Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2679 Thanks!
[Music]
so our next speaker wants to make
passwords
redundant and will tell us a little bit
about uh
PH2
so please
welcome Sai with PH2 the superior
multiactor authentication
[Applause]
framework did someone did someone boo
okay uh all right uh yeah I I want to
talk about pho but I will like use the
uh the word web of n or the name web of
n um probably even more I will explain
why in a second uh my name is Clan onai
I'm a software developer from
Germany I am a little interested in
security and devop stuff and automation
I have worked system administration
before all that new modern devop stuff
came up I do organize a Meetup about
this stuff also in southern Germany in K
and I am in like a little uh into milway
Oro so if I have screamed at you for
standing in the way in the kitchen I'm
very sorry all right so I have um put
together a small agenda for today I will
talk about what PH 2 or in specific web
offn is like explain how it works and um
why you want to use it and why you
probably should use it over the
Alternatives but I'm open for discussion
afterwards um how does it work and then
I will
talk specifically about Pas keys because
this is coming like a new hype I think
for security and it might be really cool
for a lot of people but it might
be slightly almost cool for some people
sitting in here um we'll see how that
goes so what is Pho and I think I wrote
something next to it actually oh yeah I
I copied the slide good job um so there
is two parts to pH and the most
interesting part is web offn which is a
w 3C standard and then there's the pho 2
which is actually a brand but most
people use those names like and swap it
out um pH 2 is a brand by the pho
Alliance and a lot of the big internet
companies like Amazon Google also one
password and a lot of security companies
um are part of the alliance and they set
the standard and work on stuff like web
offn um they're also pushing those most
of those are also the ones pushing for
pass Keys which is yeah it's okay I
guess and I think the the internet
overall is going to profit a lot from
this in a sec from a security
perspective um and yeah I'll go to this
a little later I will show you just for
a second how this works webn
so I have when I prepared this I have
found a a a website this one is I think
it's from Duo security if some of you
know this um it's webo .io but there's
multiple listed on the F Alliance and
the webn um Pages you can Google those
this one here I found very good to get a
general understanding how this works
because it just you can just play around
with it uh let's say I will register a
new account here um and let's say this
is called s uh CCC camp and then there's
a couple of settings in it um I'll just
I forgot to turn this no wrong one I
just forgot to turn this one off for now
but we'll get to it later um so you
Press Register you can create a pass key
and this is like a spoiler because Tas
key is basically a wrapper around webo n
um and I can and you can choose like a
security key this device so this is a
MacBook standard MacBook nothing fancy
security key would be like something
like a Ubbi key I'm using a Nitro key
here um yubik is like I think the most
well-known producer and a big part of
the phor lines also um probably all of
you have seen Ubbi keys at work Nitro
key is a company from Germany uh which
does a lot of Open Source work I just
want to give them a little shout out
they sponsored a Nitro key for me um but
like it's up to you it's the same thing
it's a USB key that you can put to your
keychain and uh Carri it around next to
you and hopefully not next to your
laptop in your bag all right let's lose
lose and use a security key and now I
have to touch it and something went
wrong oh that's that's
cute
whoops yeah probably time out so you
have a couple of seconds to use the the
UB key or Pho Nitro key whatever key and
so now the server has like um I'll
explain a little later but what we have
act essentially done is we have created
a public key or private public key pair
and we have sent the public key of this
to the server um and now when I go to
web Au .io and I will do this in a
private
tab just to make sure the sessions don't
interfere it should work out of the box
and we said size CCC camp and now I can
authenticate oh that's
good oh one more
why yeah good good catch thank you all
right so authenticate now this thing the
site knows that I have set a pass key
for this username so it quot it queres
me to to use my pass key um so I I I use
the security key there's multiple uh
additional versions I touch the key and
now it says I'm logged in and then it
shows the credentials that I have here
there is like this is just an ID uh if
you want you can take note of this and
you cannot hack my web authentic IO
account later with it um doesn't matter
anyway because they will delete the
account tomorrow all right but you get a
lot of like webo .io webo and. guide I
think is the the big one from the pH
Alliance they have a lot of um resources
if you want to to learn more and
in-depth stuff about this all right so
basically this was like already an
example where you don't use a password
so this is basically you give them your
username they know who you are they can
map your pup key that you have save
there while uh registrating uh
registering um and then you can
authenticate with it later multiple
times obviously every time you want to
log in all
right uh yes okay
so what is it actually and this is from
the definition of web offn the web offn
framework it says this is a better
alternative for securing your sensitive
information online and the webn works
for uh like for an alternative uh
authentication factor in addition to
