple keys. And I can’t say I find multiple keys cumbersome, it’s simply the same procedure again: Click add, insert key and tap the button. Just twice instead of once.
    - 5d8767c68926 4y ago
      Specifically, I want a backup key off-site. Anytime I enroll a new service, I need to retrieve my backup key from storage for the purposes of enrolling. Depending on how/where the backup is stored (bank box, parent's house across the country, etc) that would make the system less workable in practice.
- vertis 4y ago
  I've found the Yubikey to be an incredibly easy way to do 2FA. I use a usb-c nano version and it pretty much never leaves my mac (and the mac never leaves me). I've found it faster to do 2FA on a large number of tech websites. Just touch the key and you're done. I know 1Password can fill TOTP for you, but I like having my security spread across 1Password and Yubikey. In the unlikely event 1Password gets compromised they still need physical access to my computer. I don't log onto the mac with Yubikey and it has full-disk encryption turned on, so I'm pretty happy with the attack surface.
- ranguna 4y ago
  > There is a way to use a Yubikey to decrypt Linux full-disk encryption. It relies on an abandoned personal GitHub project Abandoned? You do know luks supports FIDO, right? Here's a small guide on how to do it: https://prose.bentopais.pt/setting-up-trezor-on-arch#luks-unlock https://prose.bentopais.pt/setting-up-trezor-on-arch#luks-un... You'll also find how to use your key to login to the tty, authenticate to sudo commands and much more.
- deleted 4y ago
  [deleted]
- xani_ 4y ago
  You can use Yubikeys(most of them, the cheapest ones don't have that feature IIRC) as smartcards in addition to other features. You can use smartcard in linux as both GPG key, and SSH key (via GPG SSH agent). Which means leaking your private key for SSH is essentially impossible, as key can be generated on device which means it never leaves it, even if your machine gets compromised
- waynesonfire 4y ago
  I use it to store my gpg keys among other use-cases. The key provides a permanence and isolation. I can't accidentally delete it without trying and the button needs to be pressed to access the key. I like these trait.
lddemi 4y ago
Fun demo but who is this really for? Is there a requirement for these devices anywhere aside from corporate security?
- cmdli 4y ago
  Personally, I prefer the "approval" process of YubiKey/U2F devices over having to enter a code, but I also dislike having to have a hardware device on me at all times. Also, with WebAuthN and passwordless login, YubiKeys are now able to be used to authenticate people, so I figure it would be nice to have a software solution for that. Granted, this is still just a demo, so it's a long way off from something somebody would regularly use.
- altairprime 4y ago
  This is primarily of use to people who want to disregard hardware authenticator requirements imposed by third parties without their consent.
  - postalrat 4y ago
    Jeez. That's almost as bad as requiring a password!
- MrStonedOne 4y ago
- dspillett 4y ago
  > Fun demo but who is this really for? Would being able to create virtual devices like this be more useful for testing authentication flows, compared to having physical test devices?
  - convolvatron 4y ago
    this might help w/ adoption. it would be _really nice_ to use FIDO, but I don't want to restrict my usability to people willing to carry a key around. as a compromise I think having a weaker key is better than having paths where pki is disabled
stavros 4y ago
This is fantastic. Did you make this, cmdii? Why does it need to persist files locally? I thought that all that's necessary is the key. Is it for resident keys? I'd like a virtual FIDO2 device where I have to type a password/passphrase when I launch it, and it derives a FIDO2 key from the passphrase. That way, I can have my 2FA device with me in my head, and still get all the anti-phishing benefits of WebAuthn. Certainly, it's much easier for the passphrase to be stolen/keylogged, but it's a nice option to have.
- cmdli 4y ago
  Yup, I built this. The file storage is only for the FIDO2/WebAuthN device, which generates large private keys for each credential; the U2F device keys are small enough that they are actually encrypted/stored in the key identifier that is passed in by the client. I’m currently working on trying to expand this out with new features, as most of the work here was actually emulating the USB device which involved a lot of different layers of protocols.
  - stavros 4y ago
    Very nice work! This is one step closer to a password manager that doesn't actually need to store any passwords, just one key. I'm not very familiar with FIDO2, but I thought the private keys for each credential were derived from the single key in the device and the website's domain? Is that not the case? Or are you just generating separate credentials per site and keeping those? If the latter, couldn't you derive all credentials from a single source of randomness and skip the storage?
    - cmdli 4y ago
      Each credential has its own private key which is signed by the device's private key for certification. I am uncertain if the FIDO2 spec says how those private keys need to be generated; right now they are generated randomly but they could easily be generated from a single secret/key, much like you suggest.
      - 4y ago
hamandcheese 4y ago
All I want is to be able to use Touch ID for services that only support Yubikey. At my workplace this means Duo - they have Touch ID support, but only in Chrome! In Safari or Firefox Touch ID is not an option which is very annoying. I would be very interested in a virtual Yubikey backed by Touch ID and the Secure Enclave.
- traceroute66 4y ago
  > I would be very interested in a virtual Yubikey backed by Touch ID and the Secure Enclave. Surely Apple have just answered your wishes with the introduction of Passkeys ?
