Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [fido]

FIDO (Fast IDentity Online) is a technical specification for biometric authentication to online services.

1
vote
1answer
798 views

Webauthn configuration differences in Firefox

I'm trying to understand what the different configuration elements mean in Mozilla Firefox. There was an announcement recently from Dropbox that they had enabled support for WebAuthn. I tried logging ...
6
votes
2answers
1k views

Why is FIDO U2F an entirely different standard from FIDO UAF instead of just a subset?

As you may already be aware, the Universal 2nd Factor (U2F) standard is a standard for 2nd-factor authentication which allows users to authenticate to web applications using a USB hardware token. ...
1
vote
1answer
69 views

FIDO2: will FIDO foundation MDS 1.0 metadata statements be migrated to MDS 2.0?

The FIDO foundation provides with metadata web service for UAF (MDS 1.0, https://mds.fidoalliance.org/) and a new web services for FIDO2 / WebAuthn metadata (MDS 2.0, see https://fidoalliance.org/...
1
vote
1answer
191 views

Is using WebAuthn alone considered as two factor authentication?

Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication. For a true two factor authentication you ...
3
votes
1answer
477 views

In the context of FIDO U2F, when is a new ephemeral key reused, or cached?

I'm reading this paper from Yubico on Universal Second Factor and OpenID Connect and see the description about ephemeral keys I'm confused on when a ephemeral key is used, and under what conditions ...
0
votes
0answers
56 views

Storing TOTP codes on a Feiteian ePass FIDO key

I'm looking for some Android apps that can store / read TOTP codes off of a Feitian ePass FIDO key using NFC. There appears to be a fairly simple way with a yubico key / and key but I don't know how ...
0
votes
1answer
91 views

How do FIDO keys prevent MITM reflection attacks?

FIDO keys, used for 2 factor authentication are based on a challenge-response mechanism. Besides generating a common 1-time-key using diffie-hellman, or transferring all data over TLS, how can they ...
0
votes
1answer
80 views

Does FIDO2 token works as two-factor on password-less authentication?

As authentication factors, I know the following You are (e.g. Biometrics) You have (e.g. USB) You know (e.g. Password) If I use a FIDO2 certified fingerprint reader for password-less authentication ...
0
votes
1answer
53 views

Which party stores the link between user and device in WebAuthn?

Looking at the online resources regarding WebAuthn, I still haven't been able to figure out which of the involved components (or parties) that store the link between the user and his/her authenticator ...
8
votes
2answers
184 views

Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?

According to the Google information page here: https://support.google.com/accounts/answer/6103523 If you don’t have another second step or forgot your password Note: 2-Step Verification ...
1
vote
1answer
254 views

FIDO2 on Windows: Why do I need a TPM?

I just installed the Windows 10 1809 update, which includes support for FIDO2 passwordless sign-in. I own a Yubikey 5, which supports this standard. However, I am not able to set up Windows Hello, a ...
1
vote
1answer
60 views

A FIDO U2F Device relies on public/private keys. Do they expire like in regular x509 certificates?

A FIDO U2F Device relies on public/private keys. Do they expire like in regular x509 certificates ?
2
votes
0answers
272 views

password managers and FIDO

I've just been reading some posts about FIDO support (or the lack thereof) in password managers and want to check whether my understanding is correct. My understanding of FIDO (v1) is that the device ...
0
votes
1answer
109 views

Can an infected endpoint steal private keys from a FIDO U2F Hardware Token / Yubikey?

Is it possible for an infected endpoint to steal private keys from a FIDO U2F Hardware Token / Yubikey? What attacks exist against these hardware tokens? What mitigations are possible? For the scope ...
1
vote
1answer
190 views

Handling the loss of a phone with FIDO UAF

I would like to know how this UAF method works when we lose our phone. With Google Authenticator we have to save on a paper some info about the generation of the secret key. But how does this work ...
5
votes
1answer
962 views

How should I implement FIDO UAF architecture?

I'm new to FIDO (Fast IDentity Online), and want to add FIDO UAF (Universal Authentication Framework) support to my website. I've few queries: Suppose, I've built my own FIDO Client. Is there any ...
3
votes
0answers
167 views

U2F FIDO sends identifiable serial numbers

As all of the FIDO Alliance documents state, the FIDO U2F protocols should never be able to abused to identify whether a user has multiple accounts with one service, or for services to collude and ...
7
votes
2answers
1k views

Can a FIDO U2F device be used for symmetric encryption?

