12 ms·

About Security Keys for Apple ID

308 points by judge2020 4y ago

alden5 4y ago
I find the phrase "Lightning connectors work with most iPhone models." really strange as the latest incompatible iphone would be the iphone 5, is this them foreshadowing a usb-c iphone?
- alwillis 4y ago
  > is this them foreshadowing a usb-c iPhone? Apple confirmed that USB-C is coming to the iPhone last fall [1]. [1]: https://www.theverge.com/2022/10/26/23423977/iphone-usb-c-eu-law-joswiak-confirms-compliance-lightning https://www.theverge.com/2022/10/26/23423977/iphone-usb-c-eu...
  - zippergz 4y ago
    Pedantically, no they didn't. They said they'd comply with the law, and another way to do that would be to remove the charging port entirely. (To be clear, I do think they'll add USB-C. I am just frustrated by the press's ongoing willingness to take an ambiguous statement and turn it into an absolute certain outcome in a headline.)
    - InsomniacL 4y ago
      He was asked directly: "Is Apple moving to USB-C" If his response is "..obviously we will have to..." then I don't think it's unreasonable for the headline. If he was asked "Is Apple going to comply with EU Law" and his response was the same then I think it leaves room for interpretation, but we're humans, not computers. He was asked a question and he provided an answer to that question and the headline reflects what a reasonable person would infer. If that's not the case then I think that speaks more to his trustworthiness than that of the articles writer.
jtdressel 4y ago
This is excellent news. > At least two FIDO® Certified I'm glad to see that they not only support, but require the use of multiple keys. > iOS 16.3, iPadOS 16.3, or macOS Ventura 13.3, or later on all of the devices where you're signed in with your Apple ID. and > During set up, you're signed out of inactive devices, which are devices associated with your Apple ID that you haven't used or unlocked in more than 90 days. To sign back into these devices, update to compatible software and use a security key. If your device can't be updated to compatible software, you won't be able to sign back in. I'm not ready to set this up, since I still use a few Big Sur and Monterey machines.
- hrpnk 4y ago
  > If your device can't be updated to compatible software, you won't be able to sign back in. Unless there will be a warning when adding the keys, this can lead to many support requests they will get from users who did not read this part.
  - jackson1442 4y ago
    They've been pretty good about this in the past, with iCloud E2EE my phone refused to let me enable it without updating all associated devices.
    - Gigachad 4y ago
      How has this feature been working for you. It's apparently not available in my country but I'm looking forward to trying it.
      - jackson1442 4y ago
        Haven't noticed any difference except the process to access iCloud on the web is a little different, overall it works great across all my devices.
      - kevinbowman 4y ago
        It wasn't available in my country (UK) yesterday, but I just checked after updating to 16.3 and it now says I can enable it.
kitsunesoba 4y ago
Been waiting for this. Will be setting it up on App Store accounts soon. The only potential problem for turning this on for my personal account is that you can't sign into iCloud using Windows, which isn't a problem in itself (I have no need to sync my photos to my gaming tower), but if it means I also can't sign into my Apple account that would be more troublesome since I like to use Apple Music from my Windows boxes occasionally.
- selectodude 4y ago
  I’m under the impression that in a modern browser that supports FIDO, it should work fine.
- smileybarry 4y ago
  That iCloud for Windows bit is troubling, right now it’s just photo syncing but I’m not sure if it also affected iTunes, or the upcoming Apple TV+ and Music apps. (They all use the same iTunes auth library underneath)
  - WorldMaker 4y ago
    There's more than just photo syncing in iCloud for Windows. It's an iDevice backup sync. It can be used to sync files with any app that supports the Files app (and even some that don't but supported certain older app-specific file folders). It does some Apple Keychain syncing with Edge. It does some Contacts sync and backup. It can do some account recovery help if you don't have handy access to another iOS or macOS device but have been signed into iCloud for Windows for long enough.
    - smileybarry 4y ago
      > It's an iDevice backup sync. That's exclusively iTunes (or soon the Apple Devices Windows 11 app), if I remember correctly. > It can be used to sync files[...] Right, there's also iCloud Drive.
      - 4y ago
adav 4y ago
Isn’t it odd that Apple are not yet selling their own security keys?
- CaliforniaKarl 4y ago
  It doesn't seem odd to me.
- spike021 4y ago
  Wouldn't be surprised if they do at some point.
- threeseed 4y ago
  For 99% of the population the existing approach i.e. verifying on another Apple device is sufficient.
  - jeffbee 4y ago
    Or would be, if Apple devices did not routinely prompt you for your password. I find this incredibly annoying since my Apple ID uses one of those long, irregular passwords automatically generated by password managers and in the context where Apple wants your password there's no way to cut and paste it. I can use my phone with touch ID to authorize a $20k purchase but if I want to install a free app from the App Store I need my stupid password. I wonder why they do this.
    - zie 4y ago
      So people don't forget their password and as a liveness check.
      - jeffbee 4y ago
        If they insist on this, I think it would be nice if they rigged their backend to allow me to enter the password from any of my devices. They already allow this from the Apple TV+ app on smart TVs, so the technical precedent exists within Apple.
highwaylights 4y ago
So I’ve been thinking about this for a good long while now and I’m not really sure whether this increases the security of your account or not. On one hand, you can’t accidentally or absent-mindedly approve a request from someone else on your phone with a YubiKey. On the other hand, with device 2FA you generally need to be present (Face or Touch). If someone were to steal your yubikey then they’d be able to perform a step that previously you’d have needed to be there for. I’m guessing MFA (password + presence + YubiKey) is too much of a catastrophic lockout risk to be supported.
- kube-system 4y ago
  You could get the bio version of the Yubikey. Or some other FIDO2 key with biometrics.
- TacticalCoder 4y ago
  > If someone were to steal your yubikey then they’d be able to perform a step that previously you’d have needed to be there for. Several security keys are protected themselves with an additional factor. There are, for example, Yubikeys which are unlocked by your fingerprint: this now requires the thief to not only steal your Yubikey but also have the skills required to reproduce your fingerprint. There are also several U2F devices protected by a PIN. The "Only key" uses one PIN to register a service (which you do once per service) and another PIN to authenticate to the service (so you cannot easily be tricked into registering instead of authenticating). The Ledger Nano U2F app is also protected by a PIN and has its own little screen so it displays the name (or the identifier) of the service you're either registering or authenticating to (and tells you if you're actually going to register or authenticate), is protected by a HSM and factory resets itself after three wrong PIN. I'm using the later to SSH now (requires a moderately recent version of OpenSSH: latest Debian stable is sufficient for example).
  - jay-barronville 4y ago
    > this now requires the thief to not only steal your Yubikey but also have the skills required to reproduce your fingerprint. Or the thief can “steal” a couple of your fingers too and have unlimited access to your fingerprints. Oh, wait, is that just a movie thing?
deleted 4y ago
