Breaking FIDO: Are Exploits in There?

on YouTube ↗38m

" summary

FIDO U2F uses per-site public/private key pairs generated by the authenticator, transports over USB NFC Bluetooth, and requires a signed, origin-bound signature plus a user-presence touch to defeat phishing. Chrome is the reference client; token binding / Channel ID ties assertions to the client so stolen assertions can’t be replayed from another device. Authenticators may use ECC P-256 keys and increment a global counter to detect cloned keys; client compromise and recovery/backup flows remain the hardest risks to solve.

AI-written summary · about

" chapters (8)

1. 0:00Intro
2. 1:45FIDO Authentication Protocol
3. 6:57Registration
4. 12:57Challenge Parameter (c)
5. 15:47Phishing Protection
6. 19:08Channel ID (Token Binding)
7. 25:50Device Cloning
8. 29:27Authentication Alternatives?

" related talks

• 30mHow FIDO U2F Security Keys WorkJen Tong · DevOpsDays Seattle 2018
• 33mSimple. Open. Mobile: A Look at the Future of Strong AuthenticationJerrod Chong · BSidesSF 2018
• 02h 22mFIDO 101David Turner, Paul Heim, Christina Hulka · Authenticate 2022
• 32mSecuring Online Identities with Simple, Secure, Open StandardsStina Ehrensvard · BSidesSF 2019
• 56mPasskeys 101: Technical Principles of FIDODavid Turner · Authenticate 2024
• 29mWebAuthn and security keys - unlocking the key to authenticationChristiaan Brand · PasswordsCon 2018 Stockholm
• 33mNavigating Passwordless Authentication with FIDO2 & WebAuthnJerrod Chong · BSidesSF 2019
• 47mWhy FIDO Security Keys & Webauthn are AwesomeJen Tong · NDC Oslo 2019