As I understand, U2F is mainly used for authentication. It uses challenge-response scheme to check if the device used for logging in is the same device which was used during registration based on ...
1
vote
0answers
209 views

How exactly do Fido Keys work? [closed]

Recently I acquired a security Fido key that allows me to use the U2F protocol on some of my accounts. Now I know that these keys use public/private keys for the specified account but I'm stuck on the ...
1
vote
0answers
84 views

Are all the FIDO U2F tools from Yubico cross-compatible

So I recently got myself one U2F security key to experiment with all the services that support it. However I didn't go for the mainstream option (Yubikey) since most models are quite expensive for my ...
2
votes
1answer
353 views

Why doesn't a device with x509/PKCS#11 and U2F exist?

I've been looking for a device, smartcard or USB that does two things: provide storage to a private digital signature key (used with in a standard x509 certificate) for signing documents provide ...
4
votes
1answer
845 views

Using Fido U2F or similar as primary authentication method?

I've been wondering about this for a while, but couldn't find much on the web, so I hope that someone could point me in the right direction for better understanding about this topic. Would it be ...
125
votes
6answers
43k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
2
votes
1answer
401 views

U2F protocol - Counter value & device cloning

My question is about the U2F protocol and more precisely cloning detection. According to the doc : "If there is a possibility that a U2F token can be cloned, we also need some way to detect it. We ...
5
votes
1answer
2k views

MITM attacks on FIDO UAF and U2F [closed]

In Section 6 of the Universal 2nd Factor (U2F) Overview, where MITM attacks are discussed – near the end of the section, it reads: It is still possible to MITM a user's authentication to a site if ...
8
votes
1answer
783 views

From a credential flow perspective, whats the difference between FIDO UAF and FIDO 2.0 Web Services?

The FIDO Standard allows for devices and authentication schemes to be certified as UAF or U2F. This allows for flexible unified authentication, and optional second factor enrollment and registration. ...
2
votes
3answers
1k views

Vulnerabilities despite FIDO U2F?

FIDO U2F seems much more secure than one-time-passwords (OTP), especially TOTP, because of the challenge-response architecture. In what ways is a U2F user still vulnerable? I presume if a user's ...
0
votes
1answer
78 views

Can counter-based OTPs instantly be reused at multiple services?

I am reading about hardware-based 2FA and wonder about counter-based OTPs generated from, for example, a Yubikey. I have read that in these cases, a push of a button generates a string composed of a ...
18
votes
1answer
2k views

FIDO, U2F Compatibility

I've been following the FIDO standard (a consumer-friendly public-key system similar to SSH key pairs) and it appears that it's close to being complete: both Google and PayPal have been testing it ...
1
vote
1answer
238 views

What data is sent between an NFC/BTLE FIDO U2F device and Chrome (or other agent)?

I need to explain what "conversation" occurs between a FIDO U2F device (YubiKey NEO) and the agent (Chrome). I want to know if it's a challenge response, and ultimately figure out how much ...
0
votes
2answers
357 views

Multiple tokens support for FIDO u2F

I am implementing a web service to support U2F. I need users to be able to register more than one token to their account. How should the authentication request message look when we have more than 1 ...
9
votes
3answers
2k views

Why is U2F not good enough to be used as authentication?

In the context of low- and mid-security applications (ie, 95% of the web), why isn't U2F good enough to be the only factor? As far as I can tell, U2F very securely implements the "something you have" ...
7
votes
1answer
173 views

Fido: trusting user-agent

As I went through Fido specifications: the server (providing web app/services) need to trust user agent for local fido authentication and if needed can enforce certain policies" I am not sure ...
6
votes
1answer
956 views

Are there any risks associated with using a single U2F/FIDO key with multiple sets of credentials?

I recently got a FIDO U2F key (AKA a Yubikey). I currently only use it across a range of services, but could this be a security risk in any way? For example, if I use my U2F key to authenticate on a ...
13
votes
1answer
248 views

How can mobile sign-on be secured from imposter authentication screens?

History seems to have come almost full circle where old issues are shown in new/emerging technologies. Background If you trust the operating system, Windows originally had the Control - Alt - Delete ...