Hacker News Reader

Comment by lrvick | Hacker News Reader

The Yubikey/WebAuthn comments are really ignorant and discouraging people from the best defense against this sort of attack that exists.

First of all you can get WebAuthn devices for as little as $10 now.

Second, there is no app to configure. You plug it in when it says register and tap it. Done.

Third, if the WebAuthn device gets stolen the attacker presumably lacks a password. You can't use the device by itself. Also the vast majority of attacks are remote, not IRL.

Fourth: fingerprint or pin authenticated WebAuthn devices exist if your threat model worries about physical access.

IRL attacks are a radically different threat profile.

I can't even with this article.

View on HN

Could you let me know where I can buy a well supported WebAuthn key for that price?

Looking at Amazon UK - https://amzn.to/3oWGYe4 - the cheapest appears to be about £30. Unless I want to risk my security to some no-name brand with zero customer support.

When I got my YubiKey, it told me I had to download an Android app to make it work. So, perhaps better documentation is needed?

I'm sorry you didn't like my post, I'll try to do better in future.

Conor sold U2F Zero's for less than 10 dollars (years ago) and has a kick starter now to fund his new Solo keys:

https://www.kickstarter.com/projects/conorpatrick/solo-the-f...

https://u2fzero.com/

I have a few U2F Zeros and they have been working fine for years. These are simple devices. You don't need to overpay for them.

Edit: Conor was building the U2F Zero tokens for $2.26 USD per unit. Read more here:

https://www.conorpp.com/u2f-zero-year-in-review/

I don't think the kickstarter is relevant now. You just buy them from solokeys.com. There's been Somu since that, and Solo2 is in the offing, with plenty of storage, apparently. I bought Somu partly for convenience, and partly for the promise of PGP support, which unfortunately hasn't been added yet (though there is a development version).

In answer to the expense question, two Solo keys appear to set you back 38 quid at the current exchange rate. I don't know how they compare with HYPERFIDO, which I don't think I'd come across before.

I can confirm what you and _wldu are saying and yes, the latest project is https://solokeys.com/v2 and is launching end of this month.

From an economic perspective, unfortunately, it's really hard to focus on reducing the cost, there's simply no incentive.

First, consider that the biggest cost in the customer getting a security key is basically shipping + packaging. Imagine a key that costs <$3... even packaging with a polybag + printed label + padded envelop gets to a cost that has a significant % of the production cost.

Next, it's features. To stay on par with competition, people expect the same features (see, e.g., openpgp mentioned above - the code currently doesn't fit in the stm32l4 flash), both firmware and hardware. As a result we have to look at the latest & greatest micro, but of course that alone has a significant cost.

And finally, there's the overall viability. We all know that open source projects die without a business model. The numbers in the U2FZero review simply don't add up, that was clearly unsustainable and that's why we made SoloKeys. A business has expenses other than manufacturing and if you don't account for that, the business dies together with your dream project.

Anyway, thank you both (and all others) for the great support. One step at a time, we'll get to a stronger and eventually also cheaper product!

Ah, I didn't know about the PGP code size. Point taken about the cost, and I hope you can sell to organizations. I'm surprised I can buy a competitor for £8, but then I can't run the proprietary programming software or, I assume, re-flash it. I'm happy to support a free software project anyhow. I wish I could register my Somu with the work Duo system rather than the display-a-number-you-type HOTP keys they reluctantly issue as the expensive alternative to expecting us to use personal phones for such purposes. Phishing, we've heard of it.

Nice try, but I will never attach an usb device for frequent usage that sticks out like the Solokeys v2. The size of the Somu * is fine, as it doesn't need to removed when transporting a laptop.

Integrated in to the laptop it would be great, like an Apple Watch allows https://support.apple.com/guide/imac/unlock-and-approve-with...

* https://solokeys.com/collections/all/products/somu-tiny-secu...

I hear you.

The stm32 used in v1 was 3x3mm, while the new nxp lpc55s6x used in v2 is 5x5mm. Plus we added 2mb of flash, though it's optional.

If anyone wants to try to packing the components into a somu v2, that'd be a nice addition to the *omu family [1] and we'd be more than happy to help with manufacturing. Same for a somu for usb-c.

[1] https://tomu.im

> I bought Somu partly for convenience, and partly for the promise of PGP support, which unfortunately hasn't been added yet (though there is a development version).