[deleted]
jkaplowitz 4y ago
This is mostly good news, but would best be coupled with a promise to add security key support to iCloud for Windows. Over the long term, iCloud users shouldn't have to choose between good security, on the one hand, and keeping the cross-platform support they may already rely on and which may even justify their choice to buy a paid iCloud subscription, on the other.
- brewdad 4y ago
  Agreed. I've moved to iOS devices for my phone and tablet but am still on Windows for the foreseeable future. I might make the move to Mac with my next laptop refresh but I expect that to be at least 2 years away. I'm an iCloud subscriber but can't utilize this upgrade until then.
irusensei 4y ago
I have a single yubikey so I'm not setting up this. I do use the yubikey but keep 2FA recovery codes from most services. I do however have an unused Ledger X laying around. Does anyone knows if the Ledger X could act as a security key? Thanks in advance.
- TacticalCoder 4y ago
  > I do however have an unused Ledger X laying around. Does anyone knows if the Ledger X could act as a security key? Thanks in advance. I don't have a X but I've got a S which I only use for U2F (well, webauthn now really). Chrome deprecated and now removed U2F support so moving forward it's webauthn but U2F devices are compatible with webauthn. So yes it works. I use it to log on to several services and I use to log on using SSH. Anyway here's a video showing how it works on a X: https://support.ledger.com/hc/en-us/articles/115005198545-FIDO-U2F?docs=true https://support.ledger.com/hc/en-us/articles/115005198545-FI... Now I don't know if it specifically work for this new AppleID "dual security keys" thing.
  - lxgr 4y ago
    Unlike most WebAuthN services, Apple requires FIDO-certified keys. Are you sure the Ledger is?
- lxgr 4y ago
  Probably not, given that Apple requires a FIDO-certified key, and the Ledger almost certainly isn't.
- gst 4y ago
  Didn't work for me with the Ledger Nano X. Screen prompts for confirmation to register the key for a fraction of a second (on the Nano X), then goes back to the main screen, then back to confirmation (in a loop). I tried to confirm the "registration" screen during the brief time where it showed but wasn't successful.
2OEH8eoCRo0 4y ago
> You can't sign in to iCloud for Windows. Of course not
- deleted 4y ago
  [deleted]
- filmgirlcw 4y ago
  Yeah, this is disappointing. Especially since Windows, more broadly, has more robust smart card and security key support. And Edge/Chrome both support FIDO2/WebAuthn and there is a great iCloud password manager extension for Windows browsers (but not for non-Safari browsers on iOS)
wrldos 4y ago
What happens if you lose your Yubikey? Are there scratch codes? It's bad enough now if your house burns down with all your iOS devices in it.
- Philip-J-Fry 4y ago
  It's recommended to always have a backup key stored in a safe location for this reason. The article actually says so: >At least two FIDO® Certified* security keys that work with the Apple devices that you use on a regular basis. >You must add and maintain at least two security keys. You can add up to six keys.
  - wrldos 4y ago
    Ahha I missed the "at least two" part. I can get behind that no problems at all. Now all I need is a USB-C hole in my iPhone... Edit: ok they come in NFC as well. There goes €100...
    - lxgr 4y ago
      > There goes €100... If cost is a concern, you're buying the wrong keys. You can get FIDO-certified CTAP2 tokens for much less these days (even Yubico's is only about €25 apiece).
      - wrldos 4y ago
        Cost is not a concern.
- kube-system 4y ago
  You use your backup key, that you must have. Apple won’t let you use this with a single key.
  - TylerE 4y ago
    And if the backup key is lost? Most safes aren’t really THAT fireproof
bluSCALE4 4y ago
Curious, I am somewhat paranoid about leaving me keys or wallet in my jacket at a gym but if I had a security key, I'd be pretty terrified. Does having a key mean you still need a password since it's 2 factor? If you lose a key, do you need a backup master password like using auth apps?
- rodgerd 4y ago
  > If you lose a key, do you need a backup master password like using auth apps? Yes. If you only have one key enrolled and no other recovery mechanism, you're now locked out forever. That's why Apple are pushing you to have two keys as a minimum.
- deleted 4y ago
  [deleted]
- nerdbert 4y ago
  When you log in to your account you have to provide your password and also use the key. You can choose a key that has an additional factor built in, such as a fingerprint reader. If you lose one of the keys you can authorize a new one. If you lose both of the keys and all the Apple devices that you can log into directly, e.g. with fingerprint sensor on a Mac, then you're SOL.
- Krisjohn 4y ago
  Get a pouch for your water bottle that has a pocket for your keys.
- arianvanp 4y ago
  Correct. Apple will prompt you to create a recovery key or assign a "Recovery contact" before you can enable support
daviesgeek 4y ago
I do wish they’d add better support for the mac with a key. I know it’s a little separate, but I’d really like to lock down my max with my yubikey(s).
- mynameisvlad 4y ago
  Can't you sign in using the smart card part? https://support.yubico.com/hc/en-us/articles/360016649059-Using-Your-YubiKey-as-a-Smart-Card-in-macOS https://support.yubico.com/hc/en-us/articles/360016649059-Us...
  - daviesgeek 4y ago
    You can but it’s key + pin OR password, not key + pin + password. I’ve tried a bunch of different setup configurations and can’t get it to work as a true 2FA like it should. I did get it set up correctly at some point but an OS upgrade wiped the settings. I’ll have to try it again, but the path for setup isn’t as easy as it seems.
    - mynameisvlad 4y ago
      You might be able to using PAM. Something to look into, hopefully you can still use these guides with the latest macOS: https://developers.yubico.com/yubico-pam/MacOS_X_Challenge-Response.html https://developers.yubico.com/yubico-pam/MacOS_X_Challenge-R...
      - daviesgeek 4y ago
        Ok I’ll check it out!
deleted 4y ago
[deleted]
filmgirlcw 4y ago
I wish thus would work for password prompts for macOS on machines that aren’t able to use a fingerprint sensor, like my 2020 Intel iMac. I know I should upgrade that to a new M2 Max or something (I have two M1 Max notebooks), but the GPU and 128GB of RAM I have on the iMac, not to me than the fact that it runs Docker and VMs better, really keeps me from phasing it out. But although the Apple Watch is a decent compromise, I really wish I could use my YubiKey for admin passwords or for login stuff.
- dblitt 4y ago
  You can use the PIV functionality of a yubikey to act as a smartcard, and you can log in and sudo authenticate with the yubikey and a PIN. https://support.yubico.com/hc/en-us/articles/360016649059-Using-Your-YubiKey-as-a-Smart-Card-in-macOS https://support.yubico.com/hc/en-us/articles/360016649059-Us...
  - filmgirlcw 4y ago
    Oh awesome, thanks! Not sure if this would be any faster then just typing the password, but thanks!
    - lxgr 4y ago
      One advantage is that a PIV PIN can be much shorter than a password and still be secure (because the smart card/Yubikey enforces attempt limiting in secure hardware).
vlmutolo 4y ago
> What's required for Security Keys for Apple ID > A modern web browser. If you can't use your security key to sign in on the web, update your browser to the latest version or try another browser. It doesn't seem like Firefox 108 supports this. Does anyone know if Firefox beta or nightly work to sign into iCloud with hardware security keys for 2FA? --- Just confirmed that Firefox beta (109) doesn't support iCloud's sign in, either.
- Krisjohn 4y ago
  That's odd, because I can sign into (on-prem) Confluence with my Yubikey (5 NFC) as the MFA via Firefox. I get a little Windows "tap your key" prompt and everything.
  - arianvanp 4y ago