your password but it also works without
and it will still be multiactor
authentication if you don't use a
password and I will show you in a second
how that works or why this
works so there's a kind of factors that
you can use for multifactor
authentication some of these might be
the alternative to webn so there like on
the left side I put is on the left yeah
on the left side I put a lot of a lot of
keys there's multiple brands in addition
to UB ke and Nitro key there's also
Titan key I think Google uses this or it
used to do and they have some blogs on
how to implement this um
and I I did some screenshots from chrome
just because it's like the most I'm no
advertising okay um so you can use a
password to log in as a kind of a factor
but this is here um basically the the
two Google Chrome screenshots are doing
the same um they use your local device
in this regard my laptop to log you in
so you don't necessarily have to have a
UB key you can also uh save the keypad
that you're using for logging in with
webo n to your device it might be your
cell phone might be your laptop and
therefore you have the the the um you
just need any kind of authenticator that
is um certified and the keys are one way
and your laptop and your
modernday um cell phone are the other
way and they use the TPM chip on the
cell phone or like the security chip
Hardware um on the cell phone or your
computer to generate the keys the UB key
has the hardware on uh like in inside
builtin um you can also use as as a
measure of of another factor to log in
something like biometric um I I don't
know if there is Iris scan available for
for modern day laptops or or computers
but I get we'll I guess we'll go there
at some point um you can use Windows
hello and then basically do either
password or face or thumb or whatever
you have um in the end it all boils down
to everything you use without the UB key
is the device and you have to unlock it
so it doesn't matter if you have the
password or the biometric you know like
you can use Touch ID on your phone but
you can always always just not use Touch
ID and put in the um just the password
to unlock it and um once you log in um
your device will quy you for whatever
credential you want to use and this is
already one of the backsides of or the
downsides of using a non extra security
token and just your device because you
might also save your credentials like
your username and password on the same
device that you now are saving or using
to authenticate so if someone knows your
device password they can just and and
has your device obviously so this is
like the two things that you need and
therefore it's multifactor
authentication um you need the device
and the password and then you can like
unlock the authentication no matter if
it's password or pass key
or uh Pass key or or web and S second to
password and
whatnot um and this is already one of
the downsides because if you lose your
phone and you have like um saved all
your credentials into your phone and use
it as a factor it's all in the same
device um it might not be a problem for
people sitting here but just take a look
at your co-workers when they unlock
their phones like don't shoulder surve
but just how they do it a lot of people
will use gesture wiping swiping on their
phones which is very insecure has been
shown to be very insecure um a lot of
people will use like PIN codes like 1 2
3 4 5 or up to six whatever your
Enterprise has set even in the worst
case scenario um this is everything you
you need once you have set a pass key or
weath and credential on there someone
just needs the phone and if it's badly
secured you're still
screwed and yes it's the same when you
put the Ubbi key next to the laptop or
the phone obviously like at some point
just imagine you are some it Department
most of you are admins or some of you
are admins you have users you know every
step you do to make them the more secure
they will find a way
to you know [ __ ] you over
all right okay webn um webn is a
specification that defines an API
enabling the creation and use of strong
attested scope public key based
credentials of you you don't have to to
like I'll get into some single point of
this this is just from the spec um so
basically um there's a strong public key
based credential that you are generating
yeah it has like for example the current
UB key does uh I I think it should mean
ecdsa and
ed25519 stuff like elliptic curves
modern cryptography um if you have an
old UB key you should not use it but
then again if you use it you're still
better off than not using any second
Factor at all obviously um The Fighter
two spec has like a minimum security
level that you have to use and you can
if you are administering the server that
does the authentication you can set the
Min level so there is kind of a if your
if your server does not like support
EDSA or I think it should be ecdsa I
don't know um but like if you don't
support it and the user has no other has
no other means they can just not
register a web both and
key um it the the credentials should be
attested for this means in webos and
speech or and and w3c speech that the
key requires POS session of an
authenticator so basically you need to
have a device which is either a security
token or a phone or a modern laptop um
and it also verifies it so basically one
is to register one is to authenticate so
the server sees you have the the pup key
so it assumes you own and have the
laptop in hand um it has to be somewhat
Hardware based um and then it's scoped
and this is really
interesting a key hair is generated per
website so this means if you log in and
and create a or register a web Au and
key set for
Google your laptop will not or your
device will not reuse it for let's say
