YubiKey Bio Series

Your question implies that the yubikey is an HSM. It isn't. It has a secure element.

If you want to implement your own novel test of user presence, you could get an F-Secure USB armory device (https://www.f-secure.com/en/consulting/foundry/usb-armory) and tap into the GPIO.

Trezor - I've been using one for years and it's great. Also you can backup/restore the seed (so you don't need to register multiple devices).

In essence, you require both the Yubikey in question, and the information supplied by the fingerprint reader to the Yubikey, in order to abuse this system.

From the perspective of a U2F token, which uses a regular button, this is an increase in security for most users -- if their token is lost or stolen, or left in their device, someone cannot use their token by tapping the button.

This doesn't address the inherent problem of irrevocability/unchangeability of biometrics, but it presents an interesting usability trade-off that could help non-technical users to keep their systems more secure.

If you capture the wire signal between the fingerprint reader sensor and the module, it is likely that you could replay a valid authentication. If not, you could delve deeper into the sensor until eventually you are able to inject capacitive data from the sensing surface itself, and do this.

In this case, by combining the use of a biometric with strong cryptographic authentication through the token, you require both to compromise the user -- no biometrics are shared with a server, it's all local. However if you lose either the token, or the ability to use that fingerprint (i.e. scratch or damage), you will lose access to the key the Yubikey has protected, absent some kind of backup password. For many users, that backup password will be the weak link, but a Yubikey should at least be able to rate limit attempts and erase its internal state if there are too many attempts.

> Its pretty well known that fingerprints _by themselves_ are a pretty poor replacement for passwords. (a) They're public, in that it's pretty easy to get someone's fingerprint... just find something they touched recently. (b) If they're compromised its impossible to change them.

I'm a bit more worried about Russian ransomware operators getting my passwords than my fingerprint.

I haven't used any of the other modes on my Yubikey 4 than the OpenPGP Smartcard. I would hope that other modes also support PINs/passwords, so the fingerprint is just an additional factor. If that's the case, it's not necessarily about replacing passwords with fingerprints.

It's not only a fingerprint. The fingerprint tells the yubikey that it's you who is activating it.

Without this model the attacker needs to steal the Yubikey. With this model the attacker needs to steal the Yubikey and pull a fingerprint.

It remains to be seen if that's a meaningful difference, but it seems reasonable that in some situations it could make the attack much more costly.

I could see myself using this when traveling.

A fingerprint is not a password, it's a username.

> fingerprints _by themselves_ are a pretty poor replacement for passwords

eh, that is not well known nor is it true. It is very much use case dependent.

For example, a fingerprint is a great replacement for a password to unlock your phone, for most uses of such.

When Webauthn requests user verification on a non-bio yubikey user needs to provide a (6 digit) pin.

Doesn't Yubikey design them to be left plugged in all the time? I don't see how it compromises the security at all

it absolutely does not defeat the purpose: if you somehow manage to get my password/ssh key _remotely_, there is still one more obstacle you cannot get as it's _local only_. that is why it's a second factor.

something you know with something you have.

I'd say this covers the 99% of how credentials are being misappropriated.

The yubikeys are designed to be non-clonable, so it is two factors: something you have and something you are. Not all factors are created equal, and in the past there have been issues with biometrics not really being a reliable indicator of something you are.

It doesn't defeat the purpose (if you take it, they've lost a Factor and you still don't have enough of them) but it will certainly teach them to have more than one.

(Aside: I have a story for another time about how I soft-bricked my first while finally getting around to setting up a second; that I've not yet quite recovered enough to properly tell...)

Importantly though it's a good single factor. Passwords aren't good.

1. They get repeated.

2. They get phished.

Even just as a single factor, even without a fingerprint reader, a yubikey is far superior to a password. Adding a biometric on top of that is wayyyy better than a password.

Most of what MFA has done for us is actually just provide slightly better "A's". It's not the quantity that counts, it's the quality.

Previously to reach a good quality we'd need multiple factors. We've reached a point now where we have standards for authentication that are strong, often "strong enough", even with a single factor. A password then becomes a bit of a bonus.

Same. I don't know of a single US-based bank that supports it.

When they finally support it, I guess they will add the convenient option to say you don't have your yubikey with you at the moment and then an SMS will be sent instead.

