Skip to main content

Questions tagged [fido]

FIDO (Fast IDentity Online) is a technical specification for biometric authentication to online services.

Filter by
Sorted by
Tagged with
0 votes
1 answer
66 views

Suggestions for implementing a simplified subset of WebAuthn Relaying Party Operation

Previously some good fellow explained the importance of verifying the public key created and offered by authenticators. As before, given the complexity of a FULL implementation of RP operation, I ...
DannyNiu's user avatar
  • 374
0 votes
1 answer
130 views

Will sky fall if I don't verify `AuthenticatorAttestationResponse`?

Through reading the WebAuthn spec and related MDN docs, I understand that unlike "certificate signing requests", FIDO/Passkey can have various different attestation formats and verification ...
DannyNiu's user avatar
  • 374
1 vote
1 answer
167 views

Is FIDO authN vulnerable to relay attacks?

In this question: Is FIDO2 authentication vulnerable to a social engineering replay attack? it was answered that no, not vulnerable because "the keypair used to by the FIDO device to authenticate ...
Allexj's user avatar
  • 137
0 votes
0 answers
14 views

Why does FIDO2's spec not mention FIDO UAF as a related standard? [duplicate]

Why does FIDO2's spec not mention FIDO UAF as a related standard? I wonder if FIDO UAF is still relevant. Will FIDO UAF be deprecated eventually in favor of FIDO2? Why do they co-exist if they fulfil ...
kinafu's user avatar
  • 101
1 vote
0 answers
175 views

FIDO Multi-device Authentication Sync Technical Specification

Where/what are the technical specifications to sync FIDO passkeys? FIDO passkeys are a quite hot topic. There is a white paper from FIDO Alliance about it. Several websites provide abstract ...
ndbd's user avatar
  • 201
1 vote
2 answers
151 views

Windows controlled folder access to secure Chrome cookies?

I've read about Linus Tech Tips hack, where a malware stole the browser cookies & was able to log in to Linus's channel. Is this preventable with Windows controlled folder access (preventing apps ...
Ninja Dev's user avatar
  • 111
1 vote
0 answers
1k views

Reading SSH private key physically stored on yubikey to remote into external PC

I was wondering if it's possible to only store and read a ssh private key on a yubikey and not read the private key the yubikey generated from a client computer? Currently the only way it seems to ...
SneakyShrike's user avatar
2 votes
0 answers
95 views

Yubikey Private Key Generation & Storage 5 Series vs Bio Key

References: Yubico’s Take on U2F Key Wrapping https://www.yubico.com/blog/yubicos-u2f-key-wrapping/ Key generation https://developers.yubico.com/U2F/Protocol_details/Key_generation.html Discoverable ...
CyberMedics.org's user avatar
1 vote
1 answer
471 views

When hardening my SSH key, why would I use yubikey-agent instead of the built-in `-sk` key type native to OpenSSH?

OpenSSH 8.2 added -sk key types that allow for FIDO/U2F hardware authenticators (like a YubiKey, etc.) yubikey-agent allows for the same functionality, except it (a) requires an additional client on ...
angryserver's user avatar
0 votes
0 answers
158 views

Solutions for out of band biometric login

I am enhancing our login flow to include biometric verification via your phone. The user will log in to the desktop app but will have to verify their identity via their phone. We already have an app ...
Decrypter's user avatar
  • 101
3 votes
1 answer
798 views

Is FIDO2 authentication vulnerable to a social engineering replay attack?

I'm starting to learn about the FIDO2 standard, and I'm wondering if this scenario is possible... Victim visits a credential harvesting page and enters their credentials Credential harvesting backend ...
Sean W.'s user avatar
  • 845
20 votes
5 answers
4k views

Why do some FIDO security fobs use keyboard emulation mode?

I was troubled from the very beginning by the fact that my U2F security fob acts as a keyboard and theoretically is able to press any key when no one is looking. Sometimes I accidentally touch it and ...
IlliakaillI's user avatar
1 vote
0 answers
164 views

Fido U2F, can a modified client theoretically register the same key multiple times? YubiKey Wrapped PrivateKey Method

Context I was answering a question about how YubiKey can generate "infinite" keypairs for Fido U2F but doesn't need to store them locally. This leads to my initial question: Initial Question ...
PathToLife's user avatar
0 votes
0 answers
138 views

How to best support multiple hardware keys (yubikeys, etc.) as a web app?

I've implemented second factor authentication for my web app via FIDO U2F, and am testing using a Yubikey. I have read that it is best practice to associate multiple hardware keys in case one is lost, ...
Julian H. Lam's user avatar
8 votes
1 answer
399 views

How sensitive is the primary key stub of an ed25519 security key (~/.ssh/id_ed25519_sk)?

Now that OpenSSH supports Elliptic curve security keys (since version 8.2), it's possible to generate a ed25519-sk key on a hardware security key: $ ssh-keygen -t ed25519-sk -C comment This generates ...
Petr's user avatar
  • 517
0 votes
1 answer
833 views

Why my yubikey is not protected by a PIN to log into Google?