Amazon okay um this is pretty cool
because while your private key will
never leave your device and this is the
2019 before we were talking pass Keys um
your private key will never leave the
device you only handing out pass keys
and this is actually cool from a privacy
side but also because when someone finds
your pass key and a your pup key sorry
in a leaked uh server database um they
have no idea if you used it to go and
and and re reuse it somewhere else
because you can't by the spec um and but
this also means that um as a server
administrator if you are offering web o
n or PH2 as a administrator you just get
people's pop keys so you don't have to
care like top secret for them like you
would have to with passwords and hash
them because you need like the the plane
key because it's only generated for your
device people can like attackers cannot
use this pup key to lock into anything
else if your customers have their pup
key stolen from
you all right installation we already
done because all modern browsers and
systems as or like uh it has a footnote
most modern browsers and uh systems
already implemented the webo end
standard is supported by almost every
browser that there
is Firefox actually does it but not to
the full PH2 extent specification okay
there is still some trouble with I I
don't use Firefox so I I was had a hard
time finding combinations that would
work and not I think the problem is that
you cannot use currently I think it's uh
what you cannot use is security
tokens with pass keys in combination
with Firefox on mobile or something like
that so they are working on it um I
think uh I saw the I think it's
somewhere in the next two three versions
Firefox will also add the full feature
set um all the others should do it it
comes with a flavor Chromebase browsers
just do it I uh I what what's it called
safari like uh webkit Macos browsers or
apple browsers they have like a they
used in in 2019 when web offn was
released people were really happy for
Apple because they were one of the first
to actually support this and now if you
want now they they are going Full Pass
key mode now you have to enable iCloud
password sync if you want to use the
webo end feature there's a hand oh it's
the I'm sorry never mind I should not
have reacted to hands and stuff my bad
all right um where was
I oh yeah okay it's it's supported by
most browsers or people are doing it
Safari for Safari you need to enable
Cloud sync and that's four pass keys but
the main Fe one of the main features of
of web o n was that they advertised it
that the credentials never use never
uh never go out of your machine so now
they like completely turned around and
said pass Keys basically the credentials
do move out of your machine so now you
have to think about which one is better
actually all right so talking
multifactor authentication um there's a
couple of Alternatives um most of you
will know the Google Authenticator all
the Microsoft authenticator things where
you have a time based code usually six
digits long that you can generate for a
website and it will recycle every I
don't know 30 seconds or so and uh you
have to do to input this after your
password obviously if you send a string
to a server someone can intercept it or
uh can like fish you because in the same
way with a password they just have to
like use it quicker than your password
your password doesn't expire the top
tokens expire after 30 seconds it's
still fishable um what's also a a
currently being rolled out by by most
companies is that you have an app on
your phone and when you log in on some
device you get a notification on the app
you have to click yes this was me I just
tried to log into google.com or so so if
you get fished so you go to a fake
website and accidentally because you
think it's the real Google you enter
your credentials there your username and
your password how does it help that you
have a cell phone when they just like
proxy it to
Google you just logged in so obviously
you're waiting for for a notification to
happen on your phone obviously you will
click yes this was me even though the
actual uh authentication comes from
Google and not from the fishing s so
yeah great stuff uh looks like this I
managed to uh input German screenshots
I'm very sorry like just imagine you get
you you are prompted to enter a
six-digit code into a fake website um
and the server bot because it has to be
very quickly just uses it instantly to
send it to Google or to Microsoft but
with a Time slice of like 30 seconds
left you can actually copy it by hand so
and you can then after logging and even
reuse the top code to add a new
authenticator um that's not like main of
the talk here we can talk about this
later uh top is not fishing proof so how
does webn work communication wise how
how where I'm talking a lot about key
keys and pup keys and servers and
whatnot but how does it actually work so
pho2 combines two Frameworks or two
protocols protocol like things I don't
know the the real correct word for this
um so webo n is the communication that
happens between your
browser and the backend server that
you're authenticating to it's also
called a relying party um in in web both
n and this as I said it's implemented by
most browsers by now um and then you
have the cab client to authenticator
protocol this is basically how your
browser is allowed to talk through your
Hardware with your security or with your
operating system that acts as the
authenticator and this is like in mod
all modern systems can do this
already so let's imagine you want to
register new keys and it doesn't matter
if it's passwordless or as a second
Factor after the password so basically
you as a client with your key
authenticator thing you go to the server
and and you're like hey I want to
