FIDO 2.0 - Revision history

Tom: /* References */

2024-04-27T23:39:02Z

‎References

Tom: /* Privacy */

2024-04-27T23:38:39Z

‎Privacy

Tom: /* Amusing */

2023-12-15T01:12:16Z

‎Amusing

Tom: /* Amusing */

2023-12-15T01:11:43Z

‎Amusing

Tom: /* Amusing */

2023-10-10T19:05:13Z

‎Amusing

Tom: /* Amusing */

2023-10-10T18:58:38Z

‎Amusing

Tom: /* Amusing */

2023-10-10T18:56:09Z

‎Amusing

Tom: /* Privacy */

2023-10-10T18:53:21Z

‎Privacy

Tom: /* References */

2023-10-10T02:19:07Z

‎References

Tom: /* Context */

2023-10-10T02:16:12Z

‎Context

← Older revision		Revision as of 23:39, 27 April 2024
Line 42:		Line 42:
	[[Category: Attestation]]		[[Category: Attestation]]
	[[Category: Authentication]]		[[Category: Authentication]]
		+	[[Category: Factor]]

← Older revision		Revision as of 23:38, 27 April 2024
Line 10:		Line 10:

	The FIDO protocols are designed to protect user privacy and do not provide information that can be used by different online services to collaborate and track a user across the services 123. Biometric information, if used, never leaves the user’s device 23. Therefore, it is not possible to track someone with FIDO Fast ID Online.		The FIDO protocols are designed to protect user privacy and do not provide information that can be used by different online services to collaborate and track a user across the services 123. Biometric information, if used, never leaves the user’s device 23. Therefore, it is not possible to track someone with FIDO Fast ID Online.
		+	==Problems==
		+	===Man in the Middle Attack===
		+	[1]: https://security.stackexchange.com/questions/206543/how-do-fido-keys-prevent-mitm-reflection-attacks ""
		+	[2]: https://www.yubico.com/resources/glossary/man-in-the-middle/ ""
		+	[3]: https://link.springer.com/chapter/10.1007/978-3-031-25467-3_5 ""
		+	[4]: https://www.yubico.com/blog/creating-unphishable-security-key/ ""
		+
		+	* FIDO keys, which are commonly used for two-factor authentication, employ a challenge-response mechanism to enhance security. However, it's essential to understand that FIDO keys primarily protect the integrity of messages from the authenticator to the server. Here are some key points regarding FIDO's protection against man-in-the-middle (MitM) attacks:
		+	Challenge-Response Mechanism: FIDO keys generate a one-time key using Diffie-Hellman or similar techniques. This ensures that each authentication attempt involves a unique challenge and response, making it difficult for an attacker to intercept and reuse the same response.
		+	TLS Encryption: While FIDO keys play a crucial role in authentication, they do not handle secure connections directly. Instead, they rely on the underlying transport layer security (TLS) provided by the browser. If the user's connection is not encrypted (i.e., not using TLS), the security provided by FIDO keys is compromised. Therefore, FIDO keys work best when combined with a secure TLS connection.
		+	Origin Binding: FIDO keys are bound to the origin (i.e., the website domain) where they were registered. This means that even if an attacker intercepts the communication, they cannot reuse the authentication response on a different site. The origin binding prevents MitM attackers from impersonating the user on unrelated domains.
		+	Token Binding (Optional): Some FIDO implementations support token binding, which further secures the connection between the browser and the service. Token binding ensures that the authentication token cannot be easily intercepted and reused by an attacker.
		+	Browser Security Context: Browsers expose the FIDO API only in secure contexts (i.e., over HTTPS). This helps prevent malicious scripts or extensions from accessing the FIDO API and interfering with the authentication process.
		+
		+	In summary, FIDO keys provide robust protection against MitM attacks when used in conjunction with secure TLS connections and proper origin binding. However, users should always ensure that their browser environment is secure and trust the TLS encryption to prevent any potential vulnerabilities¹[1] ²[2].
		+
		+	Source: Conversation with Bing, 4/27/2024
		+	(1) man in the middle - How do FIDO keys prevent MITM reflection attacks .... https://security.stackexchange.com/questions/206543/how-do-fido-keys-prevent-mitm-reflection-attacks.
		+	(2) What is a Man-in-the-Middle (MiTM) Attack? \| Yubico. https://www.yubico.com/resources/glossary/man-in-the-middle/.
		+	(3) Protecting FIDO Extensions Against Man-in-the-Middle Attacks. https://link.springer.com/chapter/10.1007/978-3-031-25467-3_5.
		+	(4) Creating the Unphishable Security Key - Yubico. https://www.yubico.com/blog/creating-unphishable-security-key/.

