top | item 38567626

Using FIDO keys

85 points| jaefi | 2 years ago |777.tf

63 comments

order

spiridow|2 years ago

My colleague and I recently gave a workshop about security keys where we tried to answer questions like:

* Why should I use a security key?

* What is it used for?

* How can I choose one ?

* What features should I look for?

We did cover FIDO2/Passkeys but also multiple other use cases.

Here are the slides if you're interested: https://tome.one/slides/amiet-pelissier-security-keys-worksh...

jaefi|2 years ago

Oh that's interesting, thanks for linking it!

hexfish|2 years ago

Very useful! Thanks!

aborsy|2 years ago

This space is confusing. FIDO2, U2F, UAF, CTAP, WebAuth, Passkey, 2FA, … The names frequently change.

Aren’t all of them just public key authentication (with the private key in a mini-HSM, and public key either calculated in real-time, or stored, in the HSM, and synced externally)?

jeroenhd|2 years ago

There are two names that the end user should see today (WebAuthn for older apps, Passkey for modern stuff). U2F is a pretty old name that may still pop up, but I'm not sure if any user facing software ever used that name to begin with. Most likely, the names facing the user are "security key" or "passkey".

FIDO2 is a standard set up by a couple of authentication companies and stakeholders. U2F was basically an earlier attempt at that. FIDO UAF is a protocol for authenticating, CTAP is a protocol for communicating with hardware. 2FA is just a generic term for "multiple factors", like combining a PIN with your fingerprint. WebAuthn is the web API for authenticating with security keys.

Most of them do indeed come down to public key cryptography. The challenge is providing a public key API that works across hardware vendors, supports attestation, and allows for things like "use your phone to verify your login if your computer's TPM isn't sufficient". They all solve a different problem in the chain, and the names have changed a bit over the decades.

If you're building software now, use the word "passkeys". Apple and Google have stuck with those names, and they're named a lot friendlier than "WebAuthn".

tialaramex|2 years ago

There are a bunch of related but distinct technologies with names here. For example:

CTAP is a protocol for say a PC, or a Phone to talk to an authenticator, maybe over USB or maybe Bluetooth.

WebAuthn is a W3C standard for how a web site can negotiate (via Javascript) exactly what we're going to authenticate and then perform the authentication.

Imagine you connect an external CD drive to your laptop. The CD can turn Red Book CD audio into PCM data, maybe the drive plugs in with a USB-C cable, and the drive uses a SCSI-based Mass Storage variant USB protocol to talk to the laptop, which has an XHCI USB controller, so your operating system needn't know the fine details of this precise PCI USB controller chip. Again, distinct technologies with their own names.

yencabulator|2 years ago

Passkeys are the opposite of "private key in a mini-HSM" in that they're synced to a cloud provider.

The goals of this whole thing have shifted, and it's hard to keep track of what was aiming at what goal. It started out as "actually secure 2FA" and now we're at "cloud-synced unphishable password replacements for non-technical users".

stavros|2 years ago

They are all just public key authentication with a protocol on top to enable various use cases. For FIDO2/WebAuthn/passkeys, the device, on registration, gives the website the public key to use for subsequent authentications.

DistractionRect|2 years ago

I have a couple v1 Solokey Somus lying about. Good little devices. Unfortunately the main selling point of upgradeable firmware is moot if they no longer support the old devices and you have to upgrade. At that point it's they're like everyone else. Except they require some setup on some machines, whereas other keys "just work"

I've since replaced them with yubikeys. Yubikeys have a better feature set (at least compared to by v1's) and at this point are fairly mature/stable. V2 is still pitched as alpha quality, and probably will be deprecated with a v3. As much as I want Solokeys to succeed, I just can't recommend them either.

jaefi|2 years ago

Given how the project is going, not even sure if there will be a V3 at some point.

coffee33go|2 years ago

Are you sure?

    apt-get install solo-python
One can update the firmware.

throwawayqqq11|2 years ago

Am i the only one concerned about the tendency of putting your identity on hardware you possibly do not own?

