Hacker News Reader

Comment by VA3FXP | Hacker News Reader

A security token is an excellent concept, but usually fails when applied to 'typical' use-case scenarios.

Are you military personnel who is in charge of turning the key and launching the nukes? -Excellent reason to have a key that is impossible to forge. -Also, "key discipline" is likely very high.

Are you a paranoid nerd that wants to make sure that you cannot be compromised? -Excellent reason to have a key that is impossible to forge. -But what happens when you lose that security token?

i.e. "Honey! I can't find the car keys, have you seen them?"

We desperately need _BETTER_ 2FA. Bio-metrics are not the answer. I would be in favor of an implantable RFID chip or whatever 'better' tech comes around.

View on HN

> But what happens when you lose that security token?

Pretty simple: you use your backup key to revoke the lost key. This is possible with e.g. Lastpass and Google. Of course, if the attacker logs in before you revoke the key, you are hosed, but the same would be true in your car analogy.

> i.e. "Honey! I can't find the car keys, have you seen them?"

With car keys, too, you have a backup key. Arguably, the physical car keys are easier to copy.

> I would be in favor of an implantable RFID chip or whatever 'better' tech comes around.

Nothing new, see this article from 2004 [1]. As you can read in the article, its first headline was even in 2001 (to put in perspective this is 15 to 16 years ago). Company's name is VeriChip.

The problem is that the signal can be intercepted (AFAIK it doesn't use a form of OTP), and the key cannot be easily replaced/revoked. A YubiKey doesn't suffer from this issue. The issue a YubiKey has is that it can be easier lost than an implant.

The YubiKey Neo ('large' version, not the 'laptop' version) supports NFC.

> We desperately need _BETTER_ 2FA.

Why? How?

[1] http://www.wnd.com/2004/04/24179/

I'd love something like a Yubikey Neo (NFC) with a fitness band type form factor (that I can shower/swim with), and an intention indicator (button of some sort) before the NFC would respond.

Right now I use a Pebble smartwatch (which I use for fitness, too) with Bluetooth 4 to unlock my Android phone. Not very secure since (as you put as well) I don't verify the unlock via my smartwatch, and I'm not sure about impersonating Bluetooth 4. Then again, I'm not sure if NFC (RFID) can be impersonated, either. And, if yes, how feasible it is.

That begs the question, what if you lose your backup key too (it's far less frequently used, adding to the possibility) or don't have one because it would decrease security? Here is where car analogy stops working.

> That begs the question, what if you lose your backup key too (it's far less frequently used, adding to the possibility) or don't have one because it would decrease security? Here is where car analogy stops working.

What if you lose the backup key to your car? You're can break a window to enter, but a modern car won't start easily because of the lock on the steering wheel.

Make sure you don't store both keys at the same place. Make sure one is stored at a secure place, while the other one is securely attached with you. A secure place to store a key is a fireproof safe, or a notary.

In a real pinch, I can pay a locksmith.

Can you do the same with crypto?

The procedures to maintain access to your car aren't really sufficient.

A non issue, PEBKAC.

If you're afraid you lose both your main key as well as your backup key at the same time before you were able to reinstall another backup key you can ensure you have more than 1 backup key, and/or (re)consider where you store your backup key(s).

Also, it depends on where you are using the YubiKey. If its an online service you may be able to identify yourself via alternative ways. If its your FDE, you're hosed. Or you have backups. Either way, the above still applies.

Not disagreeing with your comment, but what do biometrics have to do with this article? I don't think Yubico does anything with biometrics, and these devices definitely don't have any such capability.

Moreover, U2F already is awesome 2FA (better than _BETTER_). Fast and unphishable. Buy a few of these, keep one on your keychain, one on your desk at home, and a backup locked in your safe, and you're all set.

We use the USB-A version of these things extensively at my company, and they're unbelievably convenient.

I'm not the OP but I assume they brought up biometrics because that's something you can't forget and leave at home (like you can with a Yubikey attached to your car keys).

I get it, now, thanks. OP used biometrics as a strawman, and I misinterpreted the use as a reply to a (nonexistent) point in the original article.

Fwiw I wear my key around my neck. It only comes off the shower. Routine is the key to retention

We don't need better 2FA, we need better 1FA. Biometrics are not the answer for that either, but rather new protocols that are independend of the mechanism you use.

That exactly what the FIDO protocols are trying to do.

You can use you shitty local fingerprint sensor as a authenticator but you will still get better security agains everything exept if somebody steals your phone.

Phising is the biggest problem, it needs to be solved. We can do it in the first or the second factor. People either need to move to U2F or they need to move UAF on the first factor.

This is really the only hope.

> Biometrics are not the answer for that either

Biometrics are a way to identify a user (and establish a username); not a form of authentication or replacement for a password. This is because biometrics cannot be replacement, while they can be copied or mimicked.

1FA is theoretically possible without a password, with a form of OTP.

Biometrics SUCK. I spend many days a month digging rocks. My finger prints are rarely intact enough for a fingerprint reader to capture them and read them.

> Biometrics SUCK.

As do [secure] passwords. Which I'll demonstrate below.

> My finger prints are rarely intact enough for a fingerprint reader to capture them and read them.

Scan multiple fingers. Use different biometrics such as a photo of your face, or your eye. Remember, biometrics are meant as username replacement, not authentication (e.g. password-based); ie. so you don't have to type 'lightedman', not 'ethically-rage-retake-unlined-wrangle-lapel'.

And yet the original point still stands, which is biometrics are terrible passwords. I still agree with this timeless article on biometrics (fingerprints for this article, but all biomentrics in general) are excellent usernames, but terrible passwords:

http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...

