Questions tagged [fido]
FIDO (Fast IDentity Online) is a technical specification for biometric authentication to online services.
67
questions
0
votes
0
answers
56
views
FIDO Multi-device Authentication Sync Technical Specification
Where/what are the technical specifications to sync FIDO passkeys?
FIDO passkeys are a quite hot topic. There is a white paper from FIDO Alliance about it. Several websites provide abstract ...
- 191
1
vote
2
answers
62
views
Windows controlled folder access to secure Chrome cookies?
I've read about Linus Tech Tips hack, where a malware stole the browser cookies & was able to log in to Linus's channel.
Is this preventable with Windows controlled folder access (preventing apps ...
- 111
1
vote
0
answers
528
views
Reading SSH private key physically stored on yubikey to remote into external PC
I was wondering if it's possible to only store and read a ssh private key on a yubikey and not read the private key the yubikey generated from a client computer?
Currently the only way it seems to ...
- 193
2
votes
0
answers
44
views
Yubikey Private Key Generation & Storage 5 Series vs Bio Key
References:
Yubico’s Take on U2F Key Wrapping
https://www.yubico.com/blog/yubicos-u2f-key-wrapping/
Key generation
https://developers.yubico.com/U2F/Protocol_details/Key_generation.html
Discoverable ...
0
votes
1
answer
312
views
When hardening my SSH key, why would I use yubikey-agent instead of the built-in `-sk` key type native to OpenSSH?
OpenSSH 8.2 added -sk key types that allow for FIDO/U2F hardware authenticators (like a YubiKey, etc.)
yubikey-agent allows for the same functionality, except it (a) requires an additional client on ...
- 91
0
votes
0
answers
106
views
Solutions for out of band biometric login
I am enhancing our login flow to include biometric verification via your phone. The user will log in to the desktop app but will have to verify their identity via their phone. We already have an app ...
- 101
3
votes
1
answer
524
views
Is FIDO2 authentication vulnerable to a social engineering replay attack?
I'm starting to learn about the FIDO2 standard, and I'm wondering if this scenario is possible...
Victim visits a credential harvesting page and enters their credentials
Credential harvesting backend ...
- 835
20
votes
5
answers
3k
views
Why do some FIDO security fobs use keyboard emulation mode?
I was troubled from the very beginning by the fact that my U2F security fob acts as a keyboard and theoretically is able to press any key when no one is looking. Sometimes I accidentally touch it and ...
- 301
1
vote
0
answers
113
views
Fido U2F, can a modified client theoretically register the same key multiple times? YubiKey Wrapped PrivateKey Method
Context
I was answering a question about how YubiKey can generate "infinite" keypairs for Fido U2F but doesn't need to store them locally.
This leads to my initial question:
Initial Question
...
- 183
0
votes
0
answers
89
views
How to best support multiple hardware keys (yubikeys, etc.) as a web app?
I've implemented second factor authentication for my web app via FIDO U2F, and am testing using a Yubikey.
I have read that it is best practice to associate multiple hardware keys in case one is lost, ...
- 143
7
votes
1
answer
260
views
How sensitive is the primary key stub of an ed25519 security key (~/.ssh/id_ed25519_sk)?
Now that OpenSSH supports Elliptic curve security keys (since version 8.2), it's possible to generate a ed25519-sk key on a hardware security key:
$ ssh-keygen -t ed25519-sk -C comment
This generates ...
- 507
0
votes
1
answer
530
views
Why my yubikey is not protected by a PIN to log into Google?
I just setted my yubikey on Google so I can login into Google without any passwords. However, I don't even have to put a PIN on the yubikey, it simply works. I find this very very dangerous as anyone ...
- 415
0
votes
1
answer
485
views
Can yubikeys prevent cookie stealing?
When you log into a website, it stores cookies that let your browser access the website without having the password.
Given that some sites support yubikey for login, does it mean that the yubikey ...
- 415
7
votes
1
answer
4k
views
How does ed25519-sk actually works?
My google-foo failed me as most "how it works" sections related to fido are very... let's say... consumer-oriented.
So openssh supports U2F natively when using the appropriate elliptic-curve-...
- 73
0
votes
1
answer
89
views
Does moving webAuthn API from browser to OS improves security of registration process?
Usually, for all types of authentications, we trust the registration process and assume there is no attack is happening Like in the case of FIDO2 registration. However, as the registration process is ...
- 81
1
vote
1
answer
304
views
What is the equivalent of "forgot password" in password-less login applications using FIDO2 / Webauthn or later?
