4 ms·

There’s another foot gun I wrote about recently: https://cedwards.xyz/passkeys-are-not-2fa/ https://cedwards.xyz/passkeys-are-not-2fa/

by cedws 8mo ago

dwedge 8mo ago
I was reading your other blog post about storing them in bitwarden I have to disagree with this point: > Unless you were forced to by some organisational policy, there’s no point setting up 2FA only to reduce the effective security to 1FA because of convenience features. 2FA both stored in your password manager is less secure than storing than separately, but it still offers security compared to a single factor. The attack methods you mentioned (RAT, keylogger) require your device to be compromised, and if your device is not compromised 2fa will help you. To slip into opinion mode, I consider my password manager being compromised to be mostly total compromise anyway. Also I really like the style and font of your blog.
- TacticalCoder 8mo ago
  > To slip into opinion mode, I consider my password manager being compromised to be mostly total compromise anyway. But how is that no the entire point? If your 2FA is a proper device, like a Yubikey, the attack surface is tinier than tiny and the device ensures that your secret never leaves the device. We did see cases of passwords managers getting compromised. We haven't seen yet a secret being extracted from a Yubikey. So where you say you consider that your software (password manager) getting compromised is total compromise, we're saying: "as long as the HSM on a Yubikey does its job, we have actual 2FA and there cannot be a total compromise".
  - dwedge 8mo ago
    You're right, I should have been more clear in that I meant a local compromise of the machine running the password manager client, not the server running the password manager itself. If my sessions and all of my data can be intercepted, the yubikey 2fa seems like it's only saving me from a token "nobody can login remotely to this one service" which at that point seems pretty moot
  - fragmede 8mo ago
    Yubikey offers a false sense of security in that regard, unfortunately, because if your device is thoroughly 0wned and you don't know it, the attacker "just" has to wait for the victim to do something that would trigger the yubikey, and then swap in their forged request instead. Eg if the victim uses the yubikey to log into bank1 and to crypto wallet, but bank1 accounts have no money, instead of waiting for the customer to log into their crypto wallet with the yubikey, the attack software waits for the victim to log into bank1, but swaps in a request to the crypto wallet instead.
    - jdmoreira 8mo ago
      Not sure I understand your point. Under WebAuthn / FIDO2 you can't impersonate a RP Could you explain better?
      - gzread 8mo ago
        If the user's computer is pwned, you can wait for the user to log in to their bank account, then blank the screen while you send yourself all their money.
      - deleted 8mo ago
        [deleted]
      - fragmede 8mo ago
        WebAuthn assumes the browser is secure. If the browser is compromised, then impersonation becomes possible, so the user, thinking they're authorizing adding a new ssh key on GitHub.com by touching their yubikey, gets their money stolen by the hacked web browser because it has an invisible hidden window with bank.com waiting for yubikey authentication.
FreakLegion 8mo ago
Passkeys are meant to replace passwords. Not being second factors is the point.
- embedding-shape 8mo ago
  Someone gotta tell all these SaaS about that if so, because currently everyone is treating Passkeys as an alternative to 2FA. Take a look at how GitHub handles it for example when you use TOTP, they'll ask you to replace TOTP with passkeys.
  - vladvasiliu 8mo ago
    Many do what you describe, probably because some manager somewhere needs to tick some checkbox. But GitHub, specifically, allows you to sign in with a passkey. On the sign-in page, there's a "sign in with passkey" link. It activates my 1Password extension, asking if I want to use my passkey. I say yes, and I'm in, I don't type anything. This also works the same way with my YubiKey.
  - FreakLegion 8mo ago
    They are an alternative to 2FA. Which means they aren't 2FA. If they were 2FA, they wouldn't be an alternative to 2FA. They'd just be 2FA. Anyway, passkeys and FIDO broadly aren't the same thing. You can read the definition of passkeys at https://fidoalliance.org/passkeys/ https://fidoalliance.org/passkeys/ or look at any of the marketing, which invariably talks about how great it is that you don't have to futz with passwords anymore. FIDO credentials in general can obviously also be used as second factors. This is baked into the name of the original standard: U2F, Universal 2nd Factor. The specific point of passkeys though is that they're the single factor.
- lxgr 8mo ago
  Passkeys can absolutely constitute two factors. At least the iOS and Android default implementations back user verification (which the website/relying party can explicitly request) with biometric authentication, which together with device possession makes them two factor.
JasonADrury 8mo ago
This isn't a footgun, you just have absurd security requirements. >It should be pretty obvious that using a passkey, which lives in the same password manager as your main sign-in password/passkey is not two factors. Setting it up like this would be pointless. You simply do not need two factors with passkeys. Using passkeys is not pointless, they are vastly more secure than most combined password+2fa solutions. There are extremely few contexts where an yubikey would be meaningfully safer than the secure element in your macbook.
- gregoriol 8mo ago
  2FA is more secure than 1FA even if that one has a high security level
  - PunchyHamster 8mo ago
    if 2fa is "use the second factor that's on same device as first factor" (like when using phone apps in many cases, password + 2fa from email/sms/authenticator app on same device), I disagree.
    - dwedge 8mo ago
      If I get your password, and you use 2fa that's stored on your phone, does that improve your security position or not
  - Genbox 8mo ago
    Are you saying that two weak factors are more secure than one strong factor?
    - lazide 8mo ago
      Not who you are replying too. But a yubikey is not a weak factor. In fact, it’s not even meaningfully more secure than passkey (as passkey is designed) - passkey is, however, more convenient. So it’s more ‘one weak factor + (really times) one medium/strong factor’ vs ‘one medium/strong factor’. Which yes, the first one is better in every way from a security perspective. At least in isolation. The tricky part is that passkeys for most users are way more convenient, meaning they’ll actually get used more, which means if adopted they’ll likely result in more actual security on average. Yubikeys work well if you’re paying attention, have a security mindset, don’t lose them, etc. which good luck for your average user.
lxgr 8mo ago
> It should be pretty obvious that using a passkey, which lives in the same password manager as your main sign-in password/passkey is not two factors. Setting it up like this would be pointless. If your password manager is itself protected by two factors, I'd still call this two-factor authentication.