register a new Pass Key my name is Chris
if you have already have a user account
you already logged in the server knows
this server wants a pass key um you
generate Keys locally you save the
private key locally obviously because in
private public key you need the private
key um for for your for signing messages
um and you give the pup key to the
server who saves it with your name on it
so next time you to tell the server that
you are Chris you can
then sign a message that the server
sends you when you authenticate and the
server can then verify because they have
your PB key that you have signed this
message with your private key so this is
like pgp Basics right um or
gpg
so I want to talk about a couple of
options so this what up to now this is
just like the most basic workflow they
have maybe you have seen this picture
around the internet for quite some
time and that's what I was talking about
somebody some administrators in the past
added uh token based authentication or
multiactor
authentication um to their servers so
their admins would have to use another
device to generate a password or a
short-term password that they used to
log in and then there's people who just
hang this up with camera in front on the
internet um so they don't have to be in
touch with the device which is like it
totally defeats the purpose right um and
if you're using security tokens or um
stuff like the device as an
authenticator there's multiple uh
options that you can set as a relying
party or authenticating server to force
people or to force your client to use a
certain settings you know like
especially for security Keys you usually
have a a button or like even a
fingerprint reader that is locally saved
to the key or kind of some something you
have to press
and um it's not like connected to your
computer you have to physically press it
so this is like the the most um basic
one you can uh set verification to
discourage so it's just if I want to use
the UB key to sign in I must press the
button but as a server administrator you
can also side uh uh you can also decide
that the security token has to be
secured with a pin code that the the
user has to enter so it's even more
factors basically like I think the most
like if you if you play it like all the
way around you can go username password
you have to have the UB key you have to
press it so you're physically there then
you have a prompt on your computer that
prompts you to enter the PIN for the UB
key the server doesn't know that this is
a local setting okay um and if you set
this to required which you shouldn't in
my my opinion um there is two
possibilities either either the user can
enter the key and if they can't like if
they don't know it but also obviously if
they can't uh from a technical
standpoint because their system doesn't
allow it for it they would just you
can't you can't log in okay and then
there's something in between is
preferred where you as a user it should
it should read user can decide so when I
set up my UB key I can I can with the
man managing software from the vendor I
can decide to have a pin code on my UB
key or not okay and the server will
respect this if it's set to
Preferred okay um then there's a very
controversial and I I I won't go through
all the settings okay this is like the
second of two configuration items that I
find particularly interesting um and
this one is rather controversial um
there is the option to set a
discoverable it's like the name in in
the spec or non-discoverable
credential um and then there's again
three part three ways um like the server
can decide just don't do it dear client
then they can say prefer then the client
can decide but this is like not
something you as a user choose but this
is like the OS setup chooses and it will
use the discoverable one and I talk
about what it is in a second or you can
require it as a server site type and uh
yeah the per uh the the default is
preferred right now I think it's a bad
idea I'll come to it in a second so
discoverable credential means there is
actually a fresh
key um created for this website as I
said before as was was part of the web
both and
standard um like this is all the same it
can include a
username so this means I go to Google
they don't support it but let's just
imagine I go to a server where I want to
authenticate I just like put my UB key
or my natural key or my whatever key um
in in my laptop and press the button and
I have never entered the username it's
basically like it's okay for certain
scenarios like imagine somebody like I
I'm I work in retail let's just say a
cashier wants to log into the uh cashbox
it's okay that they just put the U key
or the Nitro key or whatever key inside
the machine press the button and they
know this is user 1 2 3 4 and they have
the password they don't need the
password it's it's completely cool um
and this makes a username less login
possible it has downsides because I have
like I don't know five Google accounts
how would Google know which one I want
you know but since the the username is
included in the key I can just send them
the the I can sign their message they
can just cross reference it with their
pup key setup um and at some point they
will find a an account that matches this
that can like verify this this sign
message so it must be me the problem is
that you can't decide on a UB key or
natural key which uh key to use like you
can't have it's impossible to have three
keys for different Google accounts if
you don't add
usernames all right um and the other
problem is that security Keys especially
which are really cool and I would really
love to use one on everything they can
only hold X Keys like the top Nitro key
currently can can save up to 25
discoverable keys and this is like the