What a wet dream for the internet controlling fascists when the adoption of "just wield your smart phone" auth would be in place and mandated every where.

Nothing compares to the secrecy of passwords.

stavros|2 years ago

My identity is already on hardware I don't own, my government ID card. What do you foresee the risks being, and why are these risks only possible with secure authentication?

dale_glass|2 years ago

What? Security keys are only "identity" in that they deliver opaque, secure numbers. The actual important bits are somewhere else anyway.

FIDO is a standard algorithm and doesn't need a phone.

ok_dad|2 years ago

I use an old Google Titan key, not the bluetooth model but the regular one, as my backup (it was my primary) and a Yubikey 5 for my primary. I like the peace of mind that they give me that no one can steal my password and login to my important accounts, but I found that certain providers only allow a single 2FA to be used, with no backup, so I don't feel good using them there (AWS, what the F?) and also I find that not a lot of services support 2FA in the form of keys, they all want to use TOTP or SMS generally, so I only can really use these for my Fastmail and Bitwarden and a few other accounts, but for my bank or my health insurance, they do not support FIDO keys. I also can't use them on any government sites! I know passkeys are going to rule the world soon, but I don't like the idea that my phone and a 3rd party have access to this 2nd factor; I prefer a separate key for this purpose.

tialaramex|2 years ago

You don't mention which country and thus which government. Some US government sites do accept WebAuthn, and for at least some UK sites it's possible via a third party.

Banks though, yeah they aren't good at this stuff. My safe† bank decided one day to completely up-end how logins work and almost locked me out. My good bank provide a very stupid, proprietary solution but at least it's an actual secure solution.

† Safe in that they're owned by the government, so, if they go bankrupt I have worse problems because now I live in a failed state. Big piles money of money sit in this bank because it's safe, but it's run by clowns who don't understand customer service.

timwis|2 years ago

As much as I want a hardware key, I still struggle with the practicality of having a backup key. I create new accounts on websites quite often, and the idea of having to go fetch my backup key out of a safe to register it (and hope the site allows multiple keys) just feels impractical (“I’ll do it tomorrow”). Not to mention—what if I’m at work, or out and about setting it up on my phone? Am I really going to remember to add my backup key when I get home every time?

Wish there were a way around this :/

twicetwice|2 years ago

My "solution" to this problem is: hardware keys with backups for the really important services—Bitwarden, Google, domain registrar, etc. And then for stuff that isn't absolutely critical, I just use an OTP stored in Bitwarden. As for having both the password and OTP stored in the same place, the way I see it, the OTP is mainly protecting against keyloggers, data breaches, etc. And then I figure, if someone gets into my Bitwarden account, I'm already fucked anyway, so it's whatever.

I currently have four Yubikeys: one on my keychain, one in my apartment, one to take with me while traveling, and one at my parents' house. I figure this should be adequate to ensure I never get locked out of Bitwarden or Google, which would be an utter disaster.

alwa|2 years ago

What do you imagine a solution here might look like? I don’t know enough about the problem space to truly know, but I feel like I’ve seen versions of this: I can authorize any arbitrary public key for use over SSH, for example; and (based on my memory of YubiOTP) it’s seemed like at least some of these hardware auth protocols work based on using an open serial number or public key to identify the authorized authenticator.

Intuitively it seems like it should be possible for me to store on my main auth device some form of the backup device’s identity or public key material, and at enrollment time, ask the authenticating service to trust either the current device or also this other device to authenticate me.

I wonder what risks I’m overlooking-surely there must be good reasons the protocol excludes that kind of approach.

stavros|2 years ago

You can use a software passkey and still get 99% of the benefit. For the other 1%, you can't have it both ways, where a hardware key is both required and not required to sign in.

