Skip to main content

Questions tagged [u2f]

Universal Second Factor (U2F) is a protocol for strengthening online authentication.

Filter by
Sorted by
Tagged with
1 vote
1 answer
183 views

Is FIDO authN vulnerable to relay attacks?

In this question: Is FIDO2 authentication vulnerable to a social engineering replay attack? it was answered that no, not vulnerable because "the keypair used to by the FIDO device to authenticate ...
Allexj's user avatar
  • 137
1 vote
0 answers
181 views

FIDO Multi-device Authentication Sync Technical Specification

Where/what are the technical specifications to sync FIDO passkeys? FIDO passkeys are a quite hot topic. There is a white paper from FIDO Alliance about it. Several websites provide abstract ...
ndbd's user avatar
  • 201
1 vote
2 answers
158 views

Windows controlled folder access to secure Chrome cookies?

I've read about Linus Tech Tips hack, where a malware stole the browser cookies & was able to log in to Linus's channel. Is this preventable with Windows controlled folder access (preventing apps ...
Ninja Dev's user avatar
  • 111
2 votes
0 answers
97 views

Yubikey Private Key Generation & Storage 5 Series vs Bio Key

References: Yubico’s Take on U2F Key Wrapping https://www.yubico.com/blog/yubicos-u2f-key-wrapping/ Key generation https://developers.yubico.com/U2F/Protocol_details/Key_generation.html Discoverable ...
CyberMedics.org's user avatar
1 vote
1 answer
486 views

When hardening my SSH key, why would I use yubikey-agent instead of the built-in `-sk` key type native to OpenSSH?

OpenSSH 8.2 added -sk key types that allow for FIDO/U2F hardware authenticators (like a YubiKey, etc.) yubikey-agent allows for the same functionality, except it (a) requires an additional client on ...
angryserver's user avatar
4 votes
1 answer
786 views

Use platform TPM as U2F for web applications

The Problem: Use the platform TMP of my Windows Laptop/PC (no external device or USB token) as U2F in a web application to check if it is a known device. My intended solution: I need to store/create ...
MrMaavin's user avatar
3 votes
3 answers
2k views

Is a hardware based 2FA more resistant to phishing than SMS or TOTP?

As I understand, modern phishing is kind of like a man-in-the-middle attack. Let's say, for example that User u has an account in Domain d where he has an SMS based 2FA enabled. This is what the ...
Agnishom Chattopadhyay's user avatar
20 votes
5 answers
4k views

Why do some FIDO security fobs use keyboard emulation mode?

I was troubled from the very beginning by the fact that my U2F security fob acts as a keyboard and theoretically is able to press any key when no one is looking. Sometimes I accidentally touch it and ...
IlliakaillI's user avatar
1 vote
0 answers
169 views

Fido U2F, can a modified client theoretically register the same key multiple times? YubiKey Wrapped PrivateKey Method

Context I was answering a question about how YubiKey can generate "infinite" keypairs for Fido U2F but doesn't need to store them locally. This leads to my initial question: Initial Question ...
PathToLife's user avatar
0 votes
0 answers
138 views

How to best support multiple hardware keys (yubikeys, etc.) as a web app?

I've implemented second factor authentication for my web app via FIDO U2F, and am testing using a Yubikey. I have read that it is best practice to associate multiple hardware keys in case one is lost, ...
Julian H. Lam's user avatar
1 vote
0 answers
219 views

Is it possible to use an ed25519 security key with Google Chrome SSH applets?

After generating an OpenSSH EC key on a hardware security key: $ ssh-keygen -t ed25519-sk -C comment Is it possible to use this key with Google Chrome SSH applet or Mosh, in particular on non-Linux ...
Petr's user avatar
  • 527
31 votes
3 answers
5k views

Is a USB security key trackable among websites?

If I have a security key (U2F key) like yubikey and use it on websites A and B and the owner of these two websites is the same, can the website owner know that I am the same user?
cooker's user avatar
  • 391
0 votes
1 answer
154 views

How do u2f devices manage to not go out of sync?

U2F devices store an internal counter to resolve a challenge and the counter value is sent back to the server (source). I think the counters on the server and on the client must go out of sync from ...
Gamer2015's user avatar
  • 727
9 votes
1 answer
5k views

How does ed25519-sk actually works?

My google-foo failed me as most "how it works" sections related to fido are very... let's say... consumer-oriented. So openssh supports U2F natively when using the appropriate elliptic-curve-...
Jane's user avatar
  • 93
1 vote
1 answer
395 views

Why isn't U2F's CTAP protocol forwards-compatible with FIDO2's CTAP protocol?

I've been trying to find the major differences between "U2F" versus "FIDO2" two-factor authentication standards. Reading some of the articles posted by different companies and even ...
natevw's user avatar
  • 131
2 votes
3 answers
3k views

Why would a U2F key be more secured than an OTP device?

