Comment by geofft | Hacker News Reader

Comment by geofft | Hacker News Reader

Parent Full thread

The newer models support U2F, which is a challenge-response thing: the website prompts you to insert your YubiKey and tap it, and the key signs a response and sends it back to your browser.

I believe this adds protection against phishing because the browser communicates which origin (that is, which domain name) is sending the challenge, and that gets hashed into the signed response. So if trust-me-im-google.com proxies google.com, it can ask you for a one-time password, and the one-time password will be valid when google.com gets it, so the MITM can get your login cookie. But if you're using U2F, the signed response will say "Yes, I would like to authenticate to trust-me-im-google.com", and google.com will reject that.

That's very cool. Could you elaborate on the method in which the key accepts the challenge? I was under the impression that a Yubikey only acted as a USB keyboard - which ensured it's security by isolation.

I believe they're describing U2F, and share your perception that at some point in the past these were just keyboards.

[1] describes the flow at a high level, and [2] goes into more details

[1]: https://www.yubico.com/about/background/fido/

[2]: https://developers.yubico.com/U2F/Protocol_details/Overview....

The general protocol is U2F:

https://developers.yubico.com/U2F/

Yubico has some python code here:

https://github.com/Yubico/python-u2flib-host

https://github.com/Yubico/python-u2flib-server

Chrome builds U2F into the browser itself for website authentication.

I've built a node.js version if Python is not your chosen stack: https://github.com/emilecantin/node-u2flib-server

Another choice that looks (sadly, for me) more popular: https://github.com/ashtuchkin/u2f

The other answers are correct, but even before U2F the yubikey supported other methods as well. The have a classic HMAC based ChallengeResponse-Mode, a smartcard and PIV interface.

The U2F device will not sign anything if the appId (that is the web origin/domain in most cases) is not already registered.

Reply on news.ycombinator.com