Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [u2f]

Universal Second Factor (U2F) is a protocol for strengthening online authentication.

0
votes
0answers
11 views

SSH Authentication with Fido2 / Yubico Security Key [migrated]

I was wondering if it is possible to use FIDO2 to authenticate against an ssh server. There are many tutorials explaining how to use GPG and the newer Yubikeys for ssh auth, but i do not find any ...
0
votes
0answers
5 views

Is there any way to use my Titan security key via NFC on my laptop, instead of USB? [migrated]

My Google Titan security key has both USB and NFC interfaces, and I'm able to use it via NFC on my Android phone. However, my laptop also has an NFC reader, and it doesn't seem to work out of the box. ...
0
votes
1answer
65 views

How do FIDO keys prevent MITM reflection attacks?

FIDO keys, used for 2 factor authentication are based on a challenge-response mechanism. Besides generating a common 1-time-key using diffie-hellman, or transferring all data over TLS, how can they ...
1
vote
0answers
165 views

USB-C and NFC U2F Keys [closed]

Are there any commercially available U2F keys that support both USB-C and NFC? So far I've looked at Yubico which seems to have a USB-C model that doesn't have NFC support or a USB-A model that does ...
0
votes
1answer
38 views

Security of damaged U2F key? [duplicate]

U2F key is praised for its security features. But I am afraid of using something so secure that when it is damaged I couldn't access my own accounts. So I searched what is recovery scenario and for ...
2
votes
2answers
121 views

Does U2F prevent phishing of passwords?

U2F is touted as a new 2 factor authentication standard that has built in defense against phishing attacks. As I understand it, this works by registering the device with each service, thereby creating ...
1
vote
1answer
58 views

A FIDO U2F Device relies on public/private keys. Do they expire like in regular x509 certificates?

A FIDO U2F Device relies on public/private keys. Do they expire like in regular x509 certificates ?
1
vote
1answer
124 views

U2F devices: backdoors possible?

Following the recent post at ZDNet on Google Titan devices designed and manufactured by a Chinese vendor and potentially prone to built-in backdoors: is it even theoretically possible to inject a ...
3
votes
0answers
137 views

How much storage is on a Google Titan Key?

I've been messing around with my Google Titan Key and learned that each authentication challenge returns a counter for how many times the key has been accessed. The only way I can think that this ...
8
votes
2answers
175 views

Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?

According to the Google information page here: https://support.google.com/accounts/answer/6103523 If you don’t have another second step or forgot your password Note: 2-Step Verification ...
3
votes
1answer
172 views

What could MitM'ed U2F do?

Google has now released their "Titan" keys to the general store (albeit via a waitlist). When they first announced their product, Yubico, their chief competitor, decried the use of Bluetooth: ...
0
votes
1answer
104 views

Can an infected endpoint steal private keys from a FIDO U2F Hardware Token / Yubikey?

Is it possible for an infected endpoint to steal private keys from a FIDO U2F Hardware Token / Yubikey? What attacks exist against these hardware tokens? What mitigations are possible? For the scope ...
1
vote
1answer
365 views

Why is the U2F secret key on yubikeys is not programmable, and how to get a universal backup token?

I'm trying to figure the best strategy for having a backup U2F token. Ideally, I want to have two identical tokens; obviously I'll have the primary one easily accessible (say, on my keyring), but the ...
0
votes
1answer
324 views

Smartphone app as a U2F hardware token via Bluetooth?

Quoting from agl's article from Mar 2018: At the time of writing, all Security Keys are based version one of FIDO’s “Client To Authenticator Protocol” (CTAP1). [...T]he core protocol [can be] ...
1
vote
0answers
195 views

Hardware-based password manager with per-password verification [closed]

I'm looking for a device to perform hardware password management very similarly to the Trezor, shown here, commonly used as a wallet for cryptocurrencies. Unfortunately, the Trezor only stores a ...
3
votes
0answers
143 views

Desktop browser that supports Fido U2F over CCID

Is there any browser that supports Fido U2F over CCID for smart cards? As far as I can see Firefox and Chrome only support U2F over HID, and only Chrome for Android (with Google Authenticator2) ...
3
votes
0answers
141 views