I have a Yubikey 5, I can store a PGP key inside, it has OTP abilities, FIDO, NFC, etc... Which is great for a device like this. First of all, I understand how a smart card is more secured than an app/...
Max13's user avatar
  • 195
1 vote
1 answer
465 views

Is there a downside to using a Ledger Nano S or X as both a crypto wallet and a 2FA key?

Newbie question, I guess. I want to get a cold wallet for increased security. I also want to start using hardware 2FA (e.g. for e-mail). I see that Ledger advertises 2FA capabilities ('FIDO U2F') on ...
legatrix's user avatar
  • 113
2 votes
2 answers
305 views

use custom 'key' for hardware security token

Using a hardware security token as a second factor is generally considered quite a boost in security. But one of the issues I'm having is how to backup the (digital) keys used in the hardware device (...
n0542344's user avatar
  • 121
10 votes
2 answers
4k views

Where are FIDO U2F Keys Stored?

I'm getting conflicting information on how the security keys are stored and used. Where are the public and private keys stored? If the private key is stored on the Yubikey itself, how many can it hold?...
Derpy's user avatar
  • 103
1 vote
0 answers
212 views

U2F instead of password for "sudo mode"?

Some apps (Github being the most prominent IMHO) allow using U2F token as a means of validation for "sudo mode" (potentially dangerous actions in UI like creating a new token) instead of password. ...
Tomáš Fejfar's user avatar
0 votes
1 answer
938 views

How to use Yubikey 5 NFC for online accounts, Linux login, and KeePassXC?

I just got my Yubikey 5 NFC, and would like to use it for Linux desktop login Linux KeePassXC (which only supports hmac-sha1 challenge-response) online accounts When reading about U2F it seams to be ...
Sandra Schlichting's user avatar
4 votes
0 answers
253 views

Security implications of using unfused U2F token

I noticed that both of the Feitian USB/NFC U2F Security Keys I purchased on Amazon a few years ago are unfused. This means that the pre-personalization step was partially performed but not completed ...
Robert Quattlebaum's user avatar
6 votes
2 answers
2k views

Is phishing ineffective against a Gmail account that has 2FA? [closed]

According to my knowledge, phishing basically only steals the email id and password, right?
Aeden Thomas's user avatar
5 votes
1 answer
748 views

How does the attestation mechanism of U2F guarantee the provenance of the key material?

I'm trying to understand Yubico's documentation of the U2F standard, and getting hung up on the PIV attestation piece. The security claim appears to be that the authoritatively-signed attestation ...
Dan Lenski's user avatar
0 votes
0 answers
133 views

Looking for ability to identify U2F device

I know that in terms of security it is not good idea (as explained here: https://github.com/Yubico/libu2f-host/issues/45#issuecomment-337013420). But we can live with that. Is there any extension of ...
alehro's user avatar
  • 101
6 votes
2 answers
322 views

Does injecting my own key material into the authenticator undermine authenticator's attestation?

I'd like to be able to inject my own key material in the FIDO2 authenticator; at the very least it will remove the need to trust the vendor (because we have no guarantee whether the vendor keeps ...
Dmitry Frank's user avatar
18 votes
1 answer
7k views

FIDO and FIDO2 differences

I've been reading both FIDO and FIDO2 specs for a while tring to understand the similarities and differences between both. Here is how I broke it down so far: FIDO: First iteration in creating a ...
Filipe Rodrigues's user avatar
3 votes
1 answer
1k views

Why don't online banks use WebAuthn? [closed]

My ideal bank would offer online banking from a browser with user/pwd and WebAuthn, for example with a NFC or USB key. No OTP or SMS or apps on the smartphone or physical devices required. (It goes ...
jj_p's user avatar
  • 379
3 votes
1 answer
1k views

FIDO U2F - MacOS TouchBar

I understand how FIDO works with yubikey: Yubikey device has a symmetric key and it uses appId, nonce and symmetric key to generate key pair for a website. And the device gives back public key and ...
Jack's user avatar
  • 173
4 votes
1 answer
411 views

Yubikey - WebAuthn and U2F

I have a yubikey which supports only U2F. It doesn't support FIDO2. I read about U2F and i understand how it works. When i test my Yubikey for WebAuthn on https://webauthn.io it works. I wanted to ...
Jack's user avatar
  • 173
1 vote
1 answer
950 views

Can 2FA keys be duplicated?

I want to order a 2FA key (like yubikey) online and I want to know if someone could make a duplicate of whatever key I order during shipping. I don't want to discuss if someone could access my package....
Linux_user0987's user avatar
1 vote
2 answers
766 views

Hardware security key with locked down usb slots

I would like to use hardware security keys in an environment where it is additionally needed to lock down any ways in which a user could download data to a device like a usb key. Is it possible to ...
Elsie's user avatar
  • 25
6 votes
1 answer
2k views

How do FIDO keys prevent MITM reflection attacks?

