FIDO2 security key company publishes results of internal security audit

Re:FIDO2 security key company publishes results of internal ... by ShakataGaNai on Thursday February 20, 2020 @09:03PM (#22380381)

I got a Solokey as part of the Kickstarter and love em. USB-C + NFC in one device.

The one thing I'd love out of a security key is the ability to set up a "Twinned Pair". So I can have one key on my keychain that I use everyday and one I keep in my safe in case something happens to the primary. Yes, I know some services support multiple security keys - but setting up two is more work and not all services do support two.

[ Parent | on HN ]

Re:FIDO2 security key company publishes results of internal ... by girvo on Thursday February 20, 2020 @10:29PM (#22380719)

I definitely would like the requirement to allow multiple keys to be a part of the standard. Allowing it at the key level seems dangerous to me, perhaps, in allowing an attacker to perhaps "clone" someone's key that hasn't setup a pair yet, though of course I'm sure there's mitigations for that if it was seriously proposed!

I have two Yubikeys, one in a safe and one on my person. It saved my butt when I lost access to the one on my person for a few days!

[ Parent | on HN ]

Re:FIDO2 security key company publishes results of internal ... by arianvanp on Friday February 21, 2020 @07:53AM (#22382705)

The fido2 protocol involves a counter that allows the server to detect cloning of a device :)

[ Parent | on HN ]

Re:FIDO2 security key company publishes results of internal ... by brazzy on Friday February 21, 2020 @12:50AM (#22381199)

The standard is actually designed specifically to prevent that.

[ Parent | on HN ]

Re:FIDO2 security key company publishes results of internal ... by ac29 on Friday February 21, 2020 @01:11PM (#22385287)

So what happens when you lose your key, or it stops working?

[ Parent | on HN ]

Re:FIDO2 security key company publishes results of internal ... by brazzy on Friday February 21, 2020 @01:51PM (#22385651)

You need to have a completely separate fallback. Typically the service will at minimum give you some one-time codes as an alternative for such cases. many services allow you to register multiple keys or TOTP apps.

[ Parent | on HN ]