Recent searches

No recent searches

Search options

Only available when logged in.
shakedown.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A community for live music fans with roots in the jam scene. Shakedown Social is run by a team of volunteers (led by @clifff and @sethadam1) and funded by donations.

Administered by:

Server stats:

254
active users

shakedown.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.3

#securitykeys

0 posts0 participants0 posts today
Royce Williams<p>Well, that's something you don't see every day - a still-panelized set of 16 security keys!</p><p>I'm told these were part of Google's Titan / Gnubby development process. (Artemis was a daughter of Leto, who was a Titan -- get it?)</p><p>I assume they don't have firmware on them yet, but it might be tricky to find out non-invasively.</p><p><a href="https://infosec.exchange/tags/SecurityKeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecurityKeys</span></a> <a href="https://infosec.exchange/tags/Gnubby" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Gnubby</span></a></p>
Royce Williams<p>Security key that's new to me: Thetis Nano-C!</p><p><a href="https://thetis.io/products/thetis-nano-c-fido2-security-key-device-passkey-usb-c" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">thetis.io/products/thetis-nano</span><span class="invisible">-c-fido2-security-key-device-passkey-usb-c</span></a></p><p>Also news to me, I'm clearly behind: FIDO2 has levels:</p><p><a href="https://fidoalliance.org/certification/authenticator-certification-levels/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">fidoalliance.org/certification</span><span class="invisible">/authenticator-certification-levels/</span></a> </p><p>This key is FIDO2 L1, and different applications may require different levels. Notably here, L1 is the minimum to get any certification at all, and you can't get L2 unless you have an actual secure hardware element. So with the device at this level, you get the independence of a separate physical object with a dramatically simpler software surface, but I suspect it might be easier to get secrets right off the key with physical possession.</p><p>(Note that this is an organic post, not sponsored in any way. Happened upon it in an eBay listing. I never do solicited or compensated endorsements)</p><p><a href="https://infosec.exchange/tags/SecurityKeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecurityKeys</span></a></p>
Royce Williams<p>GoDaddy makes you pick which security key you want to be prompted for by default, and only allows this key to be presented unless you follow the "try another way" workflow.</p><p>What is the purpose / threat model of this? It seems unnecessarily high friction to me, and as far as I know is not done by any other platform.</p><p><a href="https://infosec.exchange/tags/SecurityKeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecurityKeys</span></a></p>
Royce Williams<p>Since the last time I logged in fresh, Google has moved "2-step only" (non-passkey) security keys to be the <em>first</em> factor prompted for.</p><p>Only after a good key is presented is the user prompted for their password.</p><p>You are then prompted to create a passkey "instead", with a "Not now" option.</p><p><a href="https://infosec.exchange/tags/SecurityKeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecurityKeys</span></a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MFA</span></a></p>
Royce Williams<p>TIL Proton dropped their maximum supported security keys (some time after mid-August 2024) from 8 to 4 keys?! (Notice the tiny "8 out of 4" label, because I had registered the maximum 8 keys)</p><p>I suspect my current config will be stable until I need to explicitly delete a key, in which case I won't be able to add a replacement unless I delete <em>five</em> keys. 😡</p><p><a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MFA</span></a> <a href="https://infosec.exchange/tags/SecurityKeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecurityKeys</span></a> <a href="https://infosec.exchange/tags/FIDO2" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FIDO2</span></a> <a href="https://infosec.exchange/tags/Proton" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Proton</span></a></p>
Royce Williams<p>TIL the maximum number of security keys I can add to my Apple account is ... six. 😢 </p><p>Say it ain't so, <span class="h-card" translate="no"><a href="https://hachyderm.io/@rmondello" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>rmondello</span></a></span> !</p><p><a href="https://infosec.exchange/tags/SecurityKeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecurityKeys</span></a></p>