It is sad that with PGP being so horribly broken, it still casts its shadow over security products.

PGP should have been dead and buried eons ago.

> It is sad that with PGP being so horribly broken, it still casts its shadow over security products.

How is ssh with a PGP key horribly broken? There's no shadow over Solo/Somu from where I'm standing.

The key is fine. PGP--not so much.

https://latacora.micro.blog/2019/07/16/the-pgp-problem.html

So what's the problem, and what's the alternative anyway (in the absence of FIDO support in the case of ssh)?

The HYPERFIDO Mini keys (8 GBP[0,1]) are certified by the FIDO Alliance: https://fidoalliance.org/showcase/hyperfido-mini/.

[0]: https://www.amazon.co.uk/HYPERFIDO-MINI-FIDO2-HOTP-Security/...

[1]: https://www.hypersecu.com/products/hyperfido

The HyperFIDO is basically fine, it's obviously your choice to insist on the expensive famous brand products, but it seems a bit crazy to on the one hand insist those are too expensive and then reject perfectly good cheap options.

If I had a corporate budget to spend maybe I'd order trays of Yubico Security Keys or Google's Feitian rebrand. But I just wanted to have more than one vendor so I have this product (well not this one, but it's the same product under different branding) and it works fine.

AMAZON AFFILIATE LINK. Please delete....

Disappointed but not surprised when reading this. To be really honest, I can't remember the last time I read something that criticized so called "techbros" and actually said something reasonable.

As for the U2F devices, the idea of just leaving them in, the small yubikeys and all that, seem to just be a bad idea from the get-go.

You can leave them in, but you still have to tap/touch them for every authentication action (user interaction); the small YubiKey Nano included.

What is your objection to just leaving a yubikey plugged in? It eliminates most of the ways an attacker could impersonate me besides literally stealing my laptop, which is a high bar. Most people are valuable enough targets to phish or infect with malware or something, but not to plan a computer heist.

If stealing the computer is enough, someone's seriously screwed up already — it's supposed to be 2FA, not 1FA.

Stealing the computer is usually enough, as a browser cookie serves as proof of authentication all on its own. Some destructive operations require extra auth, but in terms of data exfiltration, stealing a laptop gives you everything you need.

What exactly does that have to do with YubiKeys though? Every time you use one you need to enter password. And you can also immediately revoke it as soon as you notice its stolen.

I kind of omitted that part. Having a YubiKey in or not in the laptop won't really affect things (other than the fact that you will need to get into your account somehow without the yubikey if the yubikey is stolen).

Found the techbro.

most people have a phone that can leverage webauthn, so you don't even need to buy anything. On top of that, webauthn can be configured to prevent phishing as well

Plus, iPhones already support webauthn via Face ID, and I assume MacBooks will support it via Touch ID at some point.

It is disappointing that touch id doesn't support this yet, it would be great. I put my ssh keys on touch id but my webauthn and gpg are on the yubikey and I have to remember which to touch. And the yubikey with finger print reader isnt out yet and I already have pretty much the right hardware in the mac...

For the reasons listed in the article and more, Yubikeys and similar devices aren’t likely to ever be popular.

To give future security devices along the same vain a better chance at gaining popularity and being widely adopted (which will hopefully bringing us a more stable, less stressful society), the designs of these new devices must solve or workaround the issues the author describes.

It’s really annoying when individuals such as yourself respond so very negatively and unconstructively while others are trying to discuss the issues with existing designs — an act necessary for us (collectively) to develop new designs.

The author may not provide strong evidence for their claims, but neither do you provide strong evidence (or extensive reasoning) for yours. The net gain here is negligible, expect for showing that contrary opinions exist, but that’s not particularly helpful as for every opinion held it is inevitable that someone holds the polar opposite.

I’m not a moderator, but I ask you to please try to better further the discussion with future comments.

I think Yubikey (and similar physical solutions) will eventually gain popularity. Carrying a key is pretty much a standard practice across the globe and benefit is more than negligible because it forces physical attack versus remote/virtual.

Instead of a hardware authenticator to be carried on a keyring, they should be put into rings, i.e., the things meant to be worn on your fingers, i.e., the things that most people use for providing input to their computing devices, whether they sit on a desk or are held in one's hands.

This is actually brilliant.

I had one twenty years ago, a Java Ring. Apparently they are still being made today.

Until keys become cloneable they will never gain popularity.