  - hamandcheese 4y ago
    If it requires developer action to support, then no. I want Touch ID to mimic exactly a USB Yubikey so that it works even when developers have no interest in updating their software (I.e. Duo)
    - toomuchtodo 4y ago
      Dev action should be minimal. If the site supports hardware factors (Yubikey), it should support Passkey. https://news.ycombinator.com/item?id=31299230 https://news.ycombinator.com/item?id=31299230
askvictor 4y ago
Wouldn't this reduce security considerably, for the scenario where the computer is compromised?
- cmdli 4y ago
  Author here. The credentials are encrypted on-disk with a passphrase, so it wouldn't be trivial extract them, but yes it would be somewhat less secure than a hardware device. I would consider it similar in security to a local password manager. (Note: this software is in beta so I wouldn't yet use it for significant security operations) Personally, part of the motivation for creating this was to find a middle ground between the most-secure hardware keys and the least-secure password options for authentication. I would argue that requiring users to have hardware is one of the main reasons we only see YubiKeys as a second factor, even though they benefits outside of being based in hardware (namely the lack of phishable passwords).
  - pabs3 4y ago
    I hear that Apple is creating "passkeys" which are essentially what you have created; FIDO/WebAuthN that is implemented in software and are even syncable into the cloud.
- jabbany 4y ago
  If the computer is compromised you're screwed either way. Even though WebAuthN can't be easily MITM'd like TOTP codes, someone compromising your computer could just use the UI to lie to you. I think the main reduction in security is just that the virtual 2FA device is "cloneable" vs a hardware FIDO2 token where IIRC you can't extract the internal secret. So you're getting TOTP levels of 2FA (which also uses a cloneable initialization secret) thru a FIDO2-ish UX which seems like a reasonable thing to want.
  - mjg59 4y ago
    They could, but it's still limiting - the maximum number of challenges the attacker is able to satisfy is the number of times you touch the token before you realise that something's up.
crazysim 4y ago
I'm guessing this won't work for sites where a real device is mandated. I believe on Vanguard, they were enforcing only permitting real Yubikey devices with real Yubikey certificates.
- psanford 4y ago
  Vanguard changed their policy when they switched from the u2f javascript api/shim to webauthn. I was able to register non-fido keys with vanguard a few months ago.
- Lucent 4y ago
  They'll also accept Android phones via Bluetooth. More importantly, adding two keys lets you disable SMS codes.
ivanhoe 4y ago
This sort of defeats the idea of 2FA, doesn't it? If it's implemented as a software service on the same device, it's (well theoretically at least) hackable at the same time as the device itself. The 2 factors from 2FA are both accessible to an attacker at the same time, so you effectively have just a single factor auth.
- gruez 4y ago
  It does, but there's actually a way to do this (ie. u2f without having to buy another device) in a safe way, by using the TPM available on most computers: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido
  - cube2222 4y ago
    This is actually built-in to Safari on newer Macs.
  - mjg59 4y ago
    Unfortunately without additional hardware support it's hard to tie TPM FIDO to physical user presence, which means compromising the system doesn't give you access to the secrets but does let you sign as many challenges as you want without user involvement.
    - gruez 4y ago
      Realistically speaking if your machine is compromised it's effectively game over. If you're signing into services on a daily basis an attacker wouldn't have to wait long to piggy back off a legitimate request. The chances that you catch the compromise before that happens is slim.
      - alrlroipsp 4y ago
        Exactly. This is why 2FA is being discussed, and this software breaking 2FA.
  - 4y ago
psanford 4y ago
Nice! I'm the author of tpm-fido[1] which is similar to this but with some different goals. It looks like you've implemented ctap2, which has been on my todo list for tpm-fido (we currently use the ctap1 which works fine but doesn't support newer features used for passkeys/passwordless logins). Great to see other independent implementations! The question is often asked: isn't this less secure than a physical key or touch-id? The answer is yes, but only marginally. If you have no other access to a FIDO authenticator, using a soft authenticator will still be much better than using SMS,TOTP, or Push. Phishing is the most likely way 2fa will fail you, and this is still phishing resistant. But passkeys are real and you can essentially use them today! The Android/Chrome integration is already quite good. The Chrome/iOS interaction works but is less smooth right now. That's going to get worked out quite quickly so if you have the option to use passkeys you should! [1]: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido
pabs3 4y ago
Why not use the Linux USB gadget stuff, instead of USB over IP? With the dummy_hcd Linux kernel module you can attach virtual gadgets locally. I guess you still need USB/IP for Windows though. https://www.collabora.com/news-and-blog/blog/2019/06/24/using-dummy-hcd/ https://www.collabora.com/news-and-blog/blog/2019/06/24/usin...
pabs3 4y ago
Anyone know if there is a way to do WebAuthN without loading JavaScript from the website? Perhaps a Web Extension that reimplements the login requests for every website that uses WebAuthN will be needed, since there isn't any standard protocol for WebAuthN login between the browser and website, just whatever the website implements in JavaScript.
jrm4 4y ago