Royce Williams<p>It's been 12 days since I (and a few others) noticed ... and we're still unable to rename security keys within a Google Account.</p><p><a href="https://www.reddit.com/r/GoogleSupport/comments/1gahuqa/cannot_rename_fido2_security_key/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">reddit.com/r/GoogleSupport/com</span><span class="invisible">ments/1gahuqa/cannot_rename_fido2_security_key/</span></a></p><p>Renaming keys is essential, to keep them identified and disambiguated.</p><p><a href="https://infosec.exchange/tags/Google" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Google</span></a> <a href="https://infosec.exchange/tags/SecurityKeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecurityKeys</span></a> <a href="https://infosec.exchange/tags/FIDO2" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FIDO2</span></a></p>
Royce Williams<p>Well, that's the source of the key I found on eBay. How did I not hear about these new security keys sooner??</p><p><a href="https://mastodon.online/@9to5google/111415878503051725" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">mastodon.online/@9to5google/11</span><span class="invisible">1415878503051725</span></a></p><p>"Google’s new Titan Security Keys let you store passkeys"</p><p><a href="https://9to5google.com/2023/11/15/titan-security-key-passkey/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">9to5google.com/2023/11/15/tita</span><span class="invisible">n-security-key-passkey/</span></a></p><p>And the Google blog post says they hold up to 250 passkeys:</p><p><a href="https://blog.google/technology/safety-security/titan-security-key-google-store/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">blog.google/technology/safety-</span><span class="invisible">security/titan-security-key-google-store/</span></a></p><p><a href="https://infosec.exchange/tags/passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>passkeys</span></a> <a href="https://infosec.exchange/tags/securitykeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>securitykeys</span></a></p>
Tinned-Software<p>For decades, users have authenticated on systems with usernames and passwords. This method of authentication has not changed since the beginning of the Internet. As the Internet became a more hostile place and threats emerged,&nbsp;...</p><p><a href="https://blog.tinned-software.net/secure-authentication-and-how-it-changed-over-time/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">blog.tinned-software.net/secur</span><span class="invisible">e-authentication-and-how-it-changed-over-time/</span></a></p><p><a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://infosec.exchange/tags/securitykey" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>securitykey</span></a> <a href="https://infosec.exchange/tags/securitykeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>securitykeys</span></a> <a href="https://infosec.exchange/tags/fido" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>fido</span></a> <a href="https://infosec.exchange/tags/fido2" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>fido2</span></a> <a href="https://infosec.exchange/tags/totp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>totp</span></a> <a href="https://infosec.exchange/tags/passkey" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>passkey</span></a></p>
Royce Williams<p>This is great - Google providing 100,000 free security keys through 2023 to high-risk users. (Though I am still disappointed that - after all of the joint early work Google did with Yubico - they went with Feitian instead of Yubico to provide the raw hardware for the current Titan Security Key series.)</p><p><a href="https://blog.google/technology/safety-security/new-partnerships-and-100000-security-keys-to-protect-high-risk-individuals/" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">blog.google/technology/safety-</span><span class="invisible">security/new-partnerships-and-100000-security-keys-to-protect-high-risk-individuals/</span></a></p><p><a href="https://infosec.exchange/tags/securitykeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>securitykeys</span></a> <a href="https://infosec.exchange/tags/google" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>google</span></a> <a href="https://infosec.exchange/tags/yubico" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>yubico</span></a> <a href="https://infosec.exchange/tags/yubikey" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>yubikey</span></a></p>
Royce Williams<p>Hey, <span class="h-card"><a href="https://infosec.exchange/@rmondello" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>rmondello</span></a></span> - I'm seeing reports that the 16.3 beta is requiring at least two security keys [that you can have zero, or two, but not one]? Is that across the board, or is that only true in some circumstances?</p><p>Since Apple already has a pretty solid second-factor deployment, I would have expected this to be left to the user relative to their own threat model, sort of like how Google's Advanced Protection Program (which also requires two keys) is an opt-in option.</p><p>(And apologies if covered elsewhere - Mastodon search is what it is, and my Google fu must be weak today)</p><p><a href="https://infosec.exchange/tags/securitykeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>securitykeys</span></a> <a href="https://infosec.exchange/tags/yubikey" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>yubikey</span></a></p>
TrendingLive feeds
About