FIDO keys, used for 2 factor authentication are based on a challenge-response mechanism. Besides generating a common 1-time-key using diffie-hellman, or transferring all data over TLS, how can they ...
Bharel's user avatar
  • 163
3 votes
0 answers
396 views

USB-C and NFC U2F Keys [closed]

Are there any commercially available U2F keys that support both USB-C and NFC? So far I've looked at Yubico which seems to have a USB-C model that doesn't have NFC support or a USB-A model that does ...
Gregory Arenius's user avatar
0 votes
1 answer
203 views

Security of damaged U2F key? [duplicate]

U2F key is praised for its security features. But I am afraid of using something so secure that when it is damaged I couldn't access my own accounts. So I searched what is recovery scenario and for ...
greenoldman's user avatar
2 votes
2 answers
469 views

Does U2F prevent phishing of passwords?

U2F is touted as a new 2 factor authentication standard that has built in defense against phishing attacks. As I understand it, this works by registering the device with each service, thereby creating ...
David says Reinstate Monica's user avatar
2 votes
1 answer
342 views

A FIDO U2F Device relies on public/private keys. Do they expire like in regular x509 certificates?

A FIDO U2F Device relies on public/private keys. Do they expire like in regular x509 certificates ?
onairda's user avatar
  • 123
1 vote
1 answer
246 views

U2F devices: backdoors possible?

Following the recent post at ZDNet on Google Titan devices designed and manufactured by a Chinese vendor and potentially prone to built-in backdoors: is it even theoretically possible to inject a ...
yurkennis's user avatar
  • 151
3 votes
0 answers
498 views

How much storage is on a Google Titan Key?

I've been messing around with my Google Titan Key and learned that each authentication challenge returns a counter for how many times the key has been accessed. The only way I can think that this ...
Corey Ogburn's user avatar
9 votes
2 answers
416 views

Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?

According to the Google information page here: https://support.google.com/accounts/answer/6103523 If you don’t have another second step or forgot your password Note: 2-Step Verification requires an ...
knaccc's user avatar
  • 220
3 votes
1 answer
353 views

What could MitM'ed U2F do?

Google has now released their "Titan" keys to the general store (albeit via a waitlist). When they first announced their product, Yubico, their chief competitor, decried the use of Bluetooth: ...
Michael come lately's user avatar
3 votes
1 answer
340 views

Can an infected endpoint steal private keys from a FIDO U2F Hardware Token / Yubikey?

Is it possible for an infected endpoint to steal private keys from a FIDO U2F Hardware Token / Yubikey? What attacks exist against these hardware tokens? What mitigations are possible? For the scope ...
user avatar
2 votes
2 answers
1k views

Why is the U2F secret key on yubikeys is not programmable, and how to get a universal backup token?

I'm trying to figure the best strategy for having a backup U2F token. Ideally, I want to have two identical tokens; obviously I'll have the primary one easily accessible (say, on my keyring), but the ...
Dmitry Frank's user avatar
2 votes
1 answer
1k views

Smartphone app as a U2F hardware token via Bluetooth?

Quoting from agl's article from Mar 2018: At the time of writing, all Security Keys are based version one of FIDO’s “Client To Authenticator Protocol” (CTAP1). [...T]he core protocol [can be] ...
akavel's user avatar
  • 123
1 vote
0 answers
485 views

Hardware-based password manager with per-password verification [closed]

I'm looking for a device to perform hardware password management very similarly to the Trezor, shown here, commonly used as a wallet for cryptocurrencies. Unfortunately, the Trezor only stores a ...
Paranoidparrot11's user avatar
5 votes
0 answers
321 views

Desktop browser that supports Fido U2F over CCID [closed]

Is there any browser that supports Fido U2F over CCID for smart cards? As far as I can see Firefox and Chrome only support U2F over HID, and only Chrome for Android (with Google Authenticator2) ...
pythonimus's user avatar
4 votes
0 answers
519 views

U2F FIDO sends identifiable serial numbers

As all of the FIDO Alliance documents state, the FIDO U2F protocols should never be able to abused to identify whether a user has multiple accounts with one service, or for services to collude and ...
Ed Watson's user avatar
2 votes
1 answer
3k views

Webauthn configuration differences in Firefox

I'm trying to understand what the different configuration elements mean in Mozilla Firefox. There was an announcement recently from Dropbox that they had enabled support for WebAuthn. I tried logging ...
eternaltyro's user avatar
4 votes
4 answers
14k views

Hardware-Based Password Manager [closed]

I'm trying to improve my password management, and I have a vision in mind for a solution. However, I'm having a problem putting it all together or finding a product(s) that fits. First I would like to ...
hikingnola's user avatar
4 votes
1 answer
167 views

Is there a benefit to setting up a security key on an account that already has phone-based 2FA?

I'm looking at 2FA options for my Google account, and I noticed they now allow you to add a security key to your account. I'm a bit of a novice to infosec, but I'm struggling to see the benefit for me....
user avatar