preferred setup I don't know if you have
a password manager my password manager
has like over 500 passwords if I were to
to to do pass keys on all of those and
replace all of those I would need 20 UB
keys if they all used like discoverable
credentials okay even though if even if
they don't use username l login that
would cost me like a [ __ ] lot of money
and and my my uh my key would not look
like this but more like this okay uh
Nitro key has 50 Keys there's other
brands that do more your laptop can hold
basically an infinite number okay um so
you don't have the problem with with
laptop then or phone and then there's
the non-discoverable credential and in
my opinion if you don't need the
username less login please use this so
if you're an administrator set the
discoverable credential setting to
discouraged um what's going to happen is
the security tokens like the USB keys
but also your TPM chip and stuff they
have a master password or master key and
this is basic public key cryptography we
have a master key and then you get a
seed like a nons or string from the
server when you are creating and and
registering a key set and from this
master key you create another key set
because the cool thing is like okay uh
you can later recreate it you don't have
to save this key set um so basically
this is how it happens I I go to the
server I'm like hey I'm Chris or I am
actually like Chris's operating system
um so and the server is like um okay
cool use please use this nons and I have
actually like when I was looking over
the slides earlier I'm not sure
currently if this is 16 or 64 bits but
yeah bear with me it's a string um so
then I generate from my master key a new
key
set and then I send the pp key of this
new key set to the server and I use the
the combination of the master key and
the nons for this and um the server will
send the pass uh the pup key but will
also I will save it but will also save
the nons um so when I authenticate
actually or use it as a second factor I
come back to the server I must say I am
Chris because the server has no way to
decide this otherwise um so the server
has to send me my
nons and a message to sign I forgot this
sorry um and then I can generate the
keys from the nons on the Fly while
authenticating and then I can use the
regenerated private key to sign the
message and send it to the server and
from there on the server can really
decide if I have saved the Pub Key
before the private key before um or if I
have recreated it and the server doesn't
care because they say like from a server
standpoint if I have the master key and
it is branded into the hardware it
doesn't it doesn't matter if if you have
created a new key or not
okay um yeah and then the server can
verify that it's indeed you all right so
quick wrap up um fishing is to my
knowledge impossible because um
your client will save the um the actual
or will use the the actual like URL end
point to create the keys so if you have
a key that you're you registered with
google.com and someone tries to fish you
with fake
google.com you won't have a key for fake
google.com even if they manage to Pur at
you on a fishing site to create a key
for fake
google.com you can never use it to log
into actual you google.com there's no
way the only way would be if there's a
problem with https or TLS because this
relies on service certification and
stuff okay but even if you proxy the
traffic there's no way that you can you
can you might have if you proxy the
traffic now that won't work because you
have a different address if you man in
the middle the traffic obviously this
doesn't help because you still get the
authentication or the what's it called
session token or stuff like that but for
there's no way that someone that can uh
convince me on a fake s to insert my
credentials that I all that they can use
like the um my keys the convenience is
pretty high I think especially if you
use like only your computer for not so
secure accounts like imagine um with the
Alternatives like you log in on your
desktop you put in your username you put
in your password and then you get
prompted for a key you fumble in your
back for your phone you put up you have
to start your authenticator app you
watch through your scroll through your I
don't know 200 Top token settings you
get the key you have to type it in oh
[ __ ] the time slice is up you have to
get another one um yeah I think it's
it's much easier especially if you stuff
if you use stuff like face ID or touch
ID to just like tap the touch scanner
once or if you have face ID to just have
your the camera scan your face once um
and this is really bad of me because it
should say the server only knows the
public key right I'm really whoops that
would be
fun all right okay um all right let's
say the server only knows the the public
key okay um so there's no way if they
have the public key they have no way of
telling who if it's you an attacker that
can extract the public key they can't do
a [ __ ] without with it no way contra
if you use secure tokens you might have
to spend a couple Euros on them so I
think the cheapest ones are like
105 um that that fit the standard um if
you like let's say if you want different
devices like use desktop for logging in
and phone for the authentication device
you can use this uh through scanning QR
codes on the phone from your uh on the
desktop from your phone and stuff you
need to like let let's say from let's
say you're an Enterprise or a small
company you have to give like everyone
an extra UB key or an extra phone so
that they can log in on the desktop if
you don't want to have it on the same
device or so so there might be extra
costs um the key might be saved to the
same device as the login you know so if