U2F FIDO sends identifiable serial numbers

As all of the FIDO Alliance documents state, the FIDO U2F protocols should never be able to abused to identify whether a user has multiple accounts with one service, or for services to collude and ...
1
vote
1answer
706 views

Webauthn configuration differences in Firefox

I'm trying to understand what the different configuration elements mean in Mozilla Firefox. There was an announcement recently from Dropbox that they had enabled support for WebAuthn. I tried logging ...
3
votes
4answers
3k views

Hardware-Based Password Manager

Folks, I'm trying to improve my password management, and I have a vision in mind for a solution. However, I'm having a problem putting it all together or finding a product(s) that fits. First I ...
3
votes
1answer
70 views

Is there a benefit to setting up a security key on an account that already has phone-based 2FA?

I'm looking at 2FA options for my Google account, and I noticed they now allow you to add a security key to your account. I'm a bit of a novice to infosec, but I'm struggling to see the benefit for me....
1
vote
0answers
193 views

How exactly do Fido Keys work? [closed]

Recently I acquired a security Fido key that allows me to use the U2F protocol on some of my accounts. Now I know that these keys use public/private keys for the specified account but I'm stuck on the ...
6
votes
4answers
676 views

Possible to use *only* U2F authentication?

Using a U2F USB authentication key to login to services such as Google seems a good idea. However, these services often allow you to register a backup two-factor-authentication (2FA) method, which you ...
1
vote
1answer
135 views

What 2nd factor accepted on a mobile app?

To respect the 2FA philosophy, after a 1st factor of authentication (login/password), we need to request a 2nd factor of authentication. But for a mobile app, I suppose we can't use SMS OTP, email ...
2
votes
0answers
709 views

How do security properties of Trezor's FIDO U2F differ from Yubikey?

Aside from being a bitcoin wallet, the Trezor supports FIDO U2F and seems to offer some unique benefits over a Yubikey: The keys are always generated on the device and never rely on the manufacturer ...
3
votes
2answers
1k views

App-based 2FA versus Hardware-based 2FA

How do apps like Symantec VIP / Okta Verify and similar implementations compare to using a hardware auth token such as the recent U2F devices? How real is the possibility of an Android system being ...
1
vote
0answers
84 views

Are all the FIDO U2F tools from Yubico cross-compatible

So I recently got myself one U2F security key to experiment with all the services that support it. However I didn't go for the mainstream option (Yubikey) since most models are quite expensive for my ...
7
votes
5answers
451 views

Can a smartphone strictly be viewed as the 'something you posses' factor for 2FA when it has no hardware token capability like smartcards?

It seems that 2FA purists seem to go for security keys (like ubikey or smart-cards) while others seem to have a more relaxt stance which even seem to include 'possession' of none physical elements ...
2
votes
1answer
327 views

Why doesn't a device with x509/PKCS#11 and U2F exist?

I've been looking for a device, smartcard or USB that does two things: provide storage to a private digital signature key (used with in a standard x509 certificate) for signing documents provide ...
2
votes
1answer
381 views

U2F protocol - Counter value & device cloning

My question is about the U2F protocol and more precisely cloning detection. According to the doc : "If there is a possibility that a U2F token can be cloned, we also need some way to detect it. We ...
1
vote
1answer
465 views

Secure individual passwords in password manager with U2F?

Given that U2F as implemented for instance by the YubiKey is stateless I am wondering if any password manager supports encrypting each individual password stored in a password collection using U2F. ...
-1
votes
1answer
2k views

Where can I use BLE/NFC U2F device?

Can BLE U2F security keys be used on Chrome for macOS/Windows for any site supporting U2F USB keys as a second factor? What sites/apps can I use NFC/BLE U2F keys for on NFC-(and BLE-)supporting ...
2
votes
2answers
210 views

Can the U2F standard be used by servers to impose a specific category of hardware?

I don't like that browsers, email clients, etc. come bundled with CAs and that there is no emphasis for a more decentralized authentication mechanism. Fortunately, it's not too bad, because at the ...
6
votes
2answers
1k views

Why is FIDO U2F an entirely different standard from FIDO UAF instead of just a subset?