So, curious. Anyone here do what I do, a simple encrypted Linux volume + "oathtool" powered script? Yeah, I know, same device, blah blah. I'm still pretty comfortable with it and I just don't like having this stuff on my phone, which perpetually feels less safe.
- pabs3 4y ago
  I do something similar with pass, pass-otp and browserpass. Looking forward to using virtual-fido because I do not want non-free hardware keys. https://github.com/browserpass/ https://github.com/browserpass/ https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp https://www.passwordstore.org/ https://www.passwordstore.org/
  - computerfriend 4y ago
    Are you familiar with https://solokeys.com/ https://solokeys.com/?
    - pabs3 4y ago
      I don't remember the details but some aspect of their behavior turned me off them. I'm also not sure I want a physical device at all.
  - jrm4 4y ago
    Whoa. I'd never dived into the whole hardware key thing because I never felt like I needed it -- except one (AND ONLY ONE) of my 2FA deals requires a specific app (i.e. they won't give you your generating token, you have to use Duo Mobile or a device). As I'm seeing it, "virtual-fido" will let me fake a hardware device and get me so that I only need the laptop for 2FA? Gotta look into this.
    - pabs3 4y ago
      Right. virtual-fido is similar to Apple Passkeys in that respect.
pabs3 4y ago
Hmm, I have never seen .exe files in git before. Shouldn't you check in the source for them instead?
d0ublespeak 4y ago
I think this is really cool and a smart way to approach this problem. That being said, the physical isolation of the YubiKey is what makes it useful. Having to physically press a button is the real isolating factor, the interaction is physical and not determined by a piece of software.
- lazka 4y ago
  Imo that it's not phishable and that there is no secret on the target server is even more useful in practice. And both those properties don't require physical isolation.
  - kevincox 4y ago
    To nitpick: s/there is no secret on the target server/the target server never sees the secret/ With proper password storage the target server never keeps the password. It course that is difficult to verify. With U2F the secret can't store a secret they can't see.
talkingtab 4y ago
This is my problem with fido/yubikey's and WebAuthN, etc. Somehow Fido and Yubikey have become intermixed and conflated. Like kleenex - one brand of facial tissue has become the common name for something that is or should be a commodity product. The top picks for me when I search for "yubikey" on amazon are all ~$55 USD. When I search for "fido2" the top picks are ~$24 USD. This article is about Yubikeys. Or is it. The project itself is "virtual-fido". I am sure that it is in Yubico's best interest to promote Yubikeys. And for the enterprise this is probably good. But in my opinion it is a barrier to the adoption of fido. Which is unfortunate. I wonder if there is a way to use an iPhone or Android as a Yubikey. Oops, I mean Fido device. Anyone have an idea of how to do that? It seems like getting this to run on an Android would be significantly more functional (no extra device) and cheaper.
- sbdncuvh 4y ago
  You could start by saying smartphone, but that was probably intentional.
  - rzzzt 4y ago
    Robocop is an Android, and the spike extending from his knuckle was used in the film as an authentication device.
- UncleEntity 4y ago
  > It seems like getting this to run on an Android would be significantly more functional (no extra device) and cheaper. That’s basically Google Authenticator. Didn’t RTFA as I know the algorithm is just one line of python using built-in libraries (which is how I generate passwords minus the time-based part).
  - azornathogron 4y ago
    > Didn’t RTFA as I know the algorithm is just one line of python using built-in libraries Time-based OTP (TOTP), which is what Google Authenticator implements, is not the same as FIDO U2F. They use different underlying mechanisms and have different security properties. TOTP relies on a shared secret key to generate a matching code on client & server. FIDO U2F uses a challenge-response protocol and incorporates the domain of the requesting website (the domain as verified by TLS certificate) into the challenge to ensure that the response is _only_ valid when it was requested directly from the correct website. This prevents phishing attacks, which TOTP does not.
alberth 4y ago
Dumb question … why can’t FaceID on my iPhone be used for 2fa/webauthn/fido2? Or is that “PassKeys”?
- jeroenhd 4y ago
  On iPhones and TouchID capable devices this has been available for quite some time now. I don't know how much work setting this stuff up is, but AFAIK FIDO2 is already available on-device. Using an external device for FIDO2 authentication is something I can't add much about. The FIDO2 standard should allow for this and Apple and Google are working to make such a mechanism available if I recall, they made a whole PR thing out of their FIDO2 support a month or two ago. There are apps that can do this as well though I don't know any specific ones for the Apple side of things.
waynesonfire 4y ago
anyone know which protocols specifications were relevant to this project? more specifically, which ones does it implement? Is this stack fully specified?
kenshaw 4y ago
Thanks, appreciate the package. I submitted a PR as I was also looking for a Go package similar to this, and wanted to make using this as a library a bit easier. I plan on using this to automate some website login/authentication flows, where physical tokens are (for obvious reasons) not really a possibility.
1970-01-01 4y ago
The entire point of something you have is that it's physical and can't be copied. This isn't something you have, it's something you know with multiple layers of obscurity on top of it.
mandrizzle 4y ago
Apple, Microsoft, and Android support passkeys. They seem like a much better solution yubi keys

