Questions tagged [fido]
FIDO (Fast IDentity Online) is a technical specification for biometric authentication to online services.
75 questions
5 votes
1 answer
809 views
Can you bypass PIN requirement of FIDO token protected LUKS device with hex editor?
I noticed that with Linux pam-u2f module whether you are required to input your PIN can be changed by simply editing ~/.config/Yubico/u2f_keys file and either adding +pin to your configuration line or ...
- 151
1 vote
1 answer
139 views
Is clientDataJson and attestationObject required to verify assertion during authentication in WebAuthN?
Currently I am working on implementing/supporting WebAuthN in my service (JAVA). I have a Control Plane which handles the registration ceremony and Data Plane that handles the authentication ceremony. ...
- 13
0 votes
1 answer
256 views
Best Practices for WebAuthn FIDO2 reset
Security Noob here. I am trying to build a secure passwordless login mechanism for my webservice. The authentication mechanisms My idea is to encourage the users to use the following two login methods:...
- 1
1 vote
1 answer
265 views
Is there an equivalent to passkeys but to prevent cookie stealing?
Passkeys prevent phishing, no one can make you login remotely (without exploits) and if they are hardware based and never leave the hardware, them even exploits might have a hard time getting them. ...
- 375
0 votes
1 answer
114 views
Suggestions for implementing a simplified subset of WebAuthn Relaying Party Operation
Previously some good fellow explained the importance of verifying the public key created and offered by authenticators. As before, given the complexity of a FULL implementation of RP operation, I ...
- 402
0 votes
1 answer
205 views
Will sky fall if I don't verify `AuthenticatorAttestationResponse`?
Through reading the WebAuthn spec and related MDN docs, I understand that unlike "certificate signing requests", FIDO/Passkey can have various different attestation formats and verification ...
- 402
1 vote
1 answer
335 views
Is FIDO authN vulnerable to relay attacks?
In this question: Is FIDO2 authentication vulnerable to a social engineering replay attack? it was answered that no, not vulnerable because "the keypair used to by the FIDO device to authenticate ...
- 137
0 votes
0 answers
19 views
Why does FIDO2's spec not mention FIDO UAF as a related standard? [duplicate]
Why does FIDO2's spec not mention FIDO UAF as a related standard? I wonder if FIDO UAF is still relevant. Will FIDO UAF be deprecated eventually in favor of FIDO2? Why do they co-exist if they fulfil ...
- 101
1 vote
0 answers
283 views
FIDO Multi-device Authentication Sync Technical Specification
Where/what are the technical specifications to sync FIDO passkeys? FIDO passkeys are a quite hot topic. There is a white paper from FIDO Alliance about it. Several websites provide abstract ...
- 201
2 votes
2 answers
294 views
Windows controlled folder access to secure Chrome cookies?
I've read about Linus Tech Tips hack, where a malware stole the browser cookies & was able to log in to Linus's channel. Is this preventable with Windows controlled folder access (preventing apps ...
- 121
1 vote
1 answer
2k views
Reading SSH private key physically stored on yubikey to remote into external PC
I was wondering if it's possible to only store and read a ssh private key on a yubikey and not read the private key the yubikey generated from a client computer? Currently the only way it seems to ...
- 193
2 votes
0 answers
132 views
Yubikey Private Key Generation & Storage 5 Series vs Bio Key
References: Yubico’s Take on U2F Key Wrapping https://www.yubico.com/blog/yubicos-u2f-key-wrapping/ Key generation https://developers.yubico.com/U2F/Protocol_details/Key_generation.html Discoverable ...
2 votes
1 answer
600 views
When hardening my SSH key, why would I use yubikey-agent instead of the built-in `-sk` key type native to OpenSSH?
OpenSSH 8.2 added -sk key types that allow for FIDO/U2F hardware authenticators (like a YubiKey, etc.) yubikey-agent allows for the same functionality, except it (a) requires an additional client on ...
- 151
0 votes
0 answers
182 views
Solutions for out of band biometric login
I am enhancing our login flow to include biometric verification via your phone. The user will log in to the desktop app but will have to verify their identity via their phone. We already have an app ...
- 101
3 votes
1 answer
980 views
Is FIDO2 authentication vulnerable to a social engineering replay attack?
I'm starting to learn about the FIDO2 standard, and I'm wondering if this scenario is possible... Victim visits a credential harvesting page and enters their credentials Credential harvesting backend ...
- 845