5 ms·

Why do you require a pin at all? The point of hardware keys is to protect against online takeover. Physical access is usually game over either way

turnsout 4y ago
It adds another factor (something you know), which increases the difficulty of an exploit.
jameswestgate 4y ago
2 factors - something you know and something you have. The device is what you have, the pin is something you know, otherwise anyone can pick up your security key and use it
m-p-3 4y ago
Since Microsoft's implementation of FIDO2 is passwordless, you NEED to use a PIN, which is the "something you know" part, the key being "something you have". And if the PIN is complex enough, bruteforcing or guessing won't work as I believe the default behavior is to wipe the secure element storage after 8 incorrect attempts (with 3 attempts per key being initialized at a time).
- crote 4y ago
  Those bruteforce protections aren't really worth a lot in practice. If you have physical access to the device, you will eventually be able to find a way to glitch it - as things like Cellebrite have already proven for the iPhone.
  - m-p-3 4y ago
    Is there any demonstrated case where someone was able to exfiltrate secrets from a Yubikey secure element?
michaelt 4y ago
Because Microsoft's implementation is incredibly boneheaded, and doesn't allow the Google-style mechanism of username+password+Yubikey. They only support U2F/Webauthn as an alternative to a password. I assume Microsoft is hoping to make Windows the main Webauthn provider out there, to tie online identities into the Windows login process for easier tracking/advertising.
- pQd 4y ago
  Also - thanks to that FIDO2 does not seem to be usable with Microsoft's MS365 services [ Teams, Outlook, Excel etc ] on Android or iOS. there's no way to provide pin for the security key, regardless if it's plugged in via the USB port or used via NFC. https://learn.microsoft.com/en-us/azure/active-directory/authentication/fido2-compatibility https://learn.microsoft.com/en-us/azure/active-directory/aut... bummer

turnsout 4y ago

It adds another factor (something you know), which increases the difficulty of an exploit.

jameswestgate 4y ago

2 factors - something you know and something you have. The device is what you have, the pin is something you know, otherwise anyone can pick up your security key and use it

m-p-3 4y ago

Since Microsoft's implementation of FIDO2 is passwordless, you NEED to use a PIN, which is the "something you know" part, the key being "something you have". And if the PIN is complex enough, bruteforcing or guessing won't work as I believe the default behavior is to wipe the secure element storage after 8 incorrect attempts (with 3 attempts per key being initialized at a time).

crote 4y ago
Those bruteforce protections aren't really worth a lot in practice. If you have physical access to the device, you will eventually be able to find a way to glitch it - as things like Cellebrite have already proven for the iPhone.
- m-p-3 4y ago
  Is there any demonstrated case where someone was able to exfiltrate secrets from a Yubikey secure element?

michaelt 4y ago

Because Microsoft's implementation is incredibly boneheaded, and doesn't allow the Google-style mechanism of username+password+Yubikey. They only support U2F/Webauthn as an alternative to a password. I assume Microsoft is hoping to make Windows the main Webauthn provider out there, to tie online identities into the Windows login process for easier tracking/advertising.

pQd 4y ago
Also - thanks to that FIDO2 does not seem to be usable with Microsoft's MS365 services [ Teams, Outlook, Excel etc ] on Android or iOS. there's no way to provide pin for the security key, regardless if it's plugged in via the USB port or used via NFC. https://learn.microsoft.com/en-us/azure/active-directory/authentication/fido2-compatibility https://learn.microsoft.com/en-us/azure/active-directory/aut... bummer