166 points by cmdli 4y ago

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen of any of my devices either. Edit: There is a way to use a Yubikey to decrypt Linux full-disk encryption. It relies on an abandoned personal GitHub project. Sounds fun, but not sufficiently secure it's worth spending more than $100 to allegedly improve my security with it.

warent 4y ago
I think a huge benefit of 2fa, one of the main purposes of it, was for securing accounts with weak passwords. Back in the days before password managers etc. I think these days password managers actually deprecate the need for 2fa
- TrueGeek 4y ago
  Every now and then you hear about a leak at some company that was storing passwords in clear text. Thanks to password managers this only affects that one site, but it still makes me thankful for 2FA.
  - iudqnolq 4y ago
    I don't understand the threat model there. Wouldn't nearly all hacks that lead to plain text passwords also allow the hacker to access all the login-protected data, making a more secure login process pointless?
    - bb88 4y ago
      Not necessarily. It's common practice for a hacker to break into a site, grab the passwords, then sell them or release them on the dark web. The methods they used to break into the site are often considered "trade secrets".
- askvictor 4y ago
  Multiple layers are always better. If your computer or browser is compromised, then your password manager's secrets have been pwned, but with 2FA your accounts are still safe (assuming the 2FA is on a separate device, which it really should be) There's also non-tech users to consider. It's pretty hard to convince users to use a password manager; plenty of people still re-use the same password across sites. It's impossible to prevent that. But it is possible to enforce 2FA for _your_ site.
  - iudqnolq 4y ago
    Your first example is interesting, but it's much more limited than you describe. The attacker can't use your credentials to authenticate their own session, but they have complete control over the authenticated session on your laptop. I can't think of an account I have where that would be meaningfully less bad.
    - askvictor 4y ago
      The attacker has access to all of your authenticated sessions on your compromised laptop. They don't have access to any un-authenticated accounts which have 2FA enabled.
      - bb88 4y ago
        Further because 2FA is simpler, a session can time out in a shorter amount of time.
- dilyevsky 4y ago
  Wrong - mfa is to prevent credentials stuffing mostly
- bb88 4y ago
  Passwords are an antipattern. Password managers are just a crutch to make it less painful. Password recovery is often done through the phone via SMS (health care/banking) when a 2FA hardware key would be safer. And since you're implementing 2FA, just remove the password, and ask the user to use the 2FA key.
  - smeej 4y ago
    I think my favorite example of using SMS in the least sane way possible is PayPal. I have a hardware key AND an authenticator app active for the account, but they STILL won't let me send transactions without entering a code sent to my phone number. And actually, not even then, because even though I receive the code fine, they say they can't authenticate me and don't give me a chance to enter it. Yes, it's a VOIP number, but it's been the same VOIP number for the 10 years I've had the account. It's not like it's new.
    - bb88 4y ago
      I needed to recover my user account / password through Voya recently for a corporate 401k. They needed to send me 3(!) SMS messages in the process. One to get the username (with a valid email address). One more to request to change the password. And one more to actually change the password.
ivanhoe 4y ago
Can you define what do you mean by sufficient support?
- iudqnolq 4y ago
  Sure: Enough support so that my life becomes sufficiently easier or more secure to be worth the cost. I know that's a bit wishy-washy, but for example I think I could replace my memorized 1password password with something longer if I never had to enter it from memory, which would only be the case if I could use the Yubikey on all my devices.
  - akerl_ 4y ago
    I use a yubikey with x509 cert and PIN for local auth to my Mac, and I use it for FIDO2 MFA everywhere that supports it, which includes my email account. That makes my email credentials radically more resistant to phishing, which is huge given that email is part of the recovery story for every other account. If those aren’t enough, I guess yubikeys aren’t the right call for your threat model, which is fine.
    - iudqnolq 4y ago
      I'd love to have that setup. The only problem is insufficiently mature support for the devices I use, Linux and Android. As I mentioned in an edit Yubikey local auth on Linux relies on a personal GitHub project abandoned years ago.
      - jklfhfyhjlo 4y ago
        Bah, everything the GP described works perfectly in Linux. Yubikey local auth isn't just one Yubikey specific project. The Yubikey implements a fuckload of open protocols, the vast majority of which work perfectly in Linux. Want local authentication? pam_u2f, pam_gpg, pam_x509 are all maintained.
      - akerl_ 4y ago
        The other person who replied to this seems to have gotten up on the wrong side of the bed, but the core of their suggestion is one I’d likewise recommend. I’m doing the yubikey local auth using the yubikey’s PIV applet, which holds standard x509 certs that can be used via pkcs11. You should be able to set up PAM to use them in that way, without needing any yubikey-specific hijinks. Something like https://discourse.ubuntu.com/t/smart-card-authentication/26009 https://discourse.ubuntu.com/t/smart-card-authentication/260...
hamandcheese 4y ago
> No 2fa device has sufficient support that it could be used to unlock the lockscreen of any of my devices either. Remember, 2fa is your second factor. It’s right there in the acronym. It is there to protect against a bad actor stealing your password. By definition, a second factor won’t improve the ergonomics of logging in.
- iudqnolq 4y ago
  Not quite. A second factor would allow me to reduce the complexity of my password while retaining the same level of security. Without that the only benefit of a Yubikey over a strong password saved in a password manager is phishing protection, which I'm not willing to pay that amount of money for.
  - hamandcheese 4y ago
    Not just phishing - you could lose your password via malware, or if services store passwords in clear text and get hacked.
    - iudqnolq 4y ago