I'm assuming instead of saying "forgot password?" the text would say "lost your key?" or "don't have your device?". But what would the process of secondary access look ...
- 837
1
vote
1
answer
304
views
Why isn't U2F's CTAP protocol forwards-compatible with FIDO2's CTAP protocol?
I've been trying to find the major differences between "U2F" versus "FIDO2" two-factor authentication standards. Reading some of the articles posted by different companies and even ...
- 131
2
votes
3
answers
2k
views
Why would a U2F key be more secured than an OTP device?
I have a Yubikey 5, I can store a PGP key inside, it has OTP abilities, FIDO, NFC, etc... Which is great for a device like this.
First of all, I understand how a smart card is more secured than an app/...
- 195
2
votes
1
answer
2k
views
Implementing FIDO2 (WebAuthN) in Native iOS
I am currently investigating the idea of implementing FIDO2 (WebAuthN) support in native iOS using Swift. I understand that there is no FIDO2 support in native iOS, and only available through Safari ...
- 21
0
votes
1
answer
356
views
Are hardware security keys (e.g ones supporting Fido2) "able to protect authentication" even in case of compromised hosts?
Correct me if I am wrong, please.
I understand that 2FA (MFA) increases account security in case an attacker obtains a password which might be possible via various ways, e.g. phishing, database breach,...
- 3
8
votes
2
answers
3k
views
Where are FIDO U2F Keys Stored?
I'm getting conflicting information on how the security keys are stored and used. Where are the public and private keys stored? If the private key is stored on the Yubikey itself, how many can it hold?...
- 83
0
votes
1
answer
192
views
Can FIDO be implemented for a Use Case which Allows the Use of Shared Devices?
I am a part of an organization that is developing a website that required user authentication, and we are strongly considering FIDO compliance.
However, our use case requires users to be able to log-...
- 135
1
vote
1
answer
213
views
FIDO2 - Where do Android and IOS platform authenticators store private key credentials?
I'm new to FIDO2 specification.
I'm aware that Android and IOS devices support FIDO2 protocols (even Android phones could act as a physical key for FIDO2 authentication).
However, Could anyone let me ...
4
votes
1
answer
558
views
Benefit of using OpenSSH FIDO/U2F support over GPG mode?
OpenSSH version 8.2 introduced support for FIDO/U2F hardware authenticators, via the new public key types "ecdsa-sk" and "ed25519-sk".
I currently have SSH authentication set up in combination with ...
- 141
5
votes
1
answer
666
views
How does the attestation mechanism of U2F guarantee the provenance of the key material?
I'm trying to understand Yubico's documentation of the U2F standard, and getting hung up on the PIV attestation piece.
The security claim appears to be that the authoritatively-signed attestation ...
- 323
1
vote
0
answers
102
views
WebAuthn Variation with non-connect dongle Authenticator
As I read through the WebAuthn / FIDO2 documentation, it appears the authentication is done on the local device to create an attestation to the FIDO server. This future implies the "biometrics" or ...
- 111
6
votes
2
answers
290
views
Does injecting my own key material into the authenticator undermine authenticator's attestation?
I'd like to be able to inject my own key material in the FIDO2 authenticator; at the very least it will remove the need to trust the vendor (because we have no guarantee whether the vendor keeps ...
- 195
15
votes
1
answer
7k
views
FIDO and FIDO2 differences
I've been reading both FIDO and FIDO2 specs for a while tring to understand the similarities and differences between both. Here is how I broke it down so far:
FIDO: First iteration in creating a ...
- 448
1
vote
0
answers
146
views
Practicality of Direct Anonymous Attestation [closed]
DAA (Direct Anonymous Attestation) is not the only scheme to achieve anonymous attestation. In general, these schemes allow an entity to stay anonymous throughout the attestation process. The concern ...
- 111
2
votes
0
answers
1k
views
Can an Android Phone be used as a Windows Hello Security Key?
Microsoft Windows 10 does support physical security keys since some time.
Google recently announced that Android phones can be used as security keys as well (primarily for their own services).
Is ...
3
votes
1
answer
1k
views
FIDO U2F - MacOS TouchBar
I understand how FIDO works with yubikey: Yubikey device has a symmetric key and it uses appId, nonce and symmetric key to generate key pair for a website. And the device gives back public key and ...
- 163
1
vote
2
answers
576
views
Hardware security key with locked down usb slots
I would like to use hardware security keys in an environment where it is additionally needed to lock down any ways in which a user could download data to a device like a usb key. Is it possible to ...
- 25
1
vote
1
answer
218
views
FIDO2: will FIDO foundation MDS 1.0 metadata statements be migrated to MDS 2.0?
