Collaborate Disseminate
Microsoft Windows 10 does support physical security keys since some time.
Google recently announced that Android phones can be used as security keys as well (primarily for their own services).
Is there a way that these two … Continue reading Can an Android Phone be used as a Windows Hello Security Key?
I understand how FIDO works with yubikey: Yubikey device has a symmetric key and it uses appId, nonce and symmetric key to generate key pair for a website. And the device gives back public key and keyHandle (which can used to… Continue reading FIDO U2F – MacOS TouchBar
Every time we sign up at a new website, we have to come up with a unique password. But let’s face it: You probably don’t use more than three unique passwords across the web, you forget to change them regularly and you sign up with the same email addre… Continue reading Considering a World Without Passwords
I would like to use hardware security keys in an environment where it is additionally needed to lock down any ways in which a user could download data to a device like a usb key. Is it possible to lock down a usb slot in a wa… Continue reading Hardware security key with locked down usb slots
The FIDO foundation provides with metadata web service for UAF (MDS 1.0, https://mds.fidoalliance.org/) and a new web services for FIDO2 / WebAuthn metadata (MDS 2.0, see https://fidoalliance.org/metadata/).
Metadata of some… Continue reading FIDO2: will FIDO foundation MDS 1.0 metadata statements be migrated to MDS 2.0?
Here’s the latest Naked Security podcast – enjoy! Continue reading Ep. 028 – SPEWS, Android security and scary Facebook messages [PODCAST]
FIDO keys, used for 2 factor authentication are based on a challenge-response mechanism.
Besides generating a common 1-time-key using diffie-hellman, or transferring all data over TLS, how can they prevent reflection attacks… Continue reading How do FIDO keys prevent MITM reflection attacks?
I’m looking for some Android apps that can store / read TOTP codes off of a Feitian ePass FIDO key using NFC. There appears to be a fairly simple way with a yubico key / and key but I don’t know how to do this with a Feitian… Continue reading Storing TOTP codes on a Feiteian ePass FIDO key
As authentication factors, I know the following
You are (e.g. Biometrics)
You have (e.g. USB)
You know (e.g. Password)
If I use a FIDO2 certified fingerprint reader for password-less authentication with user verification … Continue reading Does FIDO2 token works as two-factor on password-less authentication?
Looking at the online resources regarding WebAuthn, I still haven’t been able to figure out which of the involved components (or parties) that store the link between the user and his/her authenticator device.
I borrowed this… Continue reading Which party stores the link between user and device in WebAuthn?