      I use different passwords for every service. Malware on a device where I'm logged into the service can use that authenticated session to access all the things I want protected. If the service is hacked, the hacker probably has direct access to everything the password was protecting.
      - hamandcheese 4y ago
        > Malware on a device where I'm logged into the service can use that authenticated session to access all the things I want protected. Any well-secured service should protect critical actions with 2fa. “oh, are you sure you want to transfer all your funds? Please re-authenticate first”
        snadal 4y ago
traceroute66 4y ago
> I can't figure out why I'd want a Yubikey. Do you use SSH ? Yubikeys are a fabulous way to store SSH keys. Also bear in mind that aside from a secure storage mechanism, Yubkeys can also be configured to require pin and/or touch. Therefore no matter what gets onto your computer, the Yubikey won't provide the answer unless touched.
- iudqnolq 4y ago
  > Do you use SSH Yes, but not for anything where keeping the SSH private key more secure than my AWS/DigitalOcean credentials would be useful. And I store those credentials in 1Password, which doesn't have a sufficiently mature integration with Yubikey on Linux or Android.
  - LelouBil 4y ago
    Use Bitwarden, it's a great password manager and it works with yubikey. You can also self host it fully.
wyager 4y ago
I use it for github, cloudflare, login.gov, etc.
themagician 4y ago
I love the Yubikey even if it only locks down a few important accounts. For me, that's Google Accounts and Microsoft Accounts. These are the accounts I worry about this most because they are linked to so many other things. I wish 1Password offered a high security, security key ONLY mode.
- waynesonfire 4y ago
  I agree, I wish 1password had more native yubikey support.
nick__m 4y ago
I use 1Password and 2 Yubikey. Both yubikeys are configured to enter the same impossible to memorize password on a press to unlock 1Password, hid mode is supported by every device with a USB ports. I also use them as an otp second factor when a site requires it. Finally, they are configured with a x509 certificate that I use as my ssh keys. I generate one key per devices that way the secret never leaves it and I require a pin to unlock the key. For convenience, I use an ssh agent to cache the pin I could also use them for pgp signature and encryption but I have no use case for that.
- taubek 4y ago
  How do you configure Yubikey to enter password for unlocking 1password? Is this a Yubikey feature or 1password feature? Does this also work with mobile devices (phones)?
  - loulouxiv 4y ago
    That is the hid mode parent is mentionning. With ykman you can configure the Yubikey to simulate being a USB keyboard (Human Interface Device) and then "type" a static password. The default setting is to type a Yubico specific OTP that can be checked by calling an API. The issue with the static password is that anybody getting near the yubikey with a device having a USB port can steal the password in seconds.
    - taubek 4y ago
      Thank you for explanation! I wasn't aware of this feature.
    - sig-io 4y ago
      And any accidental button-press while in a chat-app or website will leak your password. I've seen many yubikey otp's accidentally pasted into irc, if you set it to password, you just posted that. I'd never recommend using that mode.
      - 4y ago
Ferret7446 4y ago
Your phrasing is odd. 2FA devices do not support websites. Websites support 2FA options. The problem isn't 2FA devices, but services not supporting 2FA. U2F/FIDO are standard at this point and many tech-related services support them; certainly, effectively all 2FA devices support them. 2FA is redundant for unlocking physical devices. Access to the device itself is already a second factor. The point of 2FA is that someone MUST physically take something from you to gain access, which greatly limits attack vectors. If you use 2FA properly, the only thing you need to worry about for account security is whether you still have your 2FA key on you.
5d8767c68926 4y ago
The thing that trips me up is the ability to make backups in the event it is lost/stolen. Seemingly not all services allow registering an additional key, and even if they do, the practicalities of juggling redundant fobs would be cumbersome.
- Semaphor 4y ago
  > Seemingly not all services allow registering an additional key I’ve only ever encountered that braindead design with AWS, every other place allows multiple keys. And I can’t say I find multiple keys cumbersome, it’s simply the same procedure again: Click add, insert key and tap the button. Just twice instead of once.
  - 5d8767c68926 4y ago
    Specifically, I want a backup key off-site. Anytime I enroll a new service, I need to retrieve my backup key from storage for the purposes of enrolling. Depending on how/where the backup is stored (bank box, parent's house across the country, etc) that would make the system less workable in practice.
vertis 4y ago
I've found the Yubikey to be an incredibly easy way to do 2FA. I use a usb-c nano version and it pretty much never leaves my mac (and the mac never leaves me). I've found it faster to do 2FA on a large number of tech websites. Just touch the key and you're done. I know 1Password can fill TOTP for you, but I like having my security spread across 1Password and Yubikey. In the unlikely event 1Password gets compromised they still need physical access to my computer. I don't log onto the mac with Yubikey and it has full-disk encryption turned on, so I'm pretty happy with the attack surface.
ranguna 4y ago
> There is a way to use a Yubikey to decrypt Linux full-disk encryption. It relies on an abandoned personal GitHub project Abandoned? You do know luks supports FIDO, right? Here's a small guide on how to do it: https://prose.bentopais.pt/setting-up-trezor-on-arch#luks-unlock https://prose.bentopais.pt/setting-up-trezor-on-arch#luks-un... You'll also find how to use your key to login to the tty, authenticate to sudo commands and much more.
deleted 4y ago
[deleted]
xani_ 4y ago
You can use Yubikeys(most of them, the cheapest ones don't have that feature IIRC) as smartcards in addition to other features. You can use smartcard in linux as both GPG key, and SSH key (via GPG SSH agent). Which means leaking your private key for SSH is essentially impossible, as key can be generated on device which means it never leaves it, even if your machine gets compromised
waynesonfire 4y ago
I use it to store my gpg keys among other use-cases. The key provides a permanence and isolation. I can't accidentally delete it without trying and the button needs to be pressed to access the key. I like these trait.