The FIDO foundation provides with metadata web service for UAF (MDS 1.0, https://mds.fidoalliance.org/) and a new web services for FIDO2 / WebAuthn metadata (MDS 2.0, see https://fidoalliance.org/...
- 433
6
votes
1
answer
2k
views
How do FIDO keys prevent MITM reflection attacks?
FIDO keys, used for 2 factor authentication are based on a challenge-response mechanism.
Besides generating a common 1-time-key using diffie-hellman, or transferring all data over TLS, how can they ...
- 163
0
votes
0
answers
166
views
Storing TOTP codes on a Feiteian ePass FIDO key
I'm looking for some Android apps that can store / read TOTP codes off of a Feitian ePass FIDO key using NFC. There appears to be a fairly simple way with a yubico key / and key but I don't know how ...
- 133
1
vote
1
answer
382
views
Does FIDO2 token works as two-factor on password-less authentication?
As authentication factors, I know the following
You are (e.g. Biometrics)
You have (e.g. USB)
You know (e.g. Password)
If I use a FIDO2 certified fingerprint reader for password-less authentication ...
- 113
0
votes
1
answer
398
views
Which party stores the link between user and device in WebAuthn?
Looking at the online resources regarding WebAuthn, I still haven't been able to figure out which of the involved components (or parties) that store the link between the user and his/her authenticator ...
- 125
3
votes
2
answers
489
views
Is using WebAuthn alone considered as two factor authentication?
Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication.
For a true two factor authentication you ...
- 31
2
votes
1
answer
3k
views
FIDO2 on Windows: Why do I need a TPM?
I just installed the Windows 10 1809 update, which includes support for FIDO2 passwordless sign-in. I own a Yubikey 5, which supports this standard. However, I am not able to set up Windows Hello, a ...
2
votes
1
answer
269
views
A FIDO U2F Device relies on public/private keys. Do they expire like in regular x509 certificates?
A FIDO U2F Device relies on public/private keys. Do they expire like in regular x509 certificates ?
- 123
9
votes
2
answers
380
views
Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?
According to the Google information page here: https://support.google.com/accounts/answer/6103523
If you don’t have another second step or forgot your password
Note:
2-Step Verification requires an ...
- 220
5
votes
1
answer
1k
views
password managers and FIDO
I've just been reading some posts about FIDO support (or the lack thereof) in password managers and want to check whether my understanding is correct.
My understanding of FIDO (v1) is that the device ...
user16214
2
votes
1
answer
286
views
Can an infected endpoint steal private keys from a FIDO U2F Hardware Token / Yubikey?
Is it possible for an infected endpoint to steal private keys from a FIDO U2F Hardware Token / Yubikey? What attacks exist against these hardware tokens? What mitigations are possible? For the scope ...
user115400
4
votes
0
answers
446
views
U2F FIDO sends identifiable serial numbers
As all of the FIDO Alliance documents state, the FIDO U2F protocols should never be able to abused to identify whether a user has multiple accounts with one service, or for services to collude and ...
- 41
2
votes
1
answer
2k
views
Webauthn configuration differences in Firefox
I'm trying to understand what the different configuration elements mean in Mozilla Firefox. There was an announcement recently from Dropbox that they had enabled support for WebAuthn. I tried logging ...
- 837
1
vote
1
answer
475
views
Handling the loss of a phone with FIDO UAF
I would like to know how this UAF method works when we lose our phone. With Google Authenticator we have to save on a paper some info about the generation of the secret key. But how does this work ...
- 113
1
vote
0
answers
385
views
How exactly do Fido Keys work? [closed]
Recently I acquired a security Fido key that allows me to use the U2F protocol on some of my accounts. Now I know that these keys use public/private keys for the specified account but I'm stuck on the ...
- 133
1
vote
0
answers
133
views
Are all the FIDO U2F tools from Yubico cross-compatible
So I recently got myself one U2F security key to experiment with all the services that support it. However I didn't go for the mainstream option (Yubikey) since most models are quite expensive for my ...
- 111
2
votes
1
answer
808
views
Why doesn't a device with x509/PKCS#11 and U2F exist?
I've been looking for a device, smartcard or USB that does two things:
provide storage to a private digital signature key (used with in a standard x509 certificate) for signing documents
provide ...
- 121
3
votes
1
answer
714
views
U2F protocol - Counter value & device cloning
My question is about the U2F protocol and more precisely cloning detection.
According to the doc :
"If there is a possibility that a U2F token can be cloned, we also need some way to detect it. We ...
- 55