As you may already be aware, the Universal 2nd Factor (U2F) standard is a standard for 2nd-factor authentication which allows users to authenticate to web applications using a USB hardware token. ...
2
votes
2answers
262 views

generation of keys for U2F

When I buy an U2F device, say a Yubikey smart-card, does the vendor hardcode on it a private key that will be later used in a challenge-response mechanism by the user, or do they only put in there ...
3
votes
1answer
979 views

OTP vs. U2F for online banking and email (vs. store key on USB)

Which one among OATH HOTP, OATH TOTP on one side (say in the form of a credit card-sized token) and U2F (say in the form of a USB key) on the other side you think is more secure for purposes like ...
4
votes
4answers
2k views

Password managers with U2F security risks

After a lot of research about password manager and a lot of reference obtained from this discussion How safe are password managers like LastPass? I come to the conclusion that password managers have ...
35
votes
6answers
3k views

Why don't PGP and SSH keys see more widespread use as a second factor when authenticating?

One of the major up-and-coming MFA methods is U2F, which relies on an initial key exchange and challenge-response mechanism. It's a relatively new protocol, and is only starting to see more ...
1
vote
1answer
236 views

What data is sent between an NFC/BTLE FIDO U2F device and Chrome (or other agent)?

I need to explain what "conversation" occurs between a FIDO U2F device (YubiKey NEO) and the agent (Chrome). I want to know if it's a challenge response, and ultimately figure out how much ...
0
votes
2answers
346 views

Multiple tokens support for FIDO u2F

I am implementing a web service to support U2F. I need users to be able to register more than one token to their account. How should the authentication request message look when we have more than 1 ...
7
votes
2answers
1k views

Can a FIDO U2F device be used for symmetric encryption?

As I understand, U2F is mainly used for authentication. It uses challenge-response scheme to check if the device used for logging in is the same device which was used during registration based on ...
6
votes
1answer
917 views

Are there any risks associated with using a single U2F/FIDO key with multiple sets of credentials?

I recently got a FIDO U2F key (AKA a Yubikey). I currently only use it across a range of services, but could this be a security risk in any way? For example, if I use my U2F key to authenticate on a ...
6
votes
1answer
227 views

Privacy of U2F keys

If I use the same U2F key for two accounts on some service, could the service detect that and match the accounts? Equivalently, if I used the same U2F key for two different services, could the ...
9
votes
3answers
2k views

Why is U2F not good enough to be used as authentication?

In the context of low- and mid-security applications (ie, 95% of the web), why isn't U2F good enough to be the only factor? As far as I can tell, U2F very securely implements the "something you have" ...
2
votes
3answers
1k views

Vulnerabilities despite FIDO U2F?

FIDO U2F seems much more secure than one-time-passwords (OTP), especially TOTP, because of the challenge-response architecture. In what ways is a U2F user still vulnerable? I presume if a user's ...
2
votes
1answer
765 views

FIDO U2F use over multiple devices for the same service

I've been looking at the FIDO alliance's U2F specification and there's something which I can't seem to find documented. If I was to use a Yubikey or something similar as part of the authentication ...
12
votes
2answers
8k views

Which websites support U2F? [closed]

FIDO Alliance's Universal 2nd Factor (U2F) is a new and promising approach to replace passwords. The FIDO Alliance comprises of many players but so far only Google website seems to support it. Are ...
5
votes
2answers
817 views

Is there any security risk, if the database with key handles for U2F devices are leaked?

Is there any risk, if a database of U2F device key handles are leaked? Enrolling a key works by: Send Enroll request with "AppID" to U2F device. U2F device answers with "Key Handle, Public Key". ...
7
votes
1answer
3k views

How do OTP USB sticks work?

I just discovered the YubiKey NEO which seems like a pretty awesome device for maintaining security for a variety of different things including computer login, SSH private keys, GPG private keys, and ...
4
votes
3answers
805 views

Why would it be a good idea for someone to get a YubiKey? [closed]

For what uses would it be smart to get a YubiKey?