    Firefox supports U2F. Webauthn is backwards-compatible with U2F. However as a website you can choose whether you want to actually support U2F or only FIDO2. Maybe Apple opted to not do it. However when I look at the JS code in appleid.apple.com there does seem to be code for U2F code surprisingly.
- lxgr 4y ago
  Firefox on macOS unfortunately has very poor WebAuthN support, in my experience. It only supports legacy U2F keys/mode, as far as I know, and Apple seems to require CTAP2.
- arianvanp 4y ago
  Firefox team simply has been refusing to implement the Webauthn spec for years now. It's extremely frustrating and is probably still years away as nobody seems to be actively working on it in any capacity.
girvo 4y ago
This is awesome news! My YubiKey keeps becoming more and more useful over time, it's excellent. Yubi Authenticator giving me TOTP has been lovely (I have two keys that I always add the codes to each, one kept safe the other used regularly), and now more and more support for FIDO/U2F etc. across all my important accounts. Apple ID was one of the last hold outs, this is so good
philip1209 4y ago
I'm hesitant to rely on security keys after two of my Yubikey 5cs broke in the same month after ~3 years of ownership. Do we understand the lifetimes and and stability of these devices? I think hardware security make a ton of sense for an enterprise environment, where you can go to IT and prove your identity to regain access. But, for something like Apple or Google - I'm sure the recovery process is not as easy. For a hardware crypto wallets, people go to extremes - safety deposit boxes, fire-proof recovery phrases, etc. But, for me - losing access to my core online accounts would be more destabilizing than losing money on a hardware wallet. Yet, we don't have the ultra-reliable backup methods in place for web auth like we do for crypto wallets.
- themagician 4y ago
  The security key here isn’t used for every login. So if you were to lose both it’s not like your account is completely disabled and all data lost. I think you can even use still use your Recovery Code. The Security Key here primarily replaces the 2FA authentication method for adding new devices to your account. From Apple’s own documentation: When you use Security Keys for Apple ID, you need a trusted device or a security key to: - Sign in with your Apple ID on a new device or on the web - Reset your Apple ID password or unlock your Apple ID - Add additional security keys or remove a security key I believe if you lose both you can still add another as long as you have access to a device that’s still logged in. The biggest hole in Apple’s security model, and one which has been documented to have been exploited many times, is people using phishing tactics to get the 6-digit 2FA code to gain iCloud access, adding a new device, then downloading the unencrypted backup from the victims primary device from iCloud. Security Keys and E2EE now make this impossible.
- hellodanylo 4y ago
  > I'm sure the recovery process is not as easy. A lot of services offer one-time backup codes and connecting multiple 2FA devices. Making Yubikey a single point of failure is certainly a bad idea.
- hnbear 4y ago
  I deployed 1000+ over 3+ years, and never had one break. It’s anecdata and I believe they can fail, but we never saw it once. Using the A and C nanos. Helped they were permanently in machines though. No mechanical risk.
sega_sai 4y ago
Am I the only one who feels lost in all those new security technologies and their various permutations, specifically understanding what's secure, how to back it up etc? We have TOTP, 2nd factor, password managers, security keys, hardware security keys, passkeys, windows hello etc/etc..
- Krisjohn 4y ago
  It's not just you. Usernames and passwords are easy, if insecure. Type username, type password, done. Get admin to reset password if you forget. Put in password manager if one account is used by a team. Security keys are hard. Needing a physical key around every time you have to log into something is annoying. Backups are hard, because off-site backups can't be done over the Internet. Self-service hardware tokens for services with infamously bad customer service is highly risky. Resetting an account if a key is lost or locked requires physically transferring hardware, which can be hard if someone is traveling, or can cause days of downtime. Team access is basically impossible if an account is secured with a physical key. Authenticators are fine, except if you lose a couple of smartphones too close together, or you need a team to access one account. Password managers that let you securely store the QR code, or actually generate the key put the MFA in the same place as the rest of the credentials, which is not ideal but increasingly necessary for the same reason password managers came into existence in the first place. Windows Hello and FaceID are actually pretty good, although fingerprint-based biometrics can be a little hit and miss. Not that a decent proportion of Windows users have Hello-compatible hardware. Interestingly, two TV shows in just the last few months (The Peripheral and, believe it or not, Mayfair Witches) have had a moment where a phone belonging to a dead or unconscious person was unlocked by showing it their face, so the shortcoming are entering public knowledge. We can "all" agree that passwords are "bad", but we cannot agree on what to replace them with, mostly because the level of computer literacy for most solutions is much higher than just typing in a username and password. I can bang out the stuff above because, as an IT professional, I've experimented with KeePass, Windows Hello and Yubikeys in the last six months, buying my own hardware, to try to find some level of opsec that could be used by our customers. All I've done is highlight the lack of commitment to IT in general and training of all kinds in basically all of our customers.
diegoholiveira 4y ago
I want that for my bank account as well.
- arianvanp 4y ago
  In Germany https://www.online-zahlen-mit-fido.de/ https://www.online-zahlen-mit-fido.de/ supports paying with Security Key. In America I know only of https://mercury.com https://mercury.com
fjni 4y ago
Will this disable fallback to text message 2fa? Or is there another way to disable it?
- acdha 4y ago
  The setup process requires you to generate a 28 digit recovery code and enter it to confirm.
hyperliner 4y ago
[dead]
deleted 4y ago
[deleted]
petesergeant 4y ago
This means I can remove the Apple keyboard velcro’d to the underside of my desk for unlocking my docked laptops … right?
- nighthawk454 4y ago
  Ha, not a bad idea. Easier than going full ham like this guy who made an external TouchID module out of a magic keyboard: https://twitter.com/khaost/status/1511564895438835712?s=21 https://twitter.com/khaost/status/1511564895438835712?s=21
Dig1t 4y ago
Can anyone tell me why nobody supports the Google Titan hardware key? It seems that the only thing it works with is Google itself. I was hopeful that the Titan would be supported with AppleID, but reading the page it doesn’t look like it.
- drewry 4y ago
  It works fine for me on GitHub, Microsoft, AWS and many others.
- labcomputer 4y ago
  Probably just a lack of awareness. If you read the support page closely, Yubikey 5 is given as an example of a supported FIDO2 key, but I’d bet that the Titan works as well. It’s kind of like how Google clearly states that you need to use Google Authenticator (tm) as 2FA for your Google account, but really any TOTP app will work.
- arianvanp 4y ago
  It's because it doesn't implement FIDO2 but only the older U2F standard. It's a bit of a dated key and I wouldn't recommend it.
roxgib 4y ago
I understand the logic of requiring two keys, but why can't I have password + (security key OR single use code). This is what most services support - for something like GitHub I have an authenticator app on my phone or my YubiKey as the second factor, and can use either. That actually provides more redundancy against lost keys/devices than I have now, since if I lose all my Apple devices I'm locked out.