someone takes as I said takes the phone
you week authentication they have both
the login if you save it to the device
and also the uh Pass key or uh webo and
key
and yeah the uh if you use pass keys I
skip that um your keys will get sync to
the cloud I'll get to this um
so
now most big companies are um pushing
for pass Keys Apple does it Google does
it uh I think Amazon does it too um one
password does it you should get rid of
the their their ad is like you should
get rid of passwords at all because it's
it's hard to remember passwords use
secure unique password you'll know it
people could use password managers but
it might be easier to just uh use like
your fingerprint on your phone and I
think it's a totally valid thing for
probably 99% of Internet
users the other thing that they say is
it will work on all devices and there my
doubts start a little because basically
pass Keys is just web outn with a little
extras or a multi device for both n as
I've read somewhere um what is happening
actually is if you set a new Pass key on
your device it will get sync to the
cloud so let's say I'm using a Mac I'm
using an iPhone I create a pass key to
lock into google.com on my Mac Safari it
gets the private Keys get synced to
Apple Cloud iCloud and then SED onto my
watch onto my uh my phone my iPhone um
and then I can log log in from all these
systems that's pretty cool
because I can now log in from my phone I
don't have to remember the password
let's say I generate a very good
password on my computer on my desktop
this is really cool I can copy paste it
and
then type it on my iPhone for an hour if
it's like 30 characters long so now the
key that doesn't even know needed a pass
key is just sync to my iPhone that's
pretty cool the problem is in my opin
opinion that iCloud if you turn on
password sync
one they know your passwords so if
you're using multi Factor authentication
Pass Key like password and key as the
second one they now you give them both
it's not worse than before because
before you had modfactor out they knew
both too or the both as the one password
but I think don't get me wrong this
should be this should make life easier
logging in sec really easier for a very
large proportion of Internet users but
there is some maybe even company policy
that will stop you from sying uh
password stuff and this includes pass
Keys into the cloud okay so uh and now
is the problem that you can if you're a
safari user I said it before this kills
web offn for Safari because they force
you to put on to to enable Cloud sync
and it use it webn worked perfectly on
Safari but now they just killed the
feature basically if you don't want to
sync um yeah so relatively high security
level it's probably stuff like your
mother in law whatever would should use
instead of typing the same three digigit
or six-digit password on on every shop
they use um it prevents fishing as I
said before it's unfishable um you don't
have to remember complex passwords
actually because the general idea behind
pass Keys is not as a multifactor like
second Factor next to password but just
to replace password
the downside is especially smartphones
have no good protection okay and the
problem is with all the syncing
tools they you have no way to choose
which passwords to sync so maybe you are
cool with like having your I don't
know your Tinder password synced to
iCloud but not your bank account
password right there's no way to
distinguish either you sync all or sync
none um and there's another one um you
have people have like server admins or
or companies have to give you some kind
of reset code because if you lose the
device or for whatever reason all your
devices that are syn I mean yeah if if
you have multiple okay um yeah it's
really bad you need some kind of backup
password now you have backup passwords
for every password that you were trying
to
replace I don't know that's like in my
head this is kind of like going back to
the start um it's vendor locked in you
cannot if you use Chrome password
manager or one password or whatever
other password on your one device you
cannot sync it to your other device that
uses iCloud or something like that you
have to use all Google account or all
Apple account or all onep account I said
earlier there's no selective sync
um password and syn and key if you have
passwords are sync to the same Cloud
device I just forgot one I got into my
head
um oh yeah there's like a point they say
you don't have to remember any password
but then again it's all tied to your
Apple account where you need a password
or to your Google account where you need
a password so at some point yes it's
easier because you don't have to
remember 100 passwords or your password
manager doesn't have to contain 500
passwords you just need
one and I don't know like I've seen
people losing their password manager or
Google password or so and then you have
like backup keys how do what do you do
with backup keys do you print them out
and put them in your in your storage or
somewhere do you put them do you write
them down in some file next to like post
it onto your computer or so no idea so I
would just want to wrap it up again one
once more and then you're free to leave
um or ask or discuss um the web both and
and secure token is in my opinion like
UB key on your keychain is in my opinion
the most secure or most possibly
achievable secure combination and then
you can if you want you can add [ __ ] on
top like from a server admin perspective
yeah put top on top of it if you're onun
like I don't know nuclear stuff um I'm
not in that business but like I would
love to see people use AU key because
that's something you don't I don't know
has any who of you has lost their keys
before like physical key okay sorry yeah