lddemi 4y ago

Fun demo but who is this really for? Is there a requirement for these devices anywhere aside from corporate security?

cmdli 4y ago
Personally, I prefer the "approval" process of YubiKey/U2F devices over having to enter a code, but I also dislike having to have a hardware device on me at all times. Also, with WebAuthN and passwordless login, YubiKeys are now able to be used to authenticate people, so I figure it would be nice to have a software solution for that. Granted, this is still just a demo, so it's a long way off from something somebody would regularly use.
altairprime 4y ago
This is primarily of use to people who want to disregard hardware authenticator requirements imposed by third parties without their consent.
- postalrat 4y ago
  Jeez. That's almost as bad as requiring a password!
MrStonedOne 4y ago
dspillett 4y ago
> Fun demo but who is this really for? Would being able to create virtual devices like this be more useful for testing authentication flows, compared to having physical test devices?
- convolvatron 4y ago
  this might help w/ adoption. it would be _really nice_ to use FIDO, but I don't want to restrict my usability to people willing to carry a key around. as a compromise I think having a weaker key is better than having paths where pki is disabled

stavros 4y ago

This is fantastic. Did you make this, cmdii? Why does it need to persist files locally? I thought that all that's necessary is the key. Is it for resident keys? I'd like a virtual FIDO2 device where I have to type a password/passphrase when I launch it, and it derives a FIDO2 key from the passphrase. That way, I can have my 2FA device with me in my head, and still get all the anti-phishing benefits of WebAuthn. Certainly, it's much easier for the passphrase to be stolen/keylogged, but it's a nice option to have.

cmdli 4y ago
Yup, I built this. The file storage is only for the FIDO2/WebAuthN device, which generates large private keys for each credential; the U2F device keys are small enough that they are actually encrypted/stored in the key identifier that is passed in by the client. I’m currently working on trying to expand this out with new features, as most of the work here was actually emulating the USB device which involved a lot of different layers of protocols.
- stavros 4y ago
  Very nice work! This is one step closer to a password manager that doesn't actually need to store any passwords, just one key. I'm not very familiar with FIDO2, but I thought the private keys for each credential were derived from the single key in the device and the website's domain? Is that not the case? Or are you just generating separate credentials per site and keeping those? If the latter, couldn't you derive all credentials from a single source of randomness and skip the storage?
  - cmdli 4y ago
    Each credential has its own private key which is signed by the device's private key for certification. I am uncertain if the FIDO2 spec says how those private keys need to be generated; right now they are generated randomly but they could easily be generated from a single secret/key, much like you suggest.
    - 4y ago

hamandcheese 4y ago

All I want is to be able to use Touch ID for services that only support Yubikey. At my workplace this means Duo - they have Touch ID support, but only in Chrome! In Safari or Firefox Touch ID is not an option which is very annoying. I would be very interested in a virtual Yubikey backed by Touch ID and the Secure Enclave.