- labcomputer 4y ago
  > but why can't I have password + (security key OR single use code) That’s actually pretty close to what they support, except that the OPTs are only sent to your trusted Apple devices (you can’t use an arbitrary TOTP app). > since if I lose all my Apple devices I'm locked out They also support a 28 digit recovery key you can print out and a method for trusted contacts to help recover your account.
  - roxgib 4y ago
    > They also support a 28 digit recovery key you can print out and a method for trusted contacts to help recover your account. Suggesting you shouldn't be required to have multiple keys?
ehzy 4y ago
Does anyone know if this works with Yubikey 4? I have a lightning to USB adapter but I can't seem to get it to work with these keys. It worked fine with A USB-C + NFC Yubikey Security key and a Google Titan key, but not Yubikey 4.
- chrizel 4y ago
  According to this recent support article by Yubico, the YubiKey 4 series should be compatible: https://support.yubico.com/hc/en-us/articles/7449189070620 https://support.yubico.com/hc/en-us/articles/7449189070620
- lxgr 4y ago
  The Yubikey 4 might not be FIDO certified? Apparently Apple accepts only certified authenticators, i.e. they presumably check the attestation certificate against an allowlist that the Yubikey 4 might not be on. Maybe they also require CTAP2 (as opposed to U2F together with the browser‘s compatibility layer)?
pfoof 4y ago
Yubikey or not, they should focus first on making TOTP instead of text messages
- top_sigrid 4y ago
  Am I missing something, but their current 2FA approach supports TOTP doesn't it? At least for me it's OS integrated TOTP codes for 2FA with my AppleID.
  - pfoof 4y ago
    Yes, for devices connected with iCloud account. But at work I use different email and each time I have to wait for text message (not to mention that they are invalidating my cookies quite often)
chewz 4y ago
Fun fact: I have tried adding my keys and macOS refused because my Mac had been activated on December 3rd last year so for security reasons I can add keys only after March 3rd. this year.. > Because this is a new device on your account, you cannot use it to add security keys until 03/04/2023. This waiting period helps protect your account.
- dodgerdan 4y ago
  Trying and failing to understand the logic of this feature.
  - artdigital 4y ago
    Someone logging into your account, registering their key and locking you out. This is a somewhat common scam
- 4ad 4y ago
  It protects against compromised devices being added to your account and then disabling your other devices.
pfortuny 4y ago
Honest question: if I lose the keys to my house, I can call a locksmith etc. If I lose my hardware key I reckon I am screwed?
- stingraycharles 4y ago
  That is why they require two keys. What you’re describing is indeed true, if one key gets lost or breaks and you don’t have a backup, you’re effectively locked out. That’s a feature, not a bug.
  - pfortuny 4y ago
    Ok thanks!
- user3939382 4y ago
  Only use hardware keys on services that let you use multiple (lookin at you AWS). I keep at least 2 backups.
  - scarface74 4y ago
    https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/ https://aws.amazon.com/blogs/security/you-can-now-assign-mul...
    - digianarchist 4y ago
      They still don't allow multiple MFAs on the root account for console access.
      - scarface74 4y ago
        > Now, you can add multiple MFA devices to AWS account root users and AWS Identity and Access Management (IAM) users in your AWS accounts
config_yml 4y ago
Meanwhile Saxobank removed all 2FA methods and will require SMS again.
supernova87a 4y ago
I'm a bit confused by one thing, or why they don't mention it. Isn't TouchID on Macbooks already equivalent in security to a Yubikey? But this is another layer on top of that? (I guess you don't have a backup / alternate method for your MacBook touchID though, and that specific key isn't usable for other iOS devices)
- sebzim4500 4y ago
  I've never used TouchID, but I don't get how this could be true. You carry a Yubikey around on your key chain, so it's always in your pocket. Presumably you are not in the same room as your laptop 100% of the time.
- ezfe 4y ago
  No, Touch ID is just a finger print reader. It can be used as a stand-in for a security key, but it's all in software on your device.
  - WorldMaker 4y ago
    Some of it is also hardware: there's a trust module (Apple's preferred term is Secure Enclave hardware). That bit of hardware is directly comparable to a security key like a YubiKey: it stores secrets and keys in a way designed to make them hard to physically exfiltrate. Having something like Touch ID on a device is often an indicator that the device has a trust module (or Secure Enclave), though that isn't a guarantee. The Touch ID itself isn't generally considered a part of the trust module, but instead is often used as an ID to unlock keys in the trust module that have been locked to that biometric data. (Same generally applies to Face ID.) The biggest distinction between the trust module (Secure Enclave) in a modern device and a physical hardware security key is proximity. Obviously, a trust module is "right next door" inside the device itself. This has benefits (only need to carry one device) and detriments: lose the device and lose all the keys/secrets inside the trust module (protection from exfiltration includes protection from 'backups'); it's more complicated to use one device with the locked keys on another device (this is shifting somewhat today with new Bluetooth LTE-based personal area network "Passkey" standards) versus standalone hardware security keys are designed to communicate with multiple devices (often anything that supports some combination of USB or NFC); the threat models for accessing keys from a trust module if you have access to a device are different from the threat models for accessing keys from a hardware security key if you have access to only a device or only the key or sometimes even both. There's definitely cross-over between the hardware trust module on a modern device and hardware security key, but one is a dedicated device for it and the other is part of a larger device and has different threat models.
O__________O 4y ago
Is there a way to audit the length of the key Apple’s actually using from the security keys and/or enforcement of key lengths by the hardware and/or protocol themselves?
- arianvanp 4y ago
  Yes. You can intercept the navigator.credentials.get call and look at the signature format. I did this and it seems to be an ECDSA p-256 signature.
  - O__________O 4y ago
    Limited knowledge on the protocol, but if they’re wrapping/encrypting and then signing the key, how would one know what key is being sent to Apple?
    - arianvanp 4y ago
      I've only looked at the signature-side of things in web. You can't enroll the keys through the WebUI; only use them. So enrollment is happening in the iPhone app. They use WebAuthn; an open standard for public key signatures. I suppose the iPhone app uses https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_security_key_authentication_using_physical_keys https://developer.apple.com/documentation/authenticationserv... for key creation. As that's the native counterpart for creating WebAuthn keys The only supported key-algorithm for this API is https://developer.apple.com/documentation/authenticationservices/ascosealgorithmidentifier/3751855-es256 https://developer.apple.com/documentation/authenticationserv... (ES256). so I'm 99% sure they are indeed using ES256 keys
gregoriol 4y ago
It would have been nice to also have the choice for some app generated OTP: it's less secure than keys but more secure than SMS, and much much easier to backup/transfer/keep/use.
mihaaly 4y ago
Finally! Pity it is only for newest OS versions. : ((
illiac786 4y ago
I’ll have to wait for them to figure out how to make it compatible with child/managed accounts…
0x4542 4y ago
To the OP: How did you find this article?

