News for hackers. Stuff that matters.

A comment on Passwordless authentication with FIDO2–beyond just the web. Parent comment

Re:Passwordless authentication with FIDO2–beyond just the web by EvanAnderson on Wednesday February 22, 2023 @08:00AM (#34894794)
> How often do you create new accounts at FIDO-supporting sites? You must have a different internet usage model than I do.

It’s introducing one more frustrating make-work item for the human. Now I have to remember to enroll all my keys at all the sites I’ve used them for. Totally manual. Totally forgettable.

These keys should act like HSMs and have proper backup and restore. Even if it locked me into a specific key manufacturer (like lost HSM backup/restore functionality does) I’d take that over the idiotic “just have multiple keys and manage keeping them all enrolled manually” story.

[ Parent | on HN ]
Re:Passwordless authentication with FIDO2–beyond just the web by postalrat on Wednesday February 22, 2023 @09:16AM (#34895838)
Probably the most important feature of hardware tokens is they can't be copied.

Any backup is a copy.

[ Parent | on HN ]
Re:Passwordless authentication with FIDO2–beyond just the web by akarve on Wednesday February 22, 2023 @11:58AM (#34898568)
No. The backups have their own secrets and no relationship to one another. You register them as distinct keys with each app.
[ Parent | on HN ]
Re:Passwordless authentication with FIDO2–beyond just the web by EvanAnderson on Thursday February 23, 2023 @06:24PM (#34918269)
I can initialize a Nitrokey on a disconnected PC with whatever device key encryption key (DKEK) I want (128-bit AES key). I can write that key down and store it in a safe place (broken into chunks, if need be, for my security model). I can backup my keys generated by the Nitrokey to export files that are completely useless w/o my DKEK. I can store those backups wherever I want without any loss of security.

If I lose my Nitrokey device I can buy another, initialize it with the same DKEK, and restore my key backups. (If I really want to I can decrypt my backups using my DKEK.)

If I don’t want to do any of that I can have the Nitrokey generate a random DKEK that is never exposed. Then I lose all my keys permanently when I lose the key. I have the option to choose the model that allows me to backup my keys if I want to.

If the point of the hardware key is to put the owner thru pointless make-work and risk then the hardware key is serving somebody other than the owner.

[ Parent | on HN ]