traceroute66 4y ago
> I would be very interested in a virtual Yubikey backed by Touch ID and the Secure Enclave. Surely Apple have just answered your wishes with the introduction of Passkeys ?
- hamandcheese 4y ago
  If it requires developer action to support, then no. I want Touch ID to mimic exactly a USB Yubikey so that it works even when developers have no interest in updating their software (I.e. Duo)
  - toomuchtodo 4y ago
    Dev action should be minimal. If the site supports hardware factors (Yubikey), it should support Passkey. https://news.ycombinator.com/item?id=31299230 https://news.ycombinator.com/item?id=31299230

askvictor 4y ago

Wouldn't this reduce security considerably, for the scenario where the computer is compromised?

cmdli 4y ago
Author here. The credentials are encrypted on-disk with a passphrase, so it wouldn't be trivial extract them, but yes it would be somewhat less secure than a hardware device. I would consider it similar in security to a local password manager. (Note: this software is in beta so I wouldn't yet use it for significant security operations) Personally, part of the motivation for creating this was to find a middle ground between the most-secure hardware keys and the least-secure password options for authentication. I would argue that requiring users to have hardware is one of the main reasons we only see YubiKeys as a second factor, even though they benefits outside of being based in hardware (namely the lack of phishable passwords).
- pabs3 4y ago
  I hear that Apple is creating "passkeys" which are essentially what you have created; FIDO/WebAuthN that is implemented in software and are even syncable into the cloud.
jabbany 4y ago
If the computer is compromised you're screwed either way. Even though WebAuthN can't be easily MITM'd like TOTP codes, someone compromising your computer could just use the UI to lie to you. I think the main reduction in security is just that the virtual 2FA device is "cloneable" vs a hardware FIDO2 token where IIRC you can't extract the internal secret. So you're getting TOTP levels of 2FA (which also uses a cloneable initialization secret) thru a FIDO2-ish UX which seems like a reasonable thing to want.
- mjg59 4y ago
  They could, but it's still limiting - the maximum number of challenges the attacker is able to satisfy is the number of times you touch the token before you realise that something's up.

crazysim 4y ago

I'm guessing this won't work for sites where a real device is mandated. I believe on Vanguard, they were enforcing only permitting real Yubikey devices with real Yubikey certificates.

psanford 4y ago
Vanguard changed their policy when they switched from the u2f javascript api/shim to webauthn. I was able to register non-fido keys with vanguard a few months ago.
Lucent 4y ago
They'll also accept Android phones via Bluetooth. More importantly, adding two keys lets you disable SMS codes.

ivanhoe 4y ago

This sort of defeats the idea of 2FA, doesn't it? If it's implemented as a software service on the same device, it's (well theoretically at least) hackable at the same time as the device itself. The 2 factors from 2FA are both accessible to an attacker at the same time, so you effectively have just a single factor auth.

gruez 4y ago
It does, but there's actually a way to do this (ie. u2f without having to buy another device) in a safe way, by using the TPM available on most computers: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido
- cube2222 4y ago
  This is actually built-in to Safari on newer Macs.
- mjg59 4y ago
  Unfortunately without additional hardware support it's hard to tie TPM FIDO to physical user presence, which means compromising the system doesn't give you access to the secrets but does let you sign as many challenges as you want without user involvement.
  - gruez 4y ago
    Realistically speaking if your machine is compromised it's effectively game over. If you're signing into services on a daily basis an attacker wouldn't have to wait long to piggy back off a legitimate request. The chances that you catch the compromise before that happens is slim.
    - alrlroipsp 4y ago
      Exactly. This is why 2FA is being discussed, and this software breaking 2FA.
- 4y ago

psanford 4y ago

Nice! I'm the author of tpm-fido[1] which is similar to this but with some different goals. It looks like you've implemented ctap2, which has been on my todo list for tpm-fido (we currently use the ctap1 which works fine but doesn't support newer features used for passkeys/passwordless logins). Great to see other independent implementations! The question is often asked: isn't this less secure than a physical key or touch-id? The answer is yes, but only marginally. If you have no other access to a FIDO authenticator, using a soft authenticator will still be much better than using SMS,TOTP, or Push. Phishing is the most likely way 2fa will fail you, and this is still phishing resistant. But passkeys are real and you can essentially use them today! The Android/Chrome integration is already quite good. The Chrome/iOS interaction works but is less smooth right now. That's going to get worked out quite quickly so if you have the option to use passkeys you should! [1]: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido

pabs3 4y ago

Why not use the Linux USB gadget stuff, instead of USB over IP? With the dummy_hcd Linux kernel module you can attach virtual gadgets locally. I guess you still need USB/IP for Windows though. https://www.collabora.com/news-and-blog/blog/2019/06/24/using-dummy-hcd/ https://www.collabora.com/news-and-blog/blog/2019/06/24/usin...

pabs3 4y ago

Anyone know if there is a way to do WebAuthN without loading JavaScript from the website? Perhaps a Web Extension that reimplements the login requests for every website that uses WebAuthN will be needed, since there isn't any standard protocol for WebAuthN login between the browser and website, just whatever the website implements in JavaScript.

jrm4 4y ago

So, curious. Anyone here do what I do, a simple encrypted Linux volume + "oathtool" powered script? Yeah, I know, same device, blah blah. I'm still pretty comfortable with it and I just don't like having this stuff on my phone, which perpetually feels less safe.