Nobody wants to re-setup every site ever because they lost their laptop that they kept it plugged into, so they won't. either this means using their backup until they lose it without even revoking the original and then swearing off the entire concept while telling all their friends to do the same, or just not using hardware tokens after the first lost of keys.

Also the "back up code" they will also get, guess where thats going! save as -> downloads or print2pdf -> downloads.

When it comes to personal account security by end users, hardware tokens will never take off, and this is why they get so much hate.

There is a real problem here that really needs to be really solved, wrt to end users and phishing/hack resistant credentials, and as long as we legitimize the lie that yubikey solves it, we gimp progress towards actually solving it.

I am not understanding your concern. You definitely don’t want the keys to be “cloneable”. You need at least two keys, sure, but I don’t see that as an inconvenience. And you should be using a password manager (with passwords cycled on a periodic basis) that is bound to your physical key.

I don't think cloneable is a good idea. If some 3rd party clones your token and uses it to commit a crime there is no way to prove that happened.

There are other solutions. Being able to make one key a proxy for another is one. That allows you to keep your master identity in a bank vault, and then use it to "sign" the one you keep on you during the day. Should you lose your daily driver, just sign another one. This still suffers from the "one true name" problem though - if someone steals that bank vault ID, you're gone.

Another approach is servers allowing a client to register multiple ID's, and later delete them. Since there are multiple ID's, there isn't one true name any more. If one is lost you cancel it, and replace it with another. The approach is already built into the FIDO2 protocol, so they've already thought about your concerns and solved them, and IMHO solved them in a better way than you propose.

A more robust approach still would be a combination of the idea above: FIDO2 multiple ID's solution, plus proxies. One key could then provide multiple ID's to every server you log into, signed by different masters that are stored in different places. Keys can't be copied, but a lost key can be replaced by signing it with the master. A compromised master can be have all it's ID's dropped by logging in with an ID proxying other master. You could think of it as RAID for 2FA's.

> Being able to make one key a proxy for another is one. That allows you to keep your master identity in a bank vault, and then use it to "sign" the one you keep on you during the day.

Yes, clonable tokens. Exactly.

When people ask for clonable tokens. This is an acceptable solution.

(But skip the bank vault. This is for avg Joe, not Jeff bezos. The closest safe will do)

I've long thought that U2F should be incorporated into phones, since everyone has one of those. Even not well off people in third world countries. In order for U2F to proliferate, everyone should have access to it. A $10 FIDO key probably won't be given a consideration if they think a free password is good enough.

WebAuthn is the modern replacement for U2F. Do not deploy greenfield U2F, it's a legacy technology only.

A modern iPhone or high-end Android phone already does WebAuthn secured with your fingerprint or (on some iPhone models) facial recognition, like your lock screen or contactless payments.

I use a Yubikey daily and the OP is greatly exaggerating the issues in my opinion. Vanguard for example it took less than a minute to set up. I don't have an "application" installed locally for the Yubikey, it was plug & play. No special software needed.

I honestly think Yubikey type devices' largest problems are - 1. Marketing. People simply do not know they exist or how they work (simple or not). 2. Support - Many websites do not support Webauthn yet. We really need developers and businesses to consider this a priority.

I have bought some keys for my family members and they love them once I demonstrate how they work.

Price. Yubikey's "best seller" goes for $45, that's grotesque. I would be surprised if the hardware costs exceeds $2 per unit and the software (or similar) can be had for free.

It's not about the hardware. In spite of the fact that they can nominally be broken into, most modern USB microcontrollers can easily implement being a security key.

The expense is that the security world hasn't converged on anything remotely approaching a single standard. So, a key has to support ... PGP, OpenSSH, FIDO, FIDO2, U2F ...

For example, you couldn't use some of the older YubiKeys with AWS because AWS only supported time-based TOTP.

That's a LOT of software work, and you can't be "Startup Sloppy" with your code or someone will break it.

The PGP thing is wildly different than the other applications in that it is a complete airgapped system on a key. The decryption and signing is actually done on key so the private key isn't exposed. PGP is pretty much the only thing that does this and as a result can be held up as an example of where we do in fact have a unique standard.

> I’m not a moderator, but I ask you to please try to better further the discussion with future comments.

Please don't go there. You're both adding to the discussion, maybe some strong words here and there, but this turn of phrase you used is a huge conversation destroyer.

Reply on news.ycombinator.com