"Remember, biometrics are meant as username replacement, not authentication (e.g. password-based)"

Tell that to my fiance's iPhone, or my HP NX-series laptop which has Windows XP and a biometric user authentication login, I don't think they got the memo.

"Scan multiple fingers"

I guess you didn't read what I wrote. I'll just stop here until you do.

> I don't think they got the memo.

Sadly, they haven't. Did you get the memo where people from CCC got the fingerprint from a minister, just to prove a point?

> I guess you didn't read what I wrote. I'll just stop here until you do.

I did read what you wrote. That doesn't refute that in use cases, one finger(print) may stop working while another still works. It also doesn't refute that other biometric data stays intact. Although having to type 'lightedman' is a minor nuisance.

> Did you get the memo where people from CCC got the fingerprint from a minister, just to prove a point?

And they could have got his phone PIN just by standing in line behind him at Starbucks when he unlocks his phone

"That doesn't refute that in use cases, one finger(print) may stop working while another still works."

Not in mine. Simply put there are too many cuts on every single finger on my hands to make biometric fingerprinting a reliable thing, and those cuts change pretty much daily. Do mining like I do, in hard rock, with hand tools and no gloves (because you need to feel for things lest you destroy a perfect specimen.) You're not escaping uncut, no matter what.

Cheers for explaining your use case.

For people like you we either need alternative way of identification (such as face recognition), or we need you to type your username ('lightedman'). The latter is IMO (in 2017, without physical keyboards) rather annoying.

Remember, I don't suggest we authenticate via fingerprints.

I'm confused...how are authentication and "password-based" related? (Yes, passwords can establish who you are...just as biometrics or tokens can. Or they can be used in place )

Using Biometrics for claimed identity is a choice (I guess...it's not one I've heard of before), not a mandate. 2FA doesn't specify what factors line up with with "claimed identity" vs "confirmed identity" - just that 2 factors is more secure than 1 factor.

I've never heard of "used biometrics as username, and a password as password", nor that "biometrics are meant as username replacement". Have I fallen behind, or am I misunderstanding you?

My understanding is that, in CONFIRMING identity, you want at least two of "know something, have something, be something". Every example I've heard/seen (admittedly limited) used these to confirm a claimed identity, not to make the claim in the first place.

> Remember, biometrics are meant as username replacement, not authentication (e.g. password-based); ie. so you don't have to type 'lightedman'

I think that's a solution in search of a problem. That may be all biometrics are actually good for; I don't think it's why anyone is interested in them.

It is a minor convenience which in the end is going to save a lot of minutes a day per human being. Time which can be spend more productive.

Practically speaking, I've been using a yubikey plugged permanently into my laptop for many years, and it works fine. I use it to authenticate to my work VPN (with a password as second factor).

The only downsides are: one fewer USB port, and the green light on the yubikey which is permanently lit.

You've made a great list of the downsides, perhaps you could at some point list the upsides? A yubikey you don't move around, and that you don't take extra steps to ensure the security of, seems no more secure or useful than a cert file on your hard drive.

Unlike a cert file, a hacker can't steal the keys in a Yubikey if the machine is compromised. Same reason why many enterprises prefer using TPMs for storing machine certs.

The advantage of a Yubikey over a TPM in this case is that the Yubikey requires a physical tap before it'll sign a request, which prevents certain MITM attacks.

If I understand correctly, you must touch the Yubikey to reply to a second factor request. Simply being present in the USB port is not sufficient to utilize its credentials.

the PIV and OpenPGP apps don't seem to require the physical interaction, but do require a PIN entry (just like a traditional smartcard).

As others have said, you have to touch the yubikey to get it to generate a one-time password (it acts like a USB keyboard).

The yubikey is one factor, the VPN also requires a second factor (memorized password). These are concatenated so you type the password without pressing the enter key, then tap the yubikey (which "types" the OTP + enter key). This process works in web forms, shells, etc. Could hardly be simpler.

If the laptop is lost/stolen, I can deactivate the token.

I have one that's permanently installed too, and the green LED isn't ever lit unless an app is asking for touch. Perhaps it depends on what mode you have it it? (I'm using mine in U2F + PGP Card mode.)

Indeed it is always important when considering security, to look at the other side and balance the risk of someone else gaining unauthorised access with you possibly losing access forever. Everyone wants "unbreakable" encryption, but unfortunately it seems very few consider the possibility of themselves losing the key --- perhaps it is because locks in the physical world are not quite as strong as good data encryption, and can be easily overcome with locksmiths and the like.

> But what happens when you lose that security token?

It's really not that big of a problem, at least in the "paranoid nerd" context. Just have backup keys that your users can print out and keep in a safe place. Or have more than one U2F device - most implementations I'm aware of allow users to register more than one device.

Of course, for most applications, there'd still be the usual support backdoor. That's definitely a problem not quite as easy to solve.

> I would be in favor of an implantable RFID chip or whatever 'better' tech comes around.

Like a vivokey? http://vivokey.com/learn-more.html

Why not just wear a ring?

Seems like the main reason is so that the guy who made it can call himself a transhumanist and say futuristic things.

Watch him put his phone to his wrist. If it was on his finger he wouldn't have to take the phone out of his hand. Is that thing glass? How is he not worried about it shattering when he falls?

I found http://nfcring.com/ but macbooks can't do NFC, otherwise I'd preordered one.

I also learned that NFC is RFID at 13.56 MHz.

The vivokey has a secure element: you can keep RSA keys on it and use it like a yubikey.

Notably, it's the first NFC 4096 bit capable device I've seen (Yubikey Neo is max 2048bit; Yubikey 4 doesn't have NFC).

Moi? I'd rather buy ten passive backup keys than implant an RFID key that puts out a signal that never turns off. At that point you're robbing Peter of pay...Well...Um...Big Brother.

Reply on news.ycombinator.com