YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

Re:YubiKey 5 Series with New NFC and FIDO2 Passwordless Feat... by martinwww on Monday September 24, 2018 @10:06AM (#18057744)

well code which U2f token generate with the help of Google authenticator has ONLY 6 digits. 6 digits that's not extremely hard to brute force is that right ?

If you are using additional backup u2f token (2 tokens in total) hacker has chance 1:500 000 to find out correct PIN is my assumption right ?

[ Parent | on HN ]

Re:YubiKey 5 Series with New NFC and FIDO2 Passwordless Feat... by tialaramex on Monday September 24, 2018 @12:10PM (#18058881)

You seem confused. I think you're describing TOTP, but this whole thread is about FIDO.

WebAuthn, U2F and similar FIDO based schemes are sending some public key signed blobs over the network. A PIN is purely a local protection, it's not sent over the wire. So a hacker can't just try guessing the PIN. First they need to steal your physical token, only then could they start guessing PINs for the stolen token.

[ Parent | on HN ]

Re:YubiKey 5 Series with New NFC and FIDO2 Passwordless Feat... by emlun on Tuesday September 25, 2018 @06:11AM (#18064940)

And even then, the token would lock itself down after too many incorrect PIN attemtpts.

[ Parent | on HN ]