News for hackers. Stuff that matters.
Re:Hype Will Turn Your Security Key into Junk by heavyset_go on Thursday July 13, 2023 @11:40PM (#36719220)
You can use the Yubico Authenticator app's WebAuthn feature on the desktop to see resident credentials on their Security Key product, same thing with Chrome/Chromium's security key settings pane.
Re:Hype Will Turn Your Security Key into Junk by NoZebra120vClip on Friday July 14, 2023 @12:27AM (#36719477)
Nope. I have Windows Yubico Authenticator v5.1.0, and with the Security Key plugged in, all screens blank.

In Chrome 114.0.5735.199 on Windows 10 Pro, there is no "security key settings pane". The closest thing available is "Privacy and Security -> Security -> Manage phones (control which phones you use as security keys.)"

However, in terms of resident credentials, I thank the GP and I stand corrected, because Yubico's own specs say that this key sports 25 slots. I wonder how many are currently in use, and which version of the CTAP protocol it is using...

Re:Hype Will Turn Your Security Key into Junk by gre345t34 on Friday July 14, 2023 @02:10AM (#36720061)
CTAP1 is only used for talking to old U2F keys.

Additionally, U2F/CTAP1 does not support resident keys anyway (IIRC).

Re:Hype Will Turn Your Security Key into Junk by heavyset_go on Saturday July 15, 2023 @06:17AM (#36735246)
So I just tried this with a blue Yubico Security Key with 5.4.3 firmware using Yubico Authenticator 6.2.0 on Linux, and I was successfully able to manage my resident credentials using the Authenticator after setting a PIN and saving a resident credential via https://webauthn.io.

I'd check your firmware versions, update your Authenticator, ensure you have a PIN set and ensure you're correctly saving a resident key on your device when registering with a service.

For Chrome, a visit to chrome://settings/securityKeys[1] should do it, but I just tried it in a Windows VM and it is not present in the menu, while it is present on Linux and macOS.

[1] https://chromium.googlesource.com/chromium/src/+/HEAD/device...