My bank recently started supporting it:

https://www.online-zahlen-mit-fido.de/

I recently was looking to add my yubikey to one of my banks (BofA) and I could not for the love of god figure out how to add one. I know BofA supports it because there are many articles about adding it, but I couldn't find a way of doing it from their website. The best I could do from there was SMS 2FA.

I finally found a link from just googling around that took me directly to a page where you could add a security key. But the catch was that I had to have an active session if I wanted to add a key. If you weren't already logged in in another tab, it will redirect you to the BofA dashboard after you log in. From all the time I spent, there is no way to get to that page from the BofA web dashboard. Very frustrating and annoying experience. But atleast it is out of the way now.

FYI you can only have a max of 2 yubikeys.

Have you asked them to? I've sent support requests to every vendor that doesn't support U2F with the hope that if others do the same it may get bumped up.

The one to unlock my Samsung Galaxy whatever-number-it-is works pretty consistently.

Android supports registering multiple fingerprints to get around this. I wonder if that's also possible with this key.

I'm with you, I've fallen out of the habit of using fingerprint auth on any of my devices that support it (Macbook, Thinkpad, Motorola phone) because it's so unreliable. I have to re-enroll at least weekly if I want to keep it working well. I have eczema issues on my hands, which I think is the main issue, but also have found cuts and paint/glue to be common problems. I can enroll multiple fingers but that means I have to try four fingers before it unlocks... and usually I end up enrolling the same finger multiple times instead since the device has stopped recognizing it.

For what it's worth I used to have a job that involved frequent use of an optical fingerprint reader (the type that's a camera behind a glass platen) and did not have these types of problems with it. I think it's a weakness of the capacitative type of reader that all devices are using now, or possibly just less sophisticated matching software.

Don’t know if this works for others, but for Apple Touch ID you can solve the wet finger issue by adding another set of prints while the finger is wet.

I would probably buy it if it had OpenPGP support

What are the alternatives now? I never really liked the Yubico stuff, though I have to admit that their hardware is well made.

I bought some Yubikey standards back in 2014 and they were $25 apiece. The Yubikey 5 NFCs I got 4 years later were $45 apiece, but had NFC and did more stuff. They released some U2F-only yubikey security keys that I thought were $20 but I am not sure (they were blue, and cheap).

Now these, which the site suggests can only do U2F/Webauthn with fingerprint, are $80. I think it's cool to have a portable fingerprint-secured webauthn token, but it's disappointing to see them so expensive. I wonder if this is the long-term price, or if they are more expensive temporarily due to supply chain issues or something like that. Or, maybe they are substantially cheaper in bulk.

There are budget smartphones you can buy under hundred bucks (Cubot Note 7). Charging $85 for this is ridiculous.

I wonder if the limitation is power. Can a fingerprint scanner be powered by NFC?

OTOH in my specific use case, I only use the NFC with my phone, the USB-C version should take care of that

This looks like it might be a bit of an early testing-the-waters, or even a one-off to satisfy a specific set of customers (note that they're FIPS compliant only).

If there's more traction I would expect future models to include more features.

Yes, Windows can use a Yubikey for Windows Hello either to unlock the device (not login) or as a second factor for anything else supporting Hello.

Not with the Bio series apparently, but at least on the Yubikey 4, when you're setup with OpenPGP, a tap works with a single request and it prompts you to tap with a blinking light. If it's blinking when you haven't done anything to prompt a tap, that would be something to worry about. If you do something that prompts a tap and a malicious process also requests something from the key at the same time, you'll get 2 requests. You'd tap it for the request you're expecting, see it blinking faster to confirm your tap, and then blink slowly again to request the 2nd tap. That second request would be your cue for worrying. IOW, the blinking is an alert against your scenario.

I think the point of this is that if somebody steals your YubiKey, they also have to steal your finger to be able to use it.

I don't even understand the threat model for this, and why it's better than the fingerprint sensor built into the laptop. Seems like it's just writing the software elsewhere. What's up with the micro Yubikeys always left in a usb port operable by anyone made even less sense, so a step up.

I know this analogy is not pedantic but it's fun to imagine the same argument with physical keys.

Lose your hands and you won't be able to use your house key.

Lose your house key and you'll have nothing to use.

Lose your mind and you won't know how to use a key.

You can setup alternate valid credentials. For example, in the case of the "have", you can have multiple valid keys. In the case of the "know", multiple valid passwords. In the case of the "are", perhaps on this model or a future one, multiple valid fingerprints. You can also setup e.g. alternate 1FA with a really strong password.

But isn't everything I know what I am?