I just setted my yubikey on Google so I can login into Google without any passwords. However, I don't even have to put a PIN on the yubikey, it simply works. I find this very very dangerous as anyone ...
Guerlando OCs's user avatar
0 votes
1 answer
662 views

Can yubikeys prevent cookie stealing?

When you log into a website, it stores cookies that let your browser access the website without having the password. Given that some sites support yubikey for login, does it mean that the yubikey ...
Guerlando OCs's user avatar
9 votes
1 answer
5k views

How does ed25519-sk actually works?

My google-foo failed me as most "how it works" sections related to fido are very... let's say... consumer-oriented. So openssh supports U2F natively when using the appropriate elliptic-curve-...
Jane's user avatar
  • 93
0 votes
1 answer
122 views

Does moving webAuthn API from browser to OS improves security of registration process?

Usually, for all types of authentications, we trust the registration process and assume there is no attack is happening Like in the case of FIDO2 registration. However, as the registration process is ...
tarun14110's user avatar
3 votes
1 answer
416 views

What is the equivalent of "forgot password" in password-less login applications using FIDO2 / Webauthn or later?

I'm assuming instead of saying "forgot password?" the text would say "lost your key?" or "don't have your device?". But what would the process of secondary access look ...
eternaltyro's user avatar
1 vote
1 answer
391 views

Why isn't U2F's CTAP protocol forwards-compatible with FIDO2's CTAP protocol?

I've been trying to find the major differences between "U2F" versus "FIDO2" two-factor authentication standards. Reading some of the articles posted by different companies and even ...
natevw's user avatar
  • 131
2 votes
3 answers
3k views

Why would a U2F key be more secured than an OTP device?

I have a Yubikey 5, I can store a PGP key inside, it has OTP abilities, FIDO, NFC, etc... Which is great for a device like this. First of all, I understand how a smart card is more secured than an app/...
Max13's user avatar
  • 195
2 votes
1 answer
3k views

Implementing FIDO2 (WebAuthN) in Native iOS

I am currently investigating the idea of implementing FIDO2 (WebAuthN) support in native iOS using Swift. I understand that there is no FIDO2 support in native iOS, and only available through Safari ...
Go James 's user avatar
0 votes
1 answer
508 views

Are hardware security keys (e.g ones supporting Fido2) "able to protect authentication" even in case of compromised hosts?

Correct me if I am wrong, please. I understand that 2FA (MFA) increases account security in case an attacker obtains a password which might be possible via various ways, e.g. phishing, database breach,...
Big X's user avatar
  • 3
10 votes
2 answers
4k views

Where are FIDO U2F Keys Stored?

I'm getting conflicting information on how the security keys are stored and used. Where are the public and private keys stored? If the private key is stored on the Yubikey itself, how many can it hold?...
Derpy's user avatar
  • 103
0 votes
1 answer
240 views

Can FIDO be implemented for a Use Case which Allows the Use of Shared Devices?

I am a part of an organization that is developing a website that required user authentication, and we are strongly considering FIDO compliance. However, our use case requires users to be able to log-...
Heshan Perera's user avatar
1 vote
1 answer
345 views

FIDO2 - Where do Android and IOS platform authenticators store private key credentials?

I'm new to FIDO2 specification. I'm aware that Android and IOS devices support FIDO2 protocols (even Android phones could act as a physical key for FIDO2 authentication). However, Could anyone let me ...
Danh Thanh Nguyen's user avatar
5 votes
1 answer
651 views

Benefit of using OpenSSH FIDO/U2F support over GPG mode?

OpenSSH version 8.2 introduced support for FIDO/U2F hardware authenticators, via the new public key types "ecdsa-sk" and "ed25519-sk". I currently have SSH authentication set up in combination with ...
nyronium's user avatar
  • 151
5 votes
1 answer
743 views

How does the attestation mechanism of U2F guarantee the provenance of the key material?

I'm trying to understand Yubico's documentation of the U2F standard, and getting hung up on the PIV attestation piece. The security claim appears to be that the authoritatively-signed attestation ...
Dan Lenski's user avatar
1 vote
0 answers
126 views

WebAuthn Variation with non-connect dongle Authenticator

As I read through the WebAuthn / FIDO2 documentation, it appears the authentication is done on the local device to create an attestation to the FIDO server. This future implies the "biometrics" or ...
mazecreator's user avatar
6 votes
2 answers
322 views

Does injecting my own key material into the authenticator undermine authenticator's attestation?

I'd like to be able to inject my own key material in the FIDO2 authenticator; at the very least it will remove the need to trust the vendor (because we have no guarantee whether the vendor keeps ...
Dmitry Frank's user avatar
18 votes
1 answer
7k views

FIDO and FIDO2 differences

I've been reading both FIDO and FIDO2 specs for a while tring to understand the similarities and differences between both. Here is how I broke it down so far: FIDO: First iteration in creating a ...
Filipe Rodrigues's user avatar
1 vote
0 answers
179 views

Practicality of Direct Anonymous Attestation [closed]

DAA (Direct Anonymous Attestation) is not the only scheme to achieve anonymous attestation. In general, these schemes allow an entity to stay anonymous throughout the attestation process. The concern ...
Consy's user avatar
  • 111
3 votes
0 answers
2k views

Can an Android Phone be used as a Windows Hello Security Key?

