emlun

8 ms·

1.
by emlun 7y ago
Someone made a bookmarklet to disable it: https://github.com/kfahy/slack-disable-wysiwyg-bookmarklet
2.
by emlun 8y ago
Google did suddenly start supporting U2F in Firefox a few months ago!
3.
by emlun 8y ago
Unlimited! Except for passwordless credentials, which do consume storage space aboard the device. But second factor (U2F style) credentials are stored encrypted on the server, so there's unlimited "space" for them.
4.
by emlun 8y ago
If the server allows it, sure.
5.
by emlun 8y ago
That won't work for U2F or FIDO2, unfortunately, since the master key is not configurable. You need to enroll both keys with each new service, sadly.
6.
by emlun 8y ago
For U2F you're right that it becomes single factor if you use the device as the only factor. With FIDO2 (which is what makes passwordless available), however, the device supports a local PIN as the "something you know" factor
7.
by emlun 8y ago
It's a hardware token that supports a local PIN as a second factor.
8.
by emlun 8y ago
My friend lost his YubiKey and found it embedded in his gravel driveway six months later. Still worked like nothing had happened.
9.
by emlun 8y ago
And even then, the token would lock itself down after too many incorrect PIN attemtpts.
10.
by emlun 8y ago
NEO also does OpenPGP over NFC on Android. iOS only recently started opening up NFC to non-Apple developers.
11.
by emlun 8y ago
Yubico currently sells one at $20. https://www.yubico.com/product/security-key-by-yubico/#secur... There are competing U2F keys, but I don't know of any competitors that support FIDO2 yet.
12.
by emlun 8y ago
>where somebody else owns your identity, not you Care to elaborate on how you mean WebAuthn prescribes that? The GUN explainer videos also seem to assume there's a server involved, so I don't understand what you mean is bad abo
13.
by emlun 8y ago
No, you were right at the beginning. There is no "root" or "real" pubkey. A separate keypair is generated each site, so that - like you said - identities are unlinkable. This is also a crucial part of what makes these cr
14.
by emlun 8y ago
Yeah, and a separate keypair is generated for each site.
15.
by emlun 8y ago
Web Authentication is part of FIDO2, which is what Microsoft is pushing. Whether you use it for passwordless login or second factor depends on what the server wants and what authenticator hardware the user has.
16.
by emlun 8y ago
I'm sorry, I don't understand at all what you mean by that.
17.
by emlun 8y ago
No - that process _remains_ a pathway for exploits against the particular website being targeted. The process does not open new pathways for transferring exploits from one site to another - on the contrary, such exploits are made more diffi
18.
by emlun 8y ago
To be more precise, the PIN is the key that unlocks the keyring (the hardware token) that contains the keys (asymmetic keypairs) to the various kingdoms (websites). WebAuthn is not a single sign-on framework, and there's no "root
19.
by emlun 8y ago
Oh, maybe I didn't get the entire question. There's no global identity or "root credential" used for all websites. A separate keypair is created for each website, and a keypair for site A is not usable on site B even if
20.
by emlun 8y ago
I think you misunderstand how WebAuthn works - there's no "root credential". See my other reply https://news.ycombinator.com/item?id=17032637 No third party issues tokens in WebAuthn either - you have your on
21.
by emlun 8y ago
I think you misunderstand how WebAuthn works - see my other reply to your previous message.
22.
by emlun 8y ago
Wait a second. Web Authentication is not an SSO framework - there's no "root credential". Each server you use the token on gets its own keypair which is used for only that site. It seems like the scenario you're describi
23.
by emlun 8y ago
It's mostly for host-authenticator communications, yes, but it it includes a couple of helpers for verifying signatures. But you're right it's not a full-featured server library at this point.
24.
by emlun 8y ago
From what I understand, Firefox doesn't implement the whole U2F spec, and Google and Facebook use some of the features (appID facets) FF left out. However, Firefox, Chrome and Edge all plan to implement the whole Web Authentication API
25.
by emlun 8y ago
The PIN is not stored on the key, it's used to unlock the key. Your analysis is correct, but your premise is false.
26.
by emlun 8y ago
This. Though I'd like to add that FIDO2 does support fingerprints and other biometrics as an additional authentication factor - it all goes under the same abstract "user verification" umbrella as PIN does. The important disti
27.
by emlun 8y ago
Maybe I misspoke - by "optional" I meant "optionally required". The server can require the use of a PIN - and although the PIN verification is done client-side, the authenticator (YubiKey) sets a bit in the signed respon
28.
by emlun 8y ago
What Freak_NL said. No, there is no globally correlatable identity, and it won't be possible to either create or authenticate credentials silently. Browsers will show confirmation popups and YubiKeys will start blinking to prompt for t
29.
by emlun 8y ago
In a sense, yes, but the keyword is "on-device". It's not shared with the server, so it can't be remotely intercepted - but it _can_ be changed in a single place (the YubiKey) should it ever be compromised.
30.
by emlun 8y ago
They will not support FIDO2, but they do support U2F which is compatible with a subset of the FIDO2 features. Specifically, they don't support PIN or username-less login, but they CAN be used as 2nd factors (emphasis on the 2) in addit

More ›