There’s another foot gun I wrote about recently: https://cedwards.xyz/passkeys-are-not-2fa/ https://cedwards.xyz/passkeys-are-not-2fa/

by cedws 8mo ago

There’s another foot gun I wrote about recently: https://cedwards.xyz/passkeys-are-not-2fa/ https://cedwards.xyz/passkeys-are-not-2fa/

dwedge 8mo ago

I was reading your other blog post about storing them in bitwarden I have to disagree with this point: > Unless you were forced to by some organisational policy, there’s no point setting up 2FA only to reduce the effective security to 1FA because of convenience features. 2FA both stored in your password manager is less secure than storing than separately, but it still offers security compared to a single factor. The attack methods you mentioned (RAT, keylogger) require your device to be compromised, and if your device is not compromised 2fa will help you. To slip into opinion mode, I consider my password manager being compromised to be mostly total compromise anyway. Also I really like the style and font of your blog.

TacticalCoder 8mo ago
> To slip into opinion mode, I consider my password manager being compromised to be mostly total compromise anyway. But how is that no the entire point? If your 2FA is a proper device, like a Yubikey, the attack surface is tinier than tiny and the device ensures that your secret never leaves the device. We did see cases of passwords managers getting compromised. We haven't seen yet a secret being extracted from a Yubikey. So where you say you consider that your software (password manager) getting compromised is total compromise, we're saying: "as long as the HSM on a Yubikey does its job, we have actual 2FA and there cannot be a total compromise".
- dwedge 8mo ago
  You're right, I should have been more clear in that I meant a local compromise of the machine running the password manager client, not the server running the password manager itself. If my sessions and all of my data can be intercepted, the yubikey 2fa seems like it's only saving me from a token "nobody can login remotely to this one service" which at that point seems pretty moot
- fragmede 8mo ago
  Yubikey offers a false sense of security in that regard, unfortunately, because if your device is thoroughly 0wned and you don't know it, the attacker "just" has to wait for the victim to do something that would trigger the yubikey, and then swap in their forged request instead. Eg if the victim uses the yubikey to log into bank1 and to crypto wallet, but bank1 accounts have no money, instead of waiting for the customer to log into their crypto wallet with the yubikey, the attack software waits for the victim to log into bank1, but swaps in a request to the crypto wallet instead.
  - jdmoreira 8mo ago
    Not sure I understand your point. Under WebAuthn / FIDO2 you can't impersonate a RP Could you explain better?
    - gzread 8mo ago
      If the user's computer is pwned, you can wait for the user to log in to their bank account, then blank the screen while you send yourself all their money.
    - deleted 8mo ago
      [deleted]
    - fragmede 8mo ago
      WebAuthn assumes the browser is secure. If the browser is compromised, then impersonation becomes possible, so the user, thinking they're authorizing adding a new ssh key on GitHub.com by touching their yubikey, gets their money stolen by the hacked web browser because it has an invisible hidden window with bank.com waiting for yubikey authentication.

