I'm a bit emotional after an extremely long and aggravating day at work, so this is probably situational based, but I HATE the whole god damn security field, and this is one of many examples of why.
It's impossible to get simple explanations out of anybody in that field. And it's why security has always been a pain. It's like they're allergic to making plain, straightforward sense.
Here’s what this actually means for people who expect stuff to matter in any practical terms.
5.8 changes zero things about how you work. You cannot upgrade older keys to it, you have no reason to buy it, and the two features actually in there have never once been used by anyone outside a lab. The WebAuthn thing could, in theory, make the browser remember your key so you don't have to pin every time you use it, but that only happens when Apple, Google and others implement this proposed standard. Right now, no browser can call it. Not Chrome, not Safari, not anything. The spec is an open pull request. If it ever ships it's years out, and it wont be you that starts using it first, it would have to be some big auth entity.
The ARKG thing: same, plus it needs a wallet ecosystem that doesn't exist yet.
Yubico shipped firmware whose headline features nothing can currently use, is not relevant for existing hardware, and wrote three pages about AI to sell it. That's the actual story.
> The WebAuthn thing could, in theory, make the browser remember your key so you don't have to pin every time you use it, but that only happens when Apple, Google and others implement this proposed standard. Right now, no browser can call it. Not Chrome, not Safari, not anything.
Wikipedia says that "WebAuthn is supported by Google Chrome, Mozilla Firefox, Microsoft Edge, Apple Safari[13] and Opera.[32]"
Perhaps you should look at the announcement. Of course webauthin is in the browsers. They didn’t announced that they now support webauthn??? I said the webauthn THING because it’s an addition to that functionality!
A 2018 page announcing the base API, and a devtool page about the virtual authenticator debugger is not relevant to this new extensions.
The thing that’s an unshipped proposal is the sign extension.
So my point stands, nothing new and useful in this at all and nothing they announced is usable for anybody today.
Or am I mistaken? What new thing will you, or anybody, do with this 5.8 announcement?
> Perhaps you should look at the announcement. Of course webauthin is in the browsers.
Yes. You sound really confused right now. Perhaps you should take a step back and check your notes.
> So my point stands
I don't think it does. It's quite obvious your claim about webauthm contrasts with reality. If you take the offer to check your notes, you can start here.
It was misleading by me also. As mentioned, terrible work day yesterday, so I was writing angrily. Ironic that I accuse the security people of being bad at explaining, then turn around and explain stuff badly myself...
Ill TRY to make it up by explaining it as i understand this.
This is not adding the pin functionality, I was just focusing on the flow that happens when you get the Fido2 challenge flow on a webpage. That functionality is already there. Thee new thing is the 5.8 ads support for a second roundtrip/flow for signing stuff in browsers.
Right now, a YubiKey does only one thing in browser: signing a "login challenge string" from the webpage (FIDO2 flow). This is just slightly simplified: (random number + domain + some other shit). Fingerprint that string and return that cryptographically signed result to the site, as proof that "Only I could have signed this login challenge."
Right now, that's the only supported back-and-forth flow for signing anything with a YubiKey vs. a browser.
The new thing is that YubiKey wants a second flow, where the browser sends a request to sign any arbitrary text. So the page contains a contract, converts that to a fingerprint, the browser sends the fingerprint to YubiKey, YubiKey cryptographically signs this, and you can post the resultant string anywhere (public key cryptography magic), and that proves that the person holds that hardware key signed that exact input string (the contract).
So if/when Chrome, Safari, Firefox, and more accept this standard, you could click a button below a contract on a webpage, and the back-and-forth dance with the YubiKey would result in a string below that contract being cryptographic proof that the exact contract above is signed by the person holding one specific key.
Notice the lack of any AI-related shit in this functionality, yet the article reads 5.8 is a revolution for security in "the AI era"
I believe in, and am a big proponent of physical 2FA being widely adopted -- though I own a half-dozen YubyKeys, I do wonder what their profit margins are. They feel a lot more expensive than they should be.
