Authentication

• Identity: unique characteristics of an individual.
• Authentication: who is this ?
• Authorization: what are they allowed to do ?


• Non-repudiation: can it be proved/audited that a person did an action ?
• Privacy: who can see what this person does ?
• Security: are these answers/attributes maintained over time ?

• Local: local user to local machine or application.
  
  
• Client to Application Server: local user/app to an application/web server.
  
  
• Application Server to Authentication/Authorization Server: back-end server-to-server communication.
  
  
• Single Sign-On: local user/app to authentication/authorization server to multiple application/web servers.
  
  

• Normal login (maybe password, maybe with 2FA)
  
  
• Password reset
  
  
• Account recovery
  
  

• Persuading Customer Support (social engineering)
  
  
• Phishing (to get credentials)
  
  
• Denial of service (report account as violating TOS, trigger "suspended because too many bad login attempts", flood account with messages or comments or confirmations)
  
  
• Impersonation (look-alike account or domain)
  
  
• Cause misuse (get user to click on a link that does something in the account, provoke user into violating TOS, get user to join group that gets banned)
  
  

1. Unique (not used anywhere else, doesn't appear in any breaches).
2. Long (at least 16 chars, probably).
3. Complex (not just lowercase and numbers).

• Unique username for each site (not just the same email address everywhere).
• Two-factor authentication (on important accounts).

• If the service has a data breach.
• If you realize the password is weaker than it should be for that kind of account.
• If you realize you've used the same password on other sites.
• If you've shared the credentials with someone else or some other service, and want to stop their access.

• Avoids forgetting passwords and other info.
  
  
• Avoids writing down passwords on Post-It's and other insecure places.
  
  
• Makes it easy to use a different password for every web site.
  
  
• Makes it easy to use long random passwords.
  
  
• Makes it easy to use two-factor authentication such as software-TOTP.
  
  
• Makes it easy to see/report duplicate passwords.
  
  
• Makes it easy to see/report accounts that don't use 2FA.
  
  
• Makes it easy to look at list of accounts and delete ones you don't want any more.
  
  
• Makes it easy to group and share info across multiple family members.
  
  
• Some will check for your info appearing in data breach lists.
  
  
• Great place to store other important info such as photo of passport ID page, info for reporting lost credit card, etc.
  
  

• Single point of risk for ALL your information. If the database is stolen and cracked, you're in big trouble.
  
  
• Single point of failure for ALL your information. If you lose the database or forget the master password, you're in big trouble.
  
  
• Making it too automatic maybe is a bad idea. If someone can sit down at your computer, open a web page, and your password manager immediately logs them in, that's bad. If malware on one page can open another page, and your password manager immediately logs it in, that's bad.
  
  
• A password manager may be too complicated for some people. But some password managers are pretty simple. And it's not clear that any other safe method would work for such people unless they have very few accounts. And if they use paper, are they going to back it up, and protect it from being stolen or copied ?
  
  
• One major risk: if you store your bank login info in a password manager, and it gets hacked, and the thief empties your bank account, neither the password manager company nor (maybe) your bank will compensate you. Both will deny any liability, according to their terms of service. Your money will be gone.
  
  

# Use KeePassXC to create a test database version 3.1.

# Submit database file to  https://hashes.com/en/johntheripper/keepass2john
# or:

sudo snap install john-the-ripper
john-the-ripper.keepass2john test.kdbx >hash.txt

# Paste hash into https://crackstation.net/
# Didn't