Maybe there can be better UX around signing up, ie "give me your public keys so I can set them up in your account", but then you lose a lot of the privacy, because the public keys aren't different per site any more (and operators can then tell the same person has an account on multiple sites).

dmm|2 years ago

> the idea of having to go fetch my backup key out of a safe to register it (and hope the site allows multiple keys) just feels impractical

An alternative some people use is to register a TOTP code and print out the QR code. Then you can remove it from the app. It's not a full solution but it might be part of one that works for you.

> Wish there were a way around this :/

Sign in with Google/Facebook/Github. I wish sites supported custom OIDC but that's probably impractical.

Nextgrid|2 years ago

I very much wonder if this obvious oversight was intentionally left unaddressed in order to create a requirement on proprietary sync/backup solutions and make true security more difficult (since the key material is now being synced around and could technically leak or be subject to "lawful intercept" or bruteforce of the sync service's authentication).

tuhriel|2 years ago

I do use multiple keys and I like them a lot, but there is a big Issue I don't see mentioned a lot: you can't solo it on most services:

- Google forces you to also keep their stupid "verify on another device", where you can't even untrust specific devices without fully logging out - proton apps don't support fido auth - microsoft account only allows it on edge and afaik not at all on linux - and so on..

I think the only service where I can fully disable other 2FA channels is github.

Edit: a word

ac50hz|2 years ago

My Yubikeys are great and have been since I started using them (2011), adopting newer products if necessary as they are released.

Passkeys are a confusing mess for most users, and the limited storage on Yubikeys doesn't help. However, 1Password's passkey support manages to reasonably successfully hide the confusions that always exist when explaining passkeys to anyone.

For now, I'm happy with my Yubikeys+1Password for all the platforms I use.

guerby|2 years ago

After looking at various keys and their features I chose basic FIDO2 with NFC with no storage or other fancy feature.

Keys with lots of feature have a larger code base and this means more bugs in the long term.

I use my FIDO2 keys for proxmox, ssh ed25519-sk, vaultwarden, nextcloud, GAFAM accounts.

Unfortunately I know of no bank that has adopted FIDO2/webauthn.

Note: Paypal only allows one FIDO2 key AFAIK, so not an option there.

jaefi|2 years ago

Looking at bank security is probably the saddest landscape around. Most will ask you for a PIN at maximum and then tell you it's not possible to have stronger authentication because of "safety".

I wish there was stronger laws forcing banks to adopt stuff like that.

jaefi|2 years ago

I wrote a small article about security keys. I hope y'all will like it.

evanjrowley|2 years ago

Cool article!

Sorry your SoloKey V2 experience isn't going so well. I have a V1 and it's been surprisingly robust over the past 3 years. For NFC, I can only get it working with my Pixel 7 phone of I remove the thick OtterBox case. Perhaps your issue is also related to your case thickness? Having to remove the case is a hassle, so I am sticking with multipurpose USB-A to USB-C adapters for now.

I've been using YubiKeys for like 10 years, but the 5C model I recently got suddenly stopped working out of nowhere. It only lasted me from October to November of this year. I've been wondering if the brand has had a quality drop-off.

Of the security keys in my possession, the Thetis U2F key has lasted the longest (~5 years) and has had no problems whatsoever. They've since released updated FIDO keys, and so I purchased 2.

Good luck on your hardware MFA journey!

tbone55|2 years ago

There is something to be said about having a physical key for an online account. Beyond the security implications it's kind of like a key to your home. Locking the door keeps most out, but there are still ways in.

seymon|2 years ago

What do you think about the german Nitrokeys? Especially the features and compatibility of the Nitrokey 3?

Anyone has one of those?

https://www.nitrokey.com/products/nitrokeys

navigate8310|2 years ago

One thing to keep in mind before buying their NFC keys is that it can only store up to 10 resident keys

lemper|2 years ago

i use security key by yubikey (blue one, USB A) as one of the mfa. mostly for github and aws. and i personally like the "cool factor" when I have to "look" for the key when the sites ask for it. "bro, what are ya doing ya dingus?" "i literally can't login without the key, bro. like a real renter in a saas world!"