wubalubadubdub
play

wubalubadubdub 1 Yuriy Ackermann Yuriy Ackermann Sr. - PowerPoint PPT Presentation

Nov 08, 2023 •138 likes •574 views

Universal Second Factor authentication or why 2FA today is wubalubadubdub 1 Yuriy Ackermann Yuriy Ackermann Sr. Certification Engineer Sr. Certification Engineer @FIDOAlliance @FIDOAlliance twitter/github: @herrjemand twitter/github:

  1. Universal Second Factor authentication or why 2FA today is wubalubadubdub 1

  2. Yuriy Ackermann Yuriy Ackermann Sr. Certification Engineer Sr. Certification Engineer @FIDOAlliance @FIDOAlliance twitter/github: @herrjemand twitter/github: @herrjemand 2

  3. 3

  4. Today we will learn Today we will learn Why passwords not enough Why 2FA has not succeeded Introduction to U2F DEMO Q&A 4

  5. Why not just passwords? Typical passwords life cycle Weak Reuse Phishing pwned haveibeenpwned.com SOLUTION! SOLUTION! Two Factor Authentication - aka 2FA Two Factor Authentication - aka 2FA 5

  6. What is 2FA? Passwords verify verify 2FA authenticate authenticate 6

  7. Do you use 2FA? 7

  8. What does 2FA looks like? Three main types Apps Tokens SMS (TOTP and HOTP) (PKI and OTP) 8

  9. So we solved it? Right? 9

  10. Why 2FA has not succeeded? Apps Tokens SMS Phishing!! Cost Still phishable UX DRIVERS UX Shared key Phishing Privacy Synced time UX Security Centralised SIM reissue Fragile SIM spoof Coverage NIST Ban 10

  11. 11

  12. 12

  13. Current state of 2FA Current state of 2FA I am in the deep pain, I am in the deep pain, please help! please help! 13

  14. So how do we solve it? We need: Easy to use Open Secure Standardized protocol. 14

  15. Introducing Universal Second Factor aka FIDO U2F 15

  16. How does U2F works? 16

  17. User layer User layer 17

  18. Browser layer 18

  19. Protocol Layer 19

  20. Step one: Challenge-Response Challenge-Response 20

  21. Step two: Phishing protection Phishing protection 21

  22. Step three: Application-specific key-pair Application-specific key-pair Relying Party 22

  23. To Wrap, or not to Wrap? 23

  24. Step four: Replay Attack Protection Replay Attack Protection 24

  25. Step five: Device attestation Device attestation 25

  26. Metadata service Metadata service 26

  27. Step five and a half: Key exercise protection Key exercise protection User must confirm their decision to perform 2FA, by performing user gesture e.g. e.g. Pressing button Fingerprint Retina scan Pincode Solving Rubikscube Remembering your wife's birthday. ...anything you want. 27

  28. Multiple identifiers GMail GMail Web Android iOS mail.google.com apk-key- com.google.SecurityKe hash:FD18FA y.dogfood How do we deal with it? How do we deal with it? 28

  29. Application Facets { "trustedFacets": [{ "version": { "major": 1, "minor" : 0 }, "ids": [ "https://accounts.google.com", "https://myaccount.google.com", "https://security.google.com", "android:apk-key-hash:FD18FA800DD00C0D9D7724328B6D...", "android:apk-key-hash:/Rj6gA3QDA2ddyQyi21JXly6gw9D...", "ios:bundle-id:com.google.SecurityKey.dogfood" ] }] } MUST MUST be served over VALID VALID HTTPS! ...no self signed certs. ...no self signed certs. 29

  30. Implementations 30

  31. 31

  32. Current users dongleauth.info dongleauth.info 32

  33. Browser support Yes Yes* No* (Nightly Nightly) (Soon... Soon...) Yes Maybe? 33

  34. WebAuthN A W3C standard for PublicKey credential authentication https://www.w3.org/Webauthn/ 34

  35. Today we learned Today we learned Passwords are hard 2FA is wubalubadubdub, and we need to do something about it. FIDO U2F is sweet. Protocol is cute ​ You can have multiple identities There are existing solutions... ...and people do use it 35

  36. DEMO 36

  37. Security Security considerations considerations You must use HTTPS You must use HTTPS Start using TLS Channel ID's U2F is just 2FA. Don't use as primary factor. 37

  38. Things to play with Things to play with https://github.com/Yubico/pam-u2f https://github.com/Yubico/python-u2flib-server https://github.com/Yubico/python-u2flib-host https://github.com/herrjemand/flask-fido-u2f https://github.com/gavinwahl/django-u2f https://github.com/google/u2f-ref-code https://github.com/conorpp/u2f-zero Specs and data Specs and data https://developers.yubico.com/U2F/ https://fidoalliance.org/specifications/download/ https://github.com/LedgerHQ <- JavaCard FIDO Dev (fido-dev) mailing list 38

  39. What's next? WE NEED 39

  40. Questions? Questions? twitter/github: @herrjemand twitter/github: @herrjemand 40

  41. Quick thanks to Quick thanks to Feitian and Yubico Feitian and Yubico for swag! for swag! 41

  42. Thank you Thank you OWASP! OWASP! 42

Recommend

More recommend