FreakLegion 8mo ago

Passkeys are meant to replace passwords. Not being second factors is the point.

embedding-shape 8mo ago
Someone gotta tell all these SaaS about that if so, because currently everyone is treating Passkeys as an alternative to 2FA. Take a look at how GitHub handles it for example when you use TOTP, they'll ask you to replace TOTP with passkeys.
- vladvasiliu 8mo ago
  Many do what you describe, probably because some manager somewhere needs to tick some checkbox. But GitHub, specifically, allows you to sign in with a passkey. On the sign-in page, there's a "sign in with passkey" link. It activates my 1Password extension, asking if I want to use my passkey. I say yes, and I'm in, I don't type anything. This also works the same way with my YubiKey.
- FreakLegion 8mo ago
  They are an alternative to 2FA. Which means they aren't 2FA. If they were 2FA, they wouldn't be an alternative to 2FA. They'd just be 2FA. Anyway, passkeys and FIDO broadly aren't the same thing. You can read the definition of passkeys at https://fidoalliance.org/passkeys/ https://fidoalliance.org/passkeys/ or look at any of the marketing, which invariably talks about how great it is that you don't have to futz with passwords anymore. FIDO credentials in general can obviously also be used as second factors. This is baked into the name of the original standard: U2F, Universal 2nd Factor. The specific point of passkeys though is that they're the single factor.
lxgr 8mo ago
Passkeys can absolutely constitute two factors. At least the iOS and Android default implementations back user verification (which the website/relying party can explicitly request) with biometric authentication, which together with device possession makes them two factor.

JasonADrury 8mo ago

This isn't a footgun, you just have absurd security requirements. >It should be pretty obvious that using a passkey, which lives in the same password manager as your main sign-in password/passkey is not two factors. Setting it up like this would be pointless. You simply do not need two factors with passkeys. Using passkeys is not pointless, they are vastly more secure than most combined password+2fa solutions. There are extremely few contexts where an yubikey would be meaningfully safer than the secure element in your macbook.

gregoriol 8mo ago
2FA is more secure than 1FA even if that one has a high security level
- PunchyHamster 8mo ago
  if 2fa is "use the second factor that's on same device as first factor" (like when using phone apps in many cases, password + 2fa from email/sms/authenticator app on same device), I disagree.
  - dwedge 8mo ago
    If I get your password, and you use 2fa that's stored on your phone, does that improve your security position or not
- Genbox 8mo ago
  Are you saying that two weak factors are more secure than one strong factor?
  - lazide 8mo ago
    Not who you are replying too. But a yubikey is not a weak factor. In fact, it’s not even meaningfully more secure than passkey (as passkey is designed) - passkey is, however, more convenient. So it’s more ‘one weak factor + (really times) one medium/strong factor’ vs ‘one medium/strong factor’. Which yes, the first one is better in every way from a security perspective. At least in isolation. The tricky part is that passkeys for most users are way more convenient, meaning they’ll actually get used more, which means if adopted they’ll likely result in more actual security on average. Yubikeys work well if you’re paying attention, have a security mindset, don’t lose them, etc. which good luck for your average user.

lxgr 8mo ago

> It should be pretty obvious that using a passkey, which lives in the same password manager as your main sign-in password/passkey is not two factors. Setting it up like this would be pointless. If your password manager is itself protected by two factors, I'd still call this two-factor authentication.