Microsoft Windows 10 does support physical security keys since some time. Google recently announced that Android phones can be used as security keys as well (primarily for their own services). Is ...
Christopher Oezbek's user avatar
3 votes
1 answer
1k views

FIDO U2F - MacOS TouchBar

I understand how FIDO works with yubikey: Yubikey device has a symmetric key and it uses appId, nonce and symmetric key to generate key pair for a website. And the device gives back public key and ...
Jack's user avatar
  • 173
1 vote
2 answers
748 views

Hardware security key with locked down usb slots

I would like to use hardware security keys in an environment where it is additionally needed to lock down any ways in which a user could download data to a device like a usb key. Is it possible to ...
Elsie's user avatar
  • 25
1 vote
1 answer
244 views

FIDO2: will FIDO foundation MDS 1.0 metadata statements be migrated to MDS 2.0?

The FIDO foundation provides with metadata web service for UAF (MDS 1.0, https://mds.fidoalliance.org/) and a new web services for FIDO2 / WebAuthn metadata (MDS 2.0, see https://fidoalliance.org/...
Tangui's user avatar
  • 443
6 votes
1 answer
2k views

How do FIDO keys prevent MITM reflection attacks?

FIDO keys, used for 2 factor authentication are based on a challenge-response mechanism. Besides generating a common 1-time-key using diffie-hellman, or transferring all data over TLS, how can they ...
Bharel's user avatar
  • 163
0 votes
0 answers
203 views

Storing TOTP codes on a Feiteian ePass FIDO key

I'm looking for some Android apps that can store / read TOTP codes off of a Feitian ePass FIDO key using NFC. There appears to be a fairly simple way with a yubico key / and key but I don't know how ...
Ryan's user avatar
  • 133
1 vote
1 answer
459 views

Does FIDO2 token works as two-factor on password-less authentication?

As authentication factors, I know the following You are (e.g. Biometrics) You have (e.g. USB) You know (e.g. Password) If I use a FIDO2 certified fingerprint reader for password-less authentication ...
Daichi's user avatar
  • 113
0 votes
1 answer
436 views

Which party stores the link between user and device in WebAuthn?

Looking at the online resources regarding WebAuthn, I still haven't been able to figure out which of the involved components (or parties) that store the link between the user and his/her authenticator ...
Lars Andren's user avatar
3 votes
2 answers
606 views

Is using WebAuthn alone considered as two factor authentication?

Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication. For a true two factor authentication you ...
Nataraj Rao's user avatar
2 votes
1 answer
3k views

FIDO2 on Windows: Why do I need a TPM?

I just installed the Windows 10 1809 update, which includes support for FIDO2 passwordless sign-in. I own a Yubikey 5, which supports this standard. However, I am not able to set up Windows Hello, a ...
Daniel Causebrook's user avatar
2 votes
1 answer
333 views

A FIDO U2F Device relies on public/private keys. Do they expire like in regular x509 certificates?

A FIDO U2F Device relies on public/private keys. Do they expire like in regular x509 certificates ?
onairda's user avatar
  • 123
9 votes
2 answers
416 views

Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?

According to the Google information page here: https://support.google.com/accounts/answer/6103523 If you don’t have another second step or forgot your password Note: 2-Step Verification requires an ...
knaccc's user avatar
  • 220
5 votes
1 answer
1k views

password managers and FIDO

I've just been reading some posts about FIDO support (or the lack thereof) in password managers and want to check whether my understanding is correct. My understanding of FIDO (v1) is that the device ...
user avatar
3 votes
1 answer
338 views

Can an infected endpoint steal private keys from a FIDO U2F Hardware Token / Yubikey?

Is it possible for an infected endpoint to steal private keys from a FIDO U2F Hardware Token / Yubikey? What attacks exist against these hardware tokens? What mitigations are possible? For the scope ...
user avatar
4 votes
0 answers
511 views

U2F FIDO sends identifiable serial numbers

As all of the FIDO Alliance documents state, the FIDO U2F protocols should never be able to abused to identify whether a user has multiple accounts with one service, or for services to collude and ...
Ed Watson's user avatar
2 votes
1 answer
3k views

Webauthn configuration differences in Firefox

I'm trying to understand what the different configuration elements mean in Mozilla Firefox. There was an announcement recently from Dropbox that they had enabled support for WebAuthn. I tried logging ...
eternaltyro's user avatar
1 vote
1 answer
546 views

Handling the loss of a phone with FIDO UAF

I would like to know how this UAF method works when we lose our phone. With Google Authenticator we have to save on a paper some info about the generation of the secret key. But how does this work ...
AndoKarim's user avatar
  • 113