7 ms·

When I use a Yubikey for passwordless authentication (FIDO2), it challenges me for a PIN before asking me to touch the device. If I give it too many incorrect P

When I use a Yubikey for passwordless authentication (FIDO2), it challenges me for a PIN before asking me to touch the device. If I give it too many incorrect PINs, the Yubikey locks up and requires a device reset, which invalidates all previous registrations to use that key for authentication. It doesn't seem like a big deal if someone steals my hardware token. https://support.yubico.com/hc/en-us/articles/4402836718866-Understanding-YubiKey-PINs https://support.yubico.com/hc/en-us/articles/4402836718866-U...

e40 3y ago
That's not how my YK works. When I go to a new computer and login to my Google account, it asks me to insert it and press the button. Did I configure it wrong?
- the_snooze 3y ago
  If you're only using it for two-factor authentication, you don't need a PIN. But when I tried to registered mine as a passkey (passwordless authentication), my browser prompted me for a PIN. I didn't have one set at the time, so it kept rejecting whatever PIN I gave it. I had to use the YubiKey Manager to set a PIN before I could register it as a a passkey. https://www.yubico.com/support/download/yubikey-manager/ https://www.yubico.com/support/download/yubikey-manager/
  - warp 3y ago
    You can also manage this from within Chrome (Privacy and security -> Security -> Manage security keys).
  - girvo 3y ago
    I use YubiCo Authenticator for TOTP via my YubiKey, and have a PIN setup due to that. Quite nice really, I imagine it's the same PIN you're talking about? I've not used it as a passkey yet
    - dwaite 3y ago
      Yubico sells Yubikeys where are smartcard devices loaded with several apps (keyboard emulation OTP, GPG, PIV card, and FIDO 2). They also sell cheaper security keys, which are purpose-built for FIDO 2 only. When someone says they are using a passkey with a Yubico device, they are talking specifically about the FIDO 2 functionality. This does not (at least currently) support import or export - partially because they want these devices to be sold in regulatory environments where hardware-bound and non-cloneable credentials are required.
- jsmith99 3y ago
  It's optional and can be required by the service. Services like Microsoft that use security keys as a single factor rather than as a MFA are more likely to require it.
- ilikepi 3y ago
  Are you sure you have a YubiKey (e.g. a "5 Series"[1]) and not a YubiCo "Security Key"[2]? The latter is a less expensive device with less functionality[3], though still good for arguably the most common 2FA situations. [1]: https://www.yubico.com/products/yubikey-5-overview/ https://www.yubico.com/products/yubikey-5-overview/ [2]: https://www.yubico.com/products/security-key/ https://www.yubico.com/products/security-key/ [3]: https://www.yubico.com/store/compare/ https://www.yubico.com/store/compare/
  - NoZebra120vClip 3y ago
    The Security Key models have an access PIN just the same.
- hntway123 3y ago
  Something I noticed after reading this thread is that Google basically converted my YK from a 2FA security key to a Passkey. I'm so confused.
  - girvo 3y ago
    Now that is annoying, and I wish companies would not do that without asking.
- yata69420 3y ago
  Yes, you need to use `ykman` to set a PIN. This also allows some services (really only Microsoft Accounts right now) to use "passwordless". The idea is you register 2 or 3 passwordless keys on important accounts. Keep one in the machine, one on your physical keychain, and one in a remote location.
jauntywundrkind 3y ago
It means though that your secure hardware token has a reliable way where the secrets all self-destruct. That someone can easily do if they get even brief hardware access. For people who have a problem keeping sufficient backups (almost everyone on earth) this seems like a horrific blocker, a show stopper for this entire intiative. I personally think these things absolutely should be able to be exported & backed up separately. Many people guffaw that now the device isn't secure. But I just don't think I could realistically adopt nor do I expect others will unless users get some better affordances, unless we get some capability to manage trust as we see fit, not just be pushed top down into someone else's desired much narrower security behavior. (Thankfully it seems like there is building interest in exports & portability, particularly as the OS/browser powered PassKeys arrives.)
- JohnFen 3y ago
  > I personally think these things absolutely should be able to be exported & backed up separately. I agree. The usual response is that you don't need to do this because you can have multiple hardware keys that authenticate to the same services, so you can store one as a backup. But managing that sounds like a real pain in the butt to me (honestly, the entire passkey system sounds like a real pain in the butt to me -- but that bit particularly so). But it looks like the major companies recognize that this is an issue and won't be requiring that part.
  - jauntywundrkind 3y ago
    It'd be awesome if you could ask to enroll a variety of other devices all at once, without having them on hand. Requiring ongoing physical access to your crucial backups to do any account enrollment or changes seems like a way to make sure you have your crucial backup way too close to potential disasters. Ideally I wanty backup keys many states away from me. But then I can enroll them! But it feels like there could be some kind of pubkey for those keys that I could also enroll at the same time as I'm getting my first device. Except these devices don't have just one pubkey cause that wouldn't be secure. Maybe they pre-make & share 20 keys with a peer device or something. Somehow though data needs to at the end be able to get into the backup/other device too though. Ugh it's wild.