308 points by judge2020 4y ago

I find the phrase "Lightning connectors work with most iPhone models." really strange as the latest incompatible iphone would be the iphone 5, is this them foreshadowing a usb-c iphone?

alwillis 4y ago
> is this them foreshadowing a usb-c iPhone? Apple confirmed that USB-C is coming to the iPhone last fall [1]. [1]: https://www.theverge.com/2022/10/26/23423977/iphone-usb-c-eu-law-joswiak-confirms-compliance-lightning https://www.theverge.com/2022/10/26/23423977/iphone-usb-c-eu...
- zippergz 4y ago
  Pedantically, no they didn't. They said they'd comply with the law, and another way to do that would be to remove the charging port entirely. (To be clear, I do think they'll add USB-C. I am just frustrated by the press's ongoing willingness to take an ambiguous statement and turn it into an absolute certain outcome in a headline.)
  - InsomniacL 4y ago
    He was asked directly: "Is Apple moving to USB-C" If his response is "..obviously we will have to..." then I don't think it's unreasonable for the headline. If he was asked "Is Apple going to comply with EU Law" and his response was the same then I think it leaves room for interpretation, but we're humans, not computers. He was asked a question and he provided an answer to that question and the headline reflects what a reasonable person would infer. If that's not the case then I think that speaks more to his trustworthiness than that of the articles writer.

jtdressel 4y ago

This is excellent news. > At least two FIDO® Certified I'm glad to see that they not only support, but require the use of multiple keys. > iOS 16.3, iPadOS 16.3, or macOS Ventura 13.3, or later on all of the devices where you're signed in with your Apple ID. and > During set up, you're signed out of inactive devices, which are devices associated with your Apple ID that you haven't used or unlocked in more than 90 days. To sign back into these devices, update to compatible software and use a security key. If your device can't be updated to compatible software, you won't be able to sign back in. I'm not ready to set this up, since I still use a few Big Sur and Monterey machines.

hrpnk 4y ago
> If your device can't be updated to compatible software, you won't be able to sign back in. Unless there will be a warning when adding the keys, this can lead to many support requests they will get from users who did not read this part.
- jackson1442 4y ago
  They've been pretty good about this in the past, with iCloud E2EE my phone refused to let me enable it without updating all associated devices.
  - Gigachad 4y ago
    How has this feature been working for you. It's apparently not available in my country but I'm looking forward to trying it.
    - jackson1442 4y ago
      Haven't noticed any difference except the process to access iCloud on the web is a little different, overall it works great across all my devices.
    - kevinbowman 4y ago
      It wasn't available in my country (UK) yesterday, but I just checked after updating to 16.3 and it now says I can enable it.

kitsunesoba 4y ago

Been waiting for this. Will be setting it up on App Store accounts soon. The only potential problem for turning this on for my personal account is that you can't sign into iCloud using Windows, which isn't a problem in itself (I have no need to sync my photos to my gaming tower), but if it means I also can't sign into my Apple account that would be more troublesome since I like to use Apple Music from my Windows boxes occasionally.

selectodude 4y ago
I’m under the impression that in a modern browser that supports FIDO, it should work fine.
smileybarry 4y ago
That iCloud for Windows bit is troubling, right now it’s just photo syncing but I’m not sure if it also affected iTunes, or the upcoming Apple TV+ and Music apps. (They all use the same iTunes auth library underneath)
- WorldMaker 4y ago
  There's more than just photo syncing in iCloud for Windows. It's an iDevice backup sync. It can be used to sync files with any app that supports the Files app (and even some that don't but supported certain older app-specific file folders). It does some Apple Keychain syncing with Edge. It does some Contacts sync and backup. It can do some account recovery help if you don't have handy access to another iOS or macOS device but have been signed into iCloud for Windows for long enough.
  - smileybarry 4y ago
    > It's an iDevice backup sync. That's exclusively iTunes (or soon the Apple Devices Windows 11 app), if I remember correctly. > It can be used to sync files[...] Right, there's also iCloud Drive.
    - 4y ago

adav 4y ago

Isn’t it odd that Apple are not yet selling their own security keys?

CaliforniaKarl 4y ago
It doesn't seem odd to me.
spike021 4y ago
Wouldn't be surprised if they do at some point.
threeseed 4y ago
For 99% of the population the existing approach i.e. verifying on another Apple device is sufficient.
- jeffbee 4y ago
  Or would be, if Apple devices did not routinely prompt you for your password. I find this incredibly annoying since my Apple ID uses one of those long, irregular passwords automatically generated by password managers and in the context where Apple wants your password there's no way to cut and paste it. I can use my phone with touch ID to authorize a $20k purchase but if I want to install a free app from the App Store I need my stupid password. I wonder why they do this.
  - zie 4y ago
    So people don't forget their password and as a liveness check.
    - jeffbee 4y ago
      If they insist on this, I think it would be nice if they rigged their backend to allow me to enter the password from any of my devices. They already allow this from the Apple TV+ app on smart TVs, so the technical precedent exists within Apple.

highwaylights 4y ago

So I’ve been thinking about this for a good long while now and I’m not really sure whether this increases the security of your account or not. On one hand, you can’t accidentally or absent-mindedly approve a request from someone else on your phone with a YubiKey. On the other hand, with device 2FA you generally need to be present (Face or Touch). If someone were to steal your yubikey then they’d be able to perform a step that previously you’d have needed to be there for. I’m guessing MFA (password + presence + YubiKey) is too much of a catastrophic lockout risk to be supported.

kube-system 4y ago
You could get the bio version of the Yubikey. Or some other FIDO2 key with biometrics.
TacticalCoder 4y ago
> If someone were to steal your yubikey then they’d be able to perform a step that previously you’d have needed to be there for. Several security keys are protected themselves with an additional factor. There are, for example, Yubikeys which are unlocked by your fingerprint: this now requires the thief to not only steal your Yubikey but also have the skills required to reproduce your fingerprint. There are also several U2F devices protected by a PIN. The "Only key" uses one PIN to register a service (which you do once per service) and another PIN to authenticate to the service (so you cannot easily be tricked into registering instead of authenticating). The Ledger Nano U2F app is also protected by a PIN and has its own little screen so it displays the name (or the identifier) of the service you're either registering or authenticating to (and tells you if you're actually going to register or authenticate), is protected by a HSM and factory resets itself after three wrong PIN. I'm using the later to SSH now (requires a moderately recent version of OpenSSH: latest Debian stable is sufficient for example).
- jay-barronville 4y ago
  > this now requires the thief to not only steal your Yubikey but also have the skills required to reproduce your fingerprint. Or the thief can “steal” a couple of your fingers too and have unlimited access to your fingerprints. Oh, wait, is that just a movie thing?

deleted 4y ago

[deleted]

jkaplowitz 4y ago

This is mostly good news, but would best be coupled with a promise to add security key support to iCloud for Windows. Over the long term, iCloud users shouldn't have to choose between good security, on the one hand, and keeping the cross-platform support they may already rely on and which may even justify their choice to buy a paid iCloud subscription, on the other.

brewdad 4y ago
Agreed. I've moved to iOS devices for my phone and tablet but am still on Windows for the foreseeable future. I might make the move to Mac with my next laptop refresh but I expect that to be at least 2 years away. I'm an iCloud subscriber but can't utilize this upgrade until then.

irusensei 4y ago

I have a single yubikey so I'm not setting up this. I do use the yubikey but keep 2FA recovery codes from most services. I do however have an unused Ledger X laying around. Does anyone knows if the Ledger X could act as a security key? Thanks in advance.