> though I own a half-dozen YubyKeys, I do wonder what their profit margins are.
I hope they are huge while the products stay affordable. A cursory check suggests even yubico's product line are on the market for around $30/key. This is hardly expensive.
They always neglect to mention that you can't (unless something changed recently) upgrade the firmware. It's carefully crouched in wording, but to read the site you'd say "Oh, so I just upgrade". No, you buy a new version of the device. And hopefully it's not like the last vulnerability when at least for a while they kept selling the vulnerable devices to deplete their stock unless you knew enough to ask for one specifically with the new firmware.
You know, I owned several revisions of Yubikeys, and I eagerly set them up on every site that would support them. Sadly, unfortunately, they were "not compatible enough" and in fact, it seemed that sites weren't interested in adding or even maintaining existing support, and they fell out of favor with many of us.
I really tried! I even went through extraordinary measures to set them up nicely on Ubuntu and Fedora Linux systems! I had ssh keys with mandatory Yubikey auth! It was nearly cybersecurity heaven!
I eventually de-registered them everywhere possible, and I got rid of them entirely. In fact I purchased a couple Google Titan keys, and even before registering them, I simply returned them unused.
The most secure auth I use now is Microsoft Authenticator, and Google Authenticator for the TOTP stuff. I really don't mind.
My general impression is that Yubikeys are "too secure" for consumers to be using. TPTB do not like Yubikeys because of their intrinsically hardened security. TPTB would rather that consumers use security that has some NOBUS breakability in it. I really don't mind, okay?
I'm a bit emotional after an extremely long and aggravating day at work, so this is probably situational based, but I HATE the whole god damn security field, and this is one of many examples of why.
It's impossible to get simple explanations out of anybody in that field. And it's why security has always been a pain. It's like they're allergic to making plain, straightforward sense.
Here’s what this actually means for people who expect stuff to matter in any practical terms.
5.8 changes zero things about how you work. You cannot upgrade older keys to it, you have no reason to buy it, and the two features actually in there have never once been used by anyone outside a lab. The WebAuthn thing could, in theory, make the browser remember your key so you don't have to pin every time you use it, but that only happens when Apple, Google and others implement this proposed standard. Right now, no browser can call it. Not Chrome, not Safari, not anything. The spec is an open pull request. If it ever ships it's years out, and it wont be you that starts using it first, it would have to be some big auth entity.
The ARKG thing: same, plus it needs a wallet ecosystem that doesn't exist yet.
Yubico shipped firmware whose headline features nothing can currently use, is not relevant for existing hardware, and wrote three pages about AI to sell it. That's the actual story.
bleh.
But a manager came to my desk and asked "what can we do for the AI era"?
> The WebAuthn thing could, in theory, make the browser remember your key so you don't have to pin every time you use it, but that only happens when Apple, Google and others implement this proposed standard. Right now, no browser can call it. Not Chrome, not Safari, not anything.
Wikipedia says that "WebAuthn is supported by Google Chrome, Mozilla Firefox, Microsoft Edge, Apple Safari[13] and Opera.[32]"
https://en.wikipedia.org/wiki/WebAuthn
Here's a Chrome link published back in 2018
https://developer.chrome.com/docs/identity/webauthn
Here's a Chrome DevTools article on their support for WebAuthn
https://developer.chrome.com/docs/devtools/webauthn
Perhaps you should check your notes?.If you know something that everyone around you doesn't, please update wikipedia's article.
Perhaps you should look at the announcement. Of course webauthin is in the browsers. They didn’t announced that they now support webauthn??? I said the webauthn THING because it’s an addition to that functionality!
A 2018 page announcing the base API, and a devtool page about the virtual authenticator debugger is not relevant to this new extensions.
The thing that’s an unshipped proposal is the sign extension.
So my point stands, nothing new and useful in this at all and nothing they announced is usable for anybody today.
Or am I mistaken? What new thing will you, or anybody, do with this 5.8 announcement?
> Perhaps you should look at the announcement. Of course webauthin is in the browsers.