e40 3y ago

That's not how my YK works. When I go to a new computer and login to my Google account, it asks me to insert it and press the button. Did I configure it wrong?

the_snooze 3y ago
If you're only using it for two-factor authentication, you don't need a PIN. But when I tried to registered mine as a passkey (passwordless authentication), my browser prompted me for a PIN. I didn't have one set at the time, so it kept rejecting whatever PIN I gave it. I had to use the YubiKey Manager to set a PIN before I could register it as a a passkey. https://www.yubico.com/support/download/yubikey-manager/ https://www.yubico.com/support/download/yubikey-manager/
- warp 3y ago
  You can also manage this from within Chrome (Privacy and security -> Security -> Manage security keys).
- girvo 3y ago
  I use YubiCo Authenticator for TOTP via my YubiKey, and have a PIN setup due to that. Quite nice really, I imagine it's the same PIN you're talking about? I've not used it as a passkey yet
  - dwaite 3y ago
    Yubico sells Yubikeys where are smartcard devices loaded with several apps (keyboard emulation OTP, GPG, PIV card, and FIDO 2). They also sell cheaper security keys, which are purpose-built for FIDO 2 only. When someone says they are using a passkey with a Yubico device, they are talking specifically about the FIDO 2 functionality. This does not (at least currently) support import or export - partially because they want these devices to be sold in regulatory environments where hardware-bound and non-cloneable credentials are required.
jsmith99 3y ago
It's optional and can be required by the service. Services like Microsoft that use security keys as a single factor rather than as a MFA are more likely to require it.
ilikepi 3y ago
Are you sure you have a YubiKey (e.g. a "5 Series"[1]) and not a YubiCo "Security Key"[2]? The latter is a less expensive device with less functionality[3], though still good for arguably the most common 2FA situations. [1]: https://www.yubico.com/products/yubikey-5-overview/ https://www.yubico.com/products/yubikey-5-overview/ [2]: https://www.yubico.com/products/security-key/ https://www.yubico.com/products/security-key/ [3]: https://www.yubico.com/store/compare/ https://www.yubico.com/store/compare/
- NoZebra120vClip 3y ago
  The Security Key models have an access PIN just the same.
hntway123 3y ago
Something I noticed after reading this thread is that Google basically converted my YK from a 2FA security key to a Passkey. I'm so confused.
- girvo 3y ago
  Now that is annoying, and I wish companies would not do that without asking.
yata69420 3y ago
Yes, you need to use `ykman` to set a PIN. This also allows some services (really only Microsoft Accounts right now) to use "passwordless". The idea is you register 2 or 3 passwordless keys on important accounts. Keep one in the machine, one on your physical keychain, and one in a remote location.

jauntywundrkind 3y ago

It means though that your secure hardware token has a reliable way where the secrets all self-destruct. That someone can easily do if they get even brief hardware access. For people who have a problem keeping sufficient backups (almost everyone on earth) this seems like a horrific blocker, a show stopper for this entire intiative. I personally think these things absolutely should be able to be exported & backed up separately. Many people guffaw that now the device isn't secure. But I just don't think I could realistically adopt nor do I expect others will unless users get some better affordances, unless we get some capability to manage trust as we see fit, not just be pushed top down into someone else's desired much narrower security behavior. (Thankfully it seems like there is building interest in exports & portability, particularly as the OS/browser powered PassKeys arrives.)

JohnFen 3y ago
> I personally think these things absolutely should be able to be exported & backed up separately. I agree. The usual response is that you don't need to do this because you can have multiple hardware keys that authenticate to the same services, so you can store one as a backup. But managing that sounds like a real pain in the butt to me (honestly, the entire passkey system sounds like a real pain in the butt to me -- but that bit particularly so). But it looks like the major companies recognize that this is an issue and won't be requiring that part.
- jauntywundrkind 3y ago
  It'd be awesome if you could ask to enroll a variety of other devices all at once, without having them on hand. Requiring ongoing physical access to your crucial backups to do any account enrollment or changes seems like a way to make sure you have your crucial backup way too close to potential disasters. Ideally I wanty backup keys many states away from me. But then I can enroll them! But it feels like there could be some kind of pubkey for those keys that I could also enroll at the same time as I'm getting my first device. Except these devices don't have just one pubkey cause that wouldn't be secure. Maybe they pre-make & share 20 keys with a peer device or something. Somehow though data needs to at the end be able to get into the backup/other device too though. Ugh it's wild.