TacticalCoder 4y ago
> I do however have an unused Ledger X laying around. Does anyone knows if the Ledger X could act as a security key? Thanks in advance. I don't have a X but I've got a S which I only use for U2F (well, webauthn now really). Chrome deprecated and now removed U2F support so moving forward it's webauthn but U2F devices are compatible with webauthn. So yes it works. I use it to log on to several services and I use to log on using SSH. Anyway here's a video showing how it works on a X: https://support.ledger.com/hc/en-us/articles/115005198545-FIDO-U2F?docs=true https://support.ledger.com/hc/en-us/articles/115005198545-FI... Now I don't know if it specifically work for this new AppleID "dual security keys" thing.
- lxgr 4y ago
  Unlike most WebAuthN services, Apple requires FIDO-certified keys. Are you sure the Ledger is?
lxgr 4y ago
Probably not, given that Apple requires a FIDO-certified key, and the Ledger almost certainly isn't.
gst 4y ago
Didn't work for me with the Ledger Nano X. Screen prompts for confirmation to register the key for a fraction of a second (on the Nano X), then goes back to the main screen, then back to confirmation (in a loop). I tried to confirm the "registration" screen during the brief time where it showed but wasn't successful.

2OEH8eoCRo0 4y ago

> You can't sign in to iCloud for Windows. Of course not

deleted 4y ago
[deleted]
filmgirlcw 4y ago
Yeah, this is disappointing. Especially since Windows, more broadly, has more robust smart card and security key support. And Edge/Chrome both support FIDO2/WebAuthn and there is a great iCloud password manager extension for Windows browsers (but not for non-Safari browsers on iOS)

wrldos 4y ago

What happens if you lose your Yubikey? Are there scratch codes? It's bad enough now if your house burns down with all your iOS devices in it.

Philip-J-Fry 4y ago
It's recommended to always have a backup key stored in a safe location for this reason. The article actually says so: >At least two FIDO® Certified* security keys that work with the Apple devices that you use on a regular basis. >You must add and maintain at least two security keys. You can add up to six keys.
- wrldos 4y ago
  Ahha I missed the "at least two" part. I can get behind that no problems at all. Now all I need is a USB-C hole in my iPhone... Edit: ok they come in NFC as well. There goes €100...
  - lxgr 4y ago
    > There goes €100... If cost is a concern, you're buying the wrong keys. You can get FIDO-certified CTAP2 tokens for much less these days (even Yubico's is only about €25 apiece).
    - wrldos 4y ago
      Cost is not a concern.
kube-system 4y ago
You use your backup key, that you must have. Apple won’t let you use this with a single key.
- TylerE 4y ago
  And if the backup key is lost? Most safes aren’t really THAT fireproof

bluSCALE4 4y ago

Curious, I am somewhat paranoid about leaving me keys or wallet in my jacket at a gym but if I had a security key, I'd be pretty terrified. Does having a key mean you still need a password since it's 2 factor? If you lose a key, do you need a backup master password like using auth apps?

rodgerd 4y ago
> If you lose a key, do you need a backup master password like using auth apps? Yes. If you only have one key enrolled and no other recovery mechanism, you're now locked out forever. That's why Apple are pushing you to have two keys as a minimum.
deleted 4y ago
[deleted]
nerdbert 4y ago
When you log in to your account you have to provide your password and also use the key. You can choose a key that has an additional factor built in, such as a fingerprint reader. If you lose one of the keys you can authorize a new one. If you lose both of the keys and all the Apple devices that you can log into directly, e.g. with fingerprint sensor on a Mac, then you're SOL.
Krisjohn 4y ago
Get a pouch for your water bottle that has a pocket for your keys.
arianvanp 4y ago
Correct. Apple will prompt you to create a recovery key or assign a "Recovery contact" before you can enable support

daviesgeek 4y ago

I do wish they’d add better support for the mac with a key. I know it’s a little separate, but I’d really like to lock down my max with my yubikey(s).

mynameisvlad 4y ago
Can't you sign in using the smart card part? https://support.yubico.com/hc/en-us/articles/360016649059-Using-Your-YubiKey-as-a-Smart-Card-in-macOS https://support.yubico.com/hc/en-us/articles/360016649059-Us...
- daviesgeek 4y ago
  You can but it’s key + pin OR password, not key + pin + password. I’ve tried a bunch of different setup configurations and can’t get it to work as a true 2FA like it should. I did get it set up correctly at some point but an OS upgrade wiped the settings. I’ll have to try it again, but the path for setup isn’t as easy as it seems.
  - mynameisvlad 4y ago
    You might be able to using PAM. Something to look into, hopefully you can still use these guides with the latest macOS: https://developers.yubico.com/yubico-pam/MacOS_X_Challenge-Response.html https://developers.yubico.com/yubico-pam/MacOS_X_Challenge-R...
    - daviesgeek 4y ago
      Ok I’ll check it out!

deleted 4y ago

[deleted]

filmgirlcw 4y ago

I wish thus would work for password prompts for macOS on machines that aren’t able to use a fingerprint sensor, like my 2020 Intel iMac. I know I should upgrade that to a new M2 Max or something (I have two M1 Max notebooks), but the GPU and 128GB of RAM I have on the iMac, not to me than the fact that it runs Docker and VMs better, really keeps me from phasing it out. But although the Apple Watch is a decent compromise, I really wish I could use my YubiKey for admin passwords or for login stuff.

dblitt 4y ago
You can use the PIV functionality of a yubikey to act as a smartcard, and you can log in and sudo authenticate with the yubikey and a PIN. https://support.yubico.com/hc/en-us/articles/360016649059-Using-Your-YubiKey-as-a-Smart-Card-in-macOS https://support.yubico.com/hc/en-us/articles/360016649059-Us...
- filmgirlcw 4y ago
  Oh awesome, thanks! Not sure if this would be any faster then just typing the password, but thanks!
  - lxgr 4y ago
    One advantage is that a PIV PIN can be much shorter than a password and still be secure (because the smart card/Yubikey enforces attempt limiting in secure hardware).

vlmutolo 4y ago

> What's required for Security Keys for Apple ID > A modern web browser. If you can't use your security key to sign in on the web, update your browser to the latest version or try another browser. It doesn't seem like Firefox 108 supports this. Does anyone know if Firefox beta or nightly work to sign into iCloud with hardware security keys for 2FA? --- Just confirmed that Firefox beta (109) doesn't support iCloud's sign in, either.