Yes. You sound really confused right now. Perhaps you should take a step back and check your notes.
> So my point stands
I don't think it does. It's quite obvious your claim about webauthm contrasts with reality. If you take the offer to check your notes, you can start here.
https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...
But something tells me no evidence in the world will sway your beliefs.
What does the word “pin” mean in this sentence? Looks like a typo.
It was misleading by me also. As mentioned, terrible work day yesterday, so I was writing angrily. Ironic that I accuse the security people of being bad at explaining, then turn around and explain stuff badly myself...
Ill TRY to make it up by explaining it as i understand this.
This is not adding the pin functionality, I was just focusing on the flow that happens when you get the Fido2 challenge flow on a webpage. That functionality is already there. Thee new thing is the 5.8 ads support for a second roundtrip/flow for signing stuff in browsers.
Right now, a YubiKey does only one thing in browser: signing a "login challenge string" from the webpage (FIDO2 flow). This is just slightly simplified: (random number + domain + some other shit). Fingerprint that string and return that cryptographically signed result to the site, as proof that "Only I could have signed this login challenge."
Right now, that's the only supported back-and-forth flow for signing anything with a YubiKey vs. a browser.
The new thing is that YubiKey wants a second flow, where the browser sends a request to sign any arbitrary text. So the page contains a contract, converts that to a fingerprint, the browser sends the fingerprint to YubiKey, YubiKey cryptographically signs this, and you can post the resultant string anywhere (public key cryptography magic), and that proves that the person holds that hardware key signed that exact input string (the contract).
So if/when Chrome, Safari, Firefox, and more accept this standard, you could click a button below a contract on a webpage, and the back-and-forth dance with the YubiKey would result in a string below that contract being cryptographic proof that the exact contract above is signed by the person holding one specific key.
Notice the lack of any AI-related shit in this functionality, yet the article reads 5.8 is a revolution for security in "the AI era"
It means entering a personal identification number (PIN) as an authentication step.
I believe in, and am a big proponent of physical 2FA being widely adopted -- though I own a half-dozen YubyKeys, I do wonder what their profit margins are. They feel a lot more expensive than they should be.
They used to be so cheap that WIRED offered them as signup freebies. I wonder what happened.
True, I got one from ARS. Still my favorite one
They are pretty expensive .I think of the production is around 10-15 bucks, so a pretty nice margin
> though I own a half-dozen YubyKeys, I do wonder what their profit margins are.
I hope they are huge while the products stay affordable. A cursory check suggests even yubico's product line are on the market for around $30/key. This is hardly expensive.
They always neglect to mention that you can't (unless something changed recently) upgrade the firmware. It's carefully crouched in wording, but to read the site you'd say "Oh, so I just upgrade". No, you buy a new version of the device. And hopefully it's not like the last vulnerability when at least for a while they kept selling the vulnerable devices to deplete their stock unless you knew enough to ask for one specifically with the new firmware.
https://utcc.utoronto.ca/~cks/space/blog/sysadmin/YubikeyMos...
You know, I owned several revisions of Yubikeys, and I eagerly set them up on every site that would support them. Sadly, unfortunately, they were "not compatible enough" and in fact, it seemed that sites weren't interested in adding or even maintaining existing support, and they fell out of favor with many of us.
I really tried! I even went through extraordinary measures to set them up nicely on Ubuntu and Fedora Linux systems! I had ssh keys with mandatory Yubikey auth! It was nearly cybersecurity heaven!
I eventually de-registered them everywhere possible, and I got rid of them entirely. In fact I purchased a couple Google Titan keys, and even before registering them, I simply returned them unused.
The most secure auth I use now is Microsoft Authenticator, and Google Authenticator for the TOTP stuff. I really don't mind.
My general impression is that Yubikeys are "too secure" for consumers to be using. TPTB do not like Yubikeys because of their intrinsically hardened security. TPTB would rather that consumers use security that has some NOBUS breakability in it. I really don't mind, okay?
> New Era
But no PQC?
[dead]