Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [fido]

FIDO (Fast IDentity Online) is a technical specification for biometric authentication to online services.

1
vote
1answer
55 views

Is using WebAuthn alone considered as two factor authentication?

Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication. For a true two factor authentication you ...
1
vote
1answer
70 views

FIDO2 on Windows: Why do I need a TPM?

I just installed the Windows 10 1809 update, which includes support for FIDO2 passwordless sign-in. I own a Yubikey 5, which supports this standard. However, I am not able to set up Windows Hello, a ...
1
vote
1answer
48 views

A FIDO U2F Device relies on public/private keys. Do they expire like in regular x509 certificates?

A FIDO U2F Device relies on public/private keys. Do they expire like in regular x509 certificates ?
7
votes
2answers
158 views

Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?

According to the Google information page here: https://support.google.com/accounts/answer/6103523 If you don’t have another second step or forgot your password Note: 2-Step Verification ...
2
votes
0answers
103 views

password managers and FIDO

I've just been reading some posts about FIDO support (or the lack thereof) in password managers and want to check whether my understanding is correct. My understanding of FIDO (v1) is that the device ...
0
votes
1answer
80 views

Can an infected endpoint steal private keys from a FIDO U2F Hardware Token / Yubikey?

Is it possible for an infected endpoint to steal private keys from a FIDO U2F Hardware Token / Yubikey? What attacks exist against these hardware tokens? What mitigations are possible? For the scope ...
3
votes
0answers
105 views

U2F FIDO sends identifiable serial numbers

As all of the FIDO Alliance documents state, the FIDO U2F protocols should never be able to abused to identify whether a user has multiple accounts with one service, or for services to collude and ...
1
vote
1answer
464 views

Webauthn configuration differences in Firefox

I'm trying to understand what the different configuration elements mean in Mozilla Firefox. There was an announcement recently from Dropbox that they had enabled support for WebAuthn. I tried logging ...
1
vote
1answer
143 views

Handling the loss of a phone with FIDO UAF

I would like to know how this UAF method works when we lose our phone. With Google Authenticator we have to save on a paper some info about the generation of the secret key. But how does this work ...
1
vote
0answers
143 views

How exactly do Fido Keys work? [closed]

Recently I acquired a security Fido key that allows me to use the U2F protocol on some of my accounts. Now I know that these keys use public/private keys for the specified account but I'm stuck on the ...
1
vote
0answers
78 views

Are all the FIDO U2F tools from Yubico cross-compatible

So I recently got myself one U2F security key to experiment with all the services that support it. However I didn't go for the mainstream option (Yubikey) since most models are quite expensive for my ...
2
votes
1answer
267 views

Why doesn't a device with x509/PKCS#11 and U2F exist?

I've been looking for a device, smartcard or USB that does two things: provide storage to a private digital signature key (used with in a standard x509 certificate) for signing documents provide ...
2
votes
1answer
342 views

U2F protocol - Counter value & device cloning

My question is about the U2F protocol and more precisely cloning detection. According to the doc : "If there is a possibility that a U2F token can be cloned, we also need some way to detect it. We ...
4
votes
1answer
2k views

MITM attacks on FIDO UAF and U2F [closed]

In Section 6 of the Universal 2nd Factor (U2F) Overview, where MITM attacks are discussed – near the end of the section, it reads: It is still possible to MITM a user's authentication to a site if ...
5
votes
1answer
858 views

How should I implement FIDO UAF architecture?

I'm new to FIDO (Fast IDentity Online), and want to add FIDO UAF (Universal Authentication Framework) support to my website. I've few queries: Suppose, I've built my own FIDO Client. Is there any ...
6
votes
2answers
1k views

Why is FIDO U2F an entirely different standard from FIDO UAF instead of just a subset?

As you may already be aware, the Universal 2nd Factor (U2F) standard is a standard for 2nd-factor authentication which allows users to authenticate to web applications using a USB hardware token. ...
2
votes
1answer
410 views

In the context of FIDO U2F, when is a new ephemeral key reused, or cached?

I'm reading this paper from Yubico on Universal Second Factor and OpenID Connect and see the description about ephemeral keys I'm confused on when a ephemeral key is used, and under what conditions ...
3
votes
1answer
671 views

Using Fido U2F or similar as primary authentication method?

I've been wondering about this for a while, but couldn't find much on the web, so I hope that someone could point me in the right direction for better understanding about this topic. Would it be ...
0
votes
1answer
68 views

Can counter-based OTPs instantly be reused at multiple services?

I am reading about hardware-based 2FA and wonder about counter-based OTPs generated from, for example, a Yubikey. I have read that in these cases, a push of a button generates a string composed of a ...
1
vote
1answer
233 views

What data is sent between an NFC/BTLE FIDO U2F device and Chrome (or other agent)?

I need to explain what "conversation" occurs between a FIDO U2F device (YubiKey NEO) and the agent (Chrome). I want to know if it's a challenge response, and ultimately figure out how much ...
8
votes
1answer
715 views

From a credential flow perspective, whats the difference between FIDO UAF and FIDO 2.0 Web Services?

The FIDO Standard allows for devices and authentication schemes to be certified as UAF or U2F. This allows for flexible unified authentication, and optional second factor enrollment and registration. ...
0
votes
2answers
324 views

Multiple tokens support for FIDO u2F

I am implementing a web service to support U2F. I need users to be able to register more than one token to their account. How should the authentication request message look when we have more than 1 ...
7
votes
2answers
1k views

Can a FIDO U2F device be used for symmetric encryption?

As I understand, U2F is mainly used for authentication. It uses challenge-response scheme to check if the device used for logging in is the same device which was used during registration based on ...
6
votes
1answer
845 views

Are there any risks associated with using a single U2F/FIDO key with multiple sets of credentials?

I recently got a FIDO U2F key (AKA a Yubikey). I currently only use it across a range of services, but could this be a security risk in any way? For example, if I use my U2F key to authenticate on a ...
9
votes
3answers
2k views

Why is U2F not good enough to be used as authentication?

In the context of low- and mid-security applications (ie, 95% of the web), why isn't U2F good enough to be the only factor? As far as I can tell, U2F very securely implements the "something you have" ...
13
votes
1answer
242 views

How can mobile sign-on be secured from imposter authentication screens?

History seems to have come almost full circle where old issues are shown in new/emerging technologies. Background If you trust the operating system, Windows originally had the Control - Alt - Delete ...
2
votes
3answers
1k views

Vulnerabilities despite FIDO U2F?

FIDO U2F seems much more secure than one-time-passwords (OTP), especially TOTP, because of the challenge-response architecture. In what ways is a U2F user still vulnerable? I presume if a user's ...
6
votes
1answer
167 views

Fido: trusting user-agent

As I went through Fido specifications: the server (providing web app/services) need to trust user agent for local fido authentication and if needed can enforce certain policies" I am not sure ...
124
votes
6answers
42k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
18
votes
1answer
2k views

FIDO, U2F Compatibility

I've been following the FIDO standard (a consumer-friendly public-key system similar to SSH key pairs) and it appears that it's close to being complete: both Google and PayPal have been testing it ...