	==Amusing==		==Amusing==

@@ Line 14: / Line 14: @@
 Fido ID is a unique identification number assigned to pets to help locate them in case they get lost. It is not designed to track humans, but is does track where that human's pet goes. There are lots of other devices such as GPS trackers that can be used to track humans and pets alike.<ref>HID Global, ''RFID FAQ'' https://www.hidglobal.com/rfid-faq</ref>
-* [https://authenticatecon.com/introducing-the-authenticate-virtual-summit-series/ Interesting set of pod cases from FIDO.]
+* [https://authenticatecon.com/introducing-the-authenticate-virtual-summit-series/ Interesting set of pod casts from FIDO.]
 ==References==

@@ Line 13: / Line 13: @@
 ==Amusing==
 Fido ID is a unique identification number assigned to pets to help locate them in case they get lost. It is not designed to track humans, but is does track where that human's pet goes. There are lots of other devices such as GPS trackers that can be used to track humans and pets alike.<ref>HID Global, ''RFID FAQ'' https://www.hidglobal.com/rfid-faq</ref>
 ==References==

@@ Line 12: / Line 12: @@
 ==Amusing==
-Fido ID is a unique identification number assigned to pets to help locate them in case they get lost. It is not designed to track humans, but is does track where that human's pet goes. There are lots of other devices such as GPS trackers that can be used to track humans and pets alike.<ref>HID Gobal, ''RFID FAQ'' https://www.hidglobal.com/rfid-faq</ref>
+Fido ID is a unique identification number assigned to pets to help locate them in case they get lost. It is not designed to track humans, but is does track where that human's pet goes. There are lots of other devices such as GPS trackers that can be used to track humans and pets alike.<ref>HID Global, ''RFID FAQ'' https://www.hidglobal.com/rfid-faq</ref>
 ==References==

← Older revision		Revision as of 18:53, 10 October 2023
Line 10:		Line 10:

	The FIDO protocols are designed to protect user privacy and do not provide information that can be used by different online services to collaborate and track a user across the services 123. Biometric information, if used, never leaves the user’s device 23. Therefore, it is not possible to track someone with FIDO Fast ID Online.		The FIDO protocols are designed to protect user privacy and do not provide information that can be used by different online services to collaborate and track a user across the services 123. Biometric information, if used, never leaves the user’s device 23. Therefore, it is not possible to track someone with FIDO Fast ID Online.
		+
		+	==Amusing==
		+	Fido ID is a unique identification number assigned to pets to help locate them in case they get lost. It is not designed to track humans, but is does track where that human's pet goes. However, there are other devices such as GPS trackers that can be used to track humans and pets alike.

	==References==		==References==

← Older revision		Revision as of 02:19, 10 October 2023
Line 15:		Line 15:
	[[Category: Standard]]		[[Category: Standard]]
	[[Category: Attestation]]		[[Category: Attestation]]
		+	[[Category: Authentication]]

@@ Line 6: / Line 6: @@
 * Replacement for [[FIDO U2F]] and [[FIDO UAF]] of version 1.0.
 * One reason to like FIDO is that there are many different authentication methods that you can do. There are keys like YubiKey and Solokey and there is also Windows Hello where you can just type in a PIN.  Quote from [https://authenticatecon.com/authenticate-2021-day-three-recap/ Authenticate 2021]
 ==References==