Krisjohn 4y ago
That's odd, because I can sign into (on-prem) Confluence with my Yubikey (5 NFC) as the MFA via Firefox. I get a little Windows "tap your key" prompt and everything.
- arianvanp 4y ago
  Firefox supports U2F. Webauthn is backwards-compatible with U2F. However as a website you can choose whether you want to actually support U2F or only FIDO2. Maybe Apple opted to not do it. However when I look at the JS code in appleid.apple.com there does seem to be code for U2F code surprisingly.
lxgr 4y ago
Firefox on macOS unfortunately has very poor WebAuthN support, in my experience. It only supports legacy U2F keys/mode, as far as I know, and Apple seems to require CTAP2.
arianvanp 4y ago
Firefox team simply has been refusing to implement the Webauthn spec for years now. It's extremely frustrating and is probably still years away as nobody seems to be actively working on it in any capacity.

girvo 4y ago

This is awesome news! My YubiKey keeps becoming more and more useful over time, it's excellent. Yubi Authenticator giving me TOTP has been lovely (I have two keys that I always add the codes to each, one kept safe the other used regularly), and now more and more support for FIDO/U2F etc. across all my important accounts. Apple ID was one of the last hold outs, this is so good

philip1209 4y ago

I'm hesitant to rely on security keys after two of my Yubikey 5cs broke in the same month after ~3 years of ownership. Do we understand the lifetimes and and stability of these devices? I think hardware security make a ton of sense for an enterprise environment, where you can go to IT and prove your identity to regain access. But, for something like Apple or Google - I'm sure the recovery process is not as easy. For a hardware crypto wallets, people go to extremes - safety deposit boxes, fire-proof recovery phrases, etc. But, for me - losing access to my core online accounts would be more destabilizing than losing money on a hardware wallet. Yet, we don't have the ultra-reliable backup methods in place for web auth like we do for crypto wallets.

themagician 4y ago
The security key here isn’t used for every login. So if you were to lose both it’s not like your account is completely disabled and all data lost. I think you can even use still use your Recovery Code. The Security Key here primarily replaces the 2FA authentication method for adding new devices to your account. From Apple’s own documentation: When you use Security Keys for Apple ID, you need a trusted device or a security key to: - Sign in with your Apple ID on a new device or on the web - Reset your Apple ID password or unlock your Apple ID - Add additional security keys or remove a security key I believe if you lose both you can still add another as long as you have access to a device that’s still logged in. The biggest hole in Apple’s security model, and one which has been documented to have been exploited many times, is people using phishing tactics to get the 6-digit 2FA code to gain iCloud access, adding a new device, then downloading the unencrypted backup from the victims primary device from iCloud. Security Keys and E2EE now make this impossible.
hellodanylo 4y ago
> I'm sure the recovery process is not as easy. A lot of services offer one-time backup codes and connecting multiple 2FA devices. Making Yubikey a single point of failure is certainly a bad idea.
hnbear 4y ago
I deployed 1000+ over 3+ years, and never had one break. It’s anecdata and I believe they can fail, but we never saw it once. Using the A and C nanos. Helped they were permanently in machines though. No mechanical risk.

sega_sai 4y ago

Am I the only one who feels lost in all those new security technologies and their various permutations, specifically understanding what's secure, how to back it up etc? We have TOTP, 2nd factor, password managers, security keys, hardware security keys, passkeys, windows hello etc/etc..

Krisjohn 4y ago
It's not just you. Usernames and passwords are easy, if insecure. Type username, type password, done. Get admin to reset password if you forget. Put in password manager if one account is used by a team. Security keys are hard. Needing a physical key around every time you have to log into something is annoying. Backups are hard, because off-site backups can't be done over the Internet. Self-service hardware tokens for services with infamously bad customer service is highly risky. Resetting an account if a key is lost or locked requires physically transferring hardware, which can be hard if someone is traveling, or can cause days of downtime. Team access is basically impossible if an account is secured with a physical key. Authenticators are fine, except if you lose a couple of smartphones too close together, or you need a team to access one account. Password managers that let you securely store the QR code, or actually generate the key put the MFA in the same place as the rest of the credentials, which is not ideal but increasingly necessary for the same reason password managers came into existence in the first place. Windows Hello and FaceID are actually pretty good, although fingerprint-based biometrics can be a little hit and miss. Not that a decent proportion of Windows users have Hello-compatible hardware. Interestingly, two TV shows in just the last few months (The Peripheral and, believe it or not, Mayfair Witches) have had a moment where a phone belonging to a dead or unconscious person was unlocked by showing it their face, so the shortcoming are entering public knowledge. We can "all" agree that passwords are "bad", but we cannot agree on what to replace them with, mostly because the level of computer literacy for most solutions is much higher than just typing in a username and password. I can bang out the stuff above because, as an IT professional, I've experimented with KeePass, Windows Hello and Yubikeys in the last six months, buying my own hardware, to try to find some level of opsec that could be used by our customers. All I've done is highlight the lack of commitment to IT in general and training of all kinds in basically all of our customers.

diegoholiveira 4y ago

I want that for my bank account as well.

arianvanp 4y ago
In Germany https://www.online-zahlen-mit-fido.de/ https://www.online-zahlen-mit-fido.de/ supports paying with Security Key. In America I know only of https://mercury.com https://mercury.com

fjni 4y ago

Will this disable fallback to text message 2fa? Or is there another way to disable it?

acdha 4y ago
The setup process requires you to generate a 28 digit recovery code and enter it to confirm.

hyperliner 4y ago

[dead]

deleted 4y ago

[deleted]

petesergeant 4y ago

This means I can remove the Apple keyboard velcro’d to the underside of my desk for unlocking my docked laptops … right?

nighthawk454 4y ago
Ha, not a bad idea. Easier than going full ham like this guy who made an external TouchID module out of a magic keyboard: https://twitter.com/khaost/status/1511564895438835712?s=21 https://twitter.com/khaost/status/1511564895438835712?s=21

Dig1t 4y ago

Can anyone tell me why nobody supports the Google Titan hardware key? It seems that the only thing it works with is Google itself. I was hopeful that the Titan would be supported with AppleID, but reading the page it doesn’t look like it.

drewry 4y ago
It works fine for me on GitHub, Microsoft, AWS and many others.
labcomputer 4y ago
Probably just a lack of awareness. If you read the support page closely, Yubikey 5 is given as an example of a supported FIDO2 key, but I’d bet that the Titan works as well. It’s kind of like how Google clearly states that you need to use Google Authenticator (tm) as 2FA for your Google account, but really any TOTP app will work.
arianvanp 4y ago
It's because it doesn't implement FIDO2 but only the older U2F standard. It's a bit of a dated key and I wouldn't recommend it.