pabs3 4y ago
I do something similar with pass, pass-otp and browserpass. Looking forward to using virtual-fido because I do not want non-free hardware keys. https://github.com/browserpass/ https://github.com/browserpass/ https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp https://www.passwordstore.org/ https://www.passwordstore.org/
- computerfriend 4y ago
  Are you familiar with https://solokeys.com/ https://solokeys.com/?
  - pabs3 4y ago
    I don't remember the details but some aspect of their behavior turned me off them. I'm also not sure I want a physical device at all.
- jrm4 4y ago
  Whoa. I'd never dived into the whole hardware key thing because I never felt like I needed it -- except one (AND ONLY ONE) of my 2FA deals requires a specific app (i.e. they won't give you your generating token, you have to use Duo Mobile or a device). As I'm seeing it, "virtual-fido" will let me fake a hardware device and get me so that I only need the laptop for 2FA? Gotta look into this.
  - pabs3 4y ago
    Right. virtual-fido is similar to Apple Passkeys in that respect.

pabs3 4y ago

Hmm, I have never seen .exe files in git before. Shouldn't you check in the source for them instead?

d0ublespeak 4y ago

I think this is really cool and a smart way to approach this problem. That being said, the physical isolation of the YubiKey is what makes it useful. Having to physically press a button is the real isolating factor, the interaction is physical and not determined by a piece of software.

lazka 4y ago
Imo that it's not phishable and that there is no secret on the target server is even more useful in practice. And both those properties don't require physical isolation.
- kevincox 4y ago
  To nitpick: s/there is no secret on the target server/the target server never sees the secret/ With proper password storage the target server never keeps the password. It course that is difficult to verify. With U2F the secret can't store a secret they can't see.

talkingtab 4y ago

This is my problem with fido/yubikey's and WebAuthN, etc. Somehow Fido and Yubikey have become intermixed and conflated. Like kleenex - one brand of facial tissue has become the common name for something that is or should be a commodity product. The top picks for me when I search for "yubikey" on amazon are all ~$55 USD. When I search for "fido2" the top picks are ~$24 USD. This article is about Yubikeys. Or is it. The project itself is "virtual-fido". I am sure that it is in Yubico's best interest to promote Yubikeys. And for the enterprise this is probably good. But in my opinion it is a barrier to the adoption of fido. Which is unfortunate. I wonder if there is a way to use an iPhone or Android as a Yubikey. Oops, I mean Fido device. Anyone have an idea of how to do that? It seems like getting this to run on an Android would be significantly more functional (no extra device) and cheaper.

sbdncuvh 4y ago
You could start by saying smartphone, but that was probably intentional.
- rzzzt 4y ago
  Robocop is an Android, and the spike extending from his knuckle was used in the film as an authentication device.
UncleEntity 4y ago
> It seems like getting this to run on an Android would be significantly more functional (no extra device) and cheaper. That’s basically Google Authenticator. Didn’t RTFA as I know the algorithm is just one line of python using built-in libraries (which is how I generate passwords minus the time-based part).
- azornathogron 4y ago
  > Didn’t RTFA as I know the algorithm is just one line of python using built-in libraries Time-based OTP (TOTP), which is what Google Authenticator implements, is not the same as FIDO U2F. They use different underlying mechanisms and have different security properties. TOTP relies on a shared secret key to generate a matching code on client & server. FIDO U2F uses a challenge-response protocol and incorporates the domain of the requesting website (the domain as verified by TLS certificate) into the challenge to ensure that the response is _only_ valid when it was requested directly from the correct website. This prevents phishing attacks, which TOTP does not.

alberth 4y ago

Dumb question … why can’t FaceID on my iPhone be used for 2fa/webauthn/fido2? Or is that “PassKeys”?

jeroenhd 4y ago
On iPhones and TouchID capable devices this has been available for quite some time now. I don't know how much work setting this stuff up is, but AFAIK FIDO2 is already available on-device. Using an external device for FIDO2 authentication is something I can't add much about. The FIDO2 standard should allow for this and Apple and Google are working to make such a mechanism available if I recall, they made a whole PR thing out of their FIDO2 support a month or two ago. There are apps that can do this as well though I don't know any specific ones for the Apple side of things.

waynesonfire 4y ago

anyone know which protocols specifications were relevant to this project? more specifically, which ones does it implement? Is this stack fully specified?

kenshaw 4y ago

Thanks, appreciate the package. I submitted a PR as I was also looking for a Go package similar to this, and wanted to make using this as a library a bit easier. I plan on using this to automate some website login/authentication flows, where physical tokens are (for obvious reasons) not really a possibility.

1970-01-01 4y ago

The entire point of something you have is that it's physical and can't be copied. This isn't something you have, it's something you know with multiple layers of obscurity on top of it.

mandrizzle 4y ago

Apple, Microsoft, and Android support passkeys. They seem like a much better solution yubi keys