you need you yeah if you use UB keys or
Nitro keys or stuff it's it's a little
piece of Hardware it probably costs them
to produce like I don't know one EUR or
so probably less you buy it in twos
would be my my recommendation okay or
use like an old phone or something like
as backup um
there's a high convenience level when
using biometric without the security
token you don't have to search for your
keys that might be like downstairs in
your house when you're or upstairs in
your house when you're working from the
back from the uh seller um you can you
can drive the decision um as a server
administrator like what kind of options
you set obviously so if it's a bank
account you probably want higher level
security than on your Twitter account it
might differ for people so it depends on
your attack or threat
scenario do I have one more oh yeah that
that's the last one thanks for joining
ah if you have thank you we will have a
Q&A yeah sure if you have questions
please line up with the microphone
please don't cross the camera in
front
he hi thanks for the red talk it's a
very cool topic and I think we will see
it a lot in corporate development yeah
uh but let's say we don't want to use
these Cloud features due to the vendor
lockin and how could we do that so I'm
thinking like using the UB key has some
restrictions with a limited number of
slots for example so why can't we put
the private key in our password managers
and have the password manager act as the
U key like virtually you could then back
this up through one drive or whatever
other it re means and it's it's actually
people are working on that like this is
one of the big things that one password
is doing um or that that they're
advertising for that you can like then
uh store the the or use it as as a web
authenticator next to your or like as an
alternative to your device um then again
you have the same problem again there's
one company that has all your stuff and
like stuff like one password does I
think they do cloud-based only currently
but yeah yeah there might be I don't I'm
not aware but it should be possible like
to have a another open password manager
that you care for it yourself I think
bit Warden is working on it and this is
very likely to be seen in a at least
companies that people around here work
for more than one password yeah it
should be should be
possible um so my question is uh quite
similar um does web o and require you to
use Hardware tokens is this part of the
standard because if it's not like
there's great open source password
managers if they adapt to the standard
you can do all your great um crypto
security stuff and I have no vendor lock
in and still use webo and because I
think webo and is great I just want to
use the the tokens yeah I'm not sure
actually what the the aspired spec is in
the end I'm very sure that most at least
most companies that are part of the phto
alliance which is the major driver of
this let's say would have a hard time of
you using open source you know like it's
not in their interest to do this but if
there's like one password for example is
is part and they have this exact problem
um it might be possible that you would
need the Hardware security chip on your
device to create the keys and but then
save them to your password manager I
don't yeah I don't know why it should
not work but I'm like I I don't know
actually
sorry uh yeah thank you for the talk um
to the best of your knowledge how secure
are the UB themselves uh like several
months ago we had the entire story with
Ledger where it was like oh we can
actually totally export your key
material from it I think there was in in
UB before uh up to a certain serial
number or or certain level uh version
they had a problem where theoretically
people were able to recreate the master
key due to some faulty
implementation but
I'm like I have no idea about crypto at
all you know like when I Was preparing
the talk I learned that you call that
string to verify from the server and ons
so my my crypto level is very very basic
I think
generally I would imagine if a company
like
Google which is known to have very
little breaches I think uh that I know
of uh uses uh security tokens they will
have this thing covered I'm very sure
that they have thoroughly tested all
these things but yeah it's it's
just if there's no flaw that people know
about doesn't mean it doesn't exist do
do you know which brand
does uh the question was because he has
no mic uh which brand Google uses a
couple years ago I think it was 2017 is
uh Google came out with a um a set of
blog posts um that they were using Titan
keys and they have it's just another it
might the chips come probably out of the
same Factory in China somewhere um but
like they using Titan keys I don't know
how it is yet or now um and they also
had like a an advertising thing where
they enabled you to buy a set of Titan
keys that do Bluetooth and NFC and U USB
and whatnot okay so but generally I
don't I I don't want to advertise for
one brand I don't know um what I can
recommend when looking at at Keys like
security token Keys think about what
kind of adapter you are using most with
this key so if you use like I have a
MacBook Air some kind years old it has
only USBC ports my phone has USB C Port
only if I use a USB a
port uh
authenticator then I can show you it
looks like this all the time so you need
an additional adapter all the time and
then I would imagine you you run around
like uh with your keychain and the
adapter falls off and and stuff so think
about it first they they have it in in
several different uh specs they also you
can also use NFC just hang it to the
back of your phone that's pretty cool
but yeah in the end just I I can
recommend a brand actually thank you
s yeah if you
have