roxgib 4y ago

I understand the logic of requiring two keys, but why can't I have password + (security key OR single use code). This is what most services support - for something like GitHub I have an authenticator app on my phone or my YubiKey as the second factor, and can use either. That actually provides more redundancy against lost keys/devices than I have now, since if I lose all my Apple devices I'm locked out.

labcomputer 4y ago
> but why can't I have password + (security key OR single use code) That’s actually pretty close to what they support, except that the OPTs are only sent to your trusted Apple devices (you can’t use an arbitrary TOTP app). > since if I lose all my Apple devices I'm locked out They also support a 28 digit recovery key you can print out and a method for trusted contacts to help recover your account.
- roxgib 4y ago
  > They also support a 28 digit recovery key you can print out and a method for trusted contacts to help recover your account. Suggesting you shouldn't be required to have multiple keys?

ehzy 4y ago

Does anyone know if this works with Yubikey 4? I have a lightning to USB adapter but I can't seem to get it to work with these keys. It worked fine with A USB-C + NFC Yubikey Security key and a Google Titan key, but not Yubikey 4.

chrizel 4y ago
According to this recent support article by Yubico, the YubiKey 4 series should be compatible: https://support.yubico.com/hc/en-us/articles/7449189070620 https://support.yubico.com/hc/en-us/articles/7449189070620
lxgr 4y ago
The Yubikey 4 might not be FIDO certified? Apparently Apple accepts only certified authenticators, i.e. they presumably check the attestation certificate against an allowlist that the Yubikey 4 might not be on. Maybe they also require CTAP2 (as opposed to U2F together with the browser‘s compatibility layer)?

pfoof 4y ago

Yubikey or not, they should focus first on making TOTP instead of text messages

top_sigrid 4y ago
Am I missing something, but their current 2FA approach supports TOTP doesn't it? At least for me it's OS integrated TOTP codes for 2FA with my AppleID.
- pfoof 4y ago
  Yes, for devices connected with iCloud account. But at work I use different email and each time I have to wait for text message (not to mention that they are invalidating my cookies quite often)

chewz 4y ago

Fun fact: I have tried adding my keys and macOS refused because my Mac had been activated on December 3rd last year so for security reasons I can add keys only after March 3rd. this year.. > Because this is a new device on your account, you cannot use it to add security keys until 03/04/2023. This waiting period helps protect your account.

dodgerdan 4y ago
Trying and failing to understand the logic of this feature.
- artdigital 4y ago
  Someone logging into your account, registering their key and locking you out. This is a somewhat common scam
4ad 4y ago
It protects against compromised devices being added to your account and then disabling your other devices.

pfortuny 4y ago

Honest question: if I lose the keys to my house, I can call a locksmith etc. If I lose my hardware key I reckon I am screwed?

stingraycharles 4y ago
That is why they require two keys. What you’re describing is indeed true, if one key gets lost or breaks and you don’t have a backup, you’re effectively locked out. That’s a feature, not a bug.
- pfortuny 4y ago
  Ok thanks!
user3939382 4y ago
Only use hardware keys on services that let you use multiple (lookin at you AWS). I keep at least 2 backups.
- scarface74 4y ago
  https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/ https://aws.amazon.com/blogs/security/you-can-now-assign-mul...
  - digianarchist 4y ago
    They still don't allow multiple MFAs on the root account for console access.
    - scarface74 4y ago
      > Now, you can add multiple MFA devices to AWS account root users and AWS Identity and Access Management (IAM) users in your AWS accounts

config_yml 4y ago

Meanwhile Saxobank removed all 2FA methods and will require SMS again.

supernova87a 4y ago

I'm a bit confused by one thing, or why they don't mention it. Isn't TouchID on Macbooks already equivalent in security to a Yubikey? But this is another layer on top of that? (I guess you don't have a backup / alternate method for your MacBook touchID though, and that specific key isn't usable for other iOS devices)

sebzim4500 4y ago
I've never used TouchID, but I don't get how this could be true. You carry a Yubikey around on your key chain, so it's always in your pocket. Presumably you are not in the same room as your laptop 100% of the time.
ezfe 4y ago
No, Touch ID is just a finger print reader. It can be used as a stand-in for a security key, but it's all in software on your device.
- WorldMaker 4y ago
  Some of it is also hardware: there's a trust module (Apple's preferred term is Secure Enclave hardware). That bit of hardware is directly comparable to a security key like a YubiKey: it stores secrets and keys in a way designed to make them hard to physically exfiltrate. Having something like Touch ID on a device is often an indicator that the device has a trust module (or Secure Enclave), though that isn't a guarantee. The Touch ID itself isn't generally considered a part of the trust module, but instead is often used as an ID to unlock keys in the trust module that have been locked to that biometric data. (Same generally applies to Face ID.) The biggest distinction between the trust module (Secure Enclave) in a modern device and a physical hardware security key is proximity. Obviously, a trust module is "right next door" inside the device itself. This has benefits (only need to carry one device) and detriments: lose the device and lose all the keys/secrets inside the trust module (protection from exfiltration includes protection from 'backups'); it's more complicated to use one device with the locked keys on another device (this is shifting somewhat today with new Bluetooth LTE-based personal area network "Passkey" standards) versus standalone hardware security keys are designed to communicate with multiple devices (often anything that supports some combination of USB or NFC); the threat models for accessing keys from a trust module if you have access to a device are different from the threat models for accessing keys from a hardware security key if you have access to only a device or only the key or sometimes even both. There's definitely cross-over between the hardware trust module on a modern device and hardware security key, but one is a dedicated device for it and the other is part of a larger device and has different threat models.

O__________O 4y ago

Is there a way to audit the length of the key Apple’s actually using from the security keys and/or enforcement of key lengths by the hardware and/or protocol themselves?

arianvanp 4y ago
Yes. You can intercept the navigator.credentials.get call and look at the signature format. I did this and it seems to be an ECDSA p-256 signature.
- O__________O 4y ago
  Limited knowledge on the protocol, but if they’re wrapping/encrypting and then signing the key, how would one know what key is being sent to Apple?
  - arianvanp 4y ago
    I've only looked at the signature-side of things in web. You can't enroll the keys through the WebUI; only use them. So enrollment is happening in the iPhone app. They use WebAuthn; an open standard for public key signatures. I suppose the iPhone app uses https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_security_key_authentication_using_physical_keys https://developer.apple.com/documentation/authenticationserv... for key creation. As that's the native counterpart for creating WebAuthn keys The only supported key-algorithm for this API is https://developer.apple.com/documentation/authenticationservices/ascosealgorithmidentifier/3751855-es256 https://developer.apple.com/documentation/authenticationserv... (ES256). so I'm 99% sure they are indeed using ES256 keys

gregoriol 4y ago

It would have been nice to also have the choice for some app generated OTP: it's less secure than keys but more secure than SMS, and much much easier to backup/transfer/keep/use.

mihaaly 4y ago

Finally! Pity it is only for newest OS versions. : ((

illiac786 4y ago

I’ll have to wait for them to figure out how to make it compatible with child/managed accounts…

0x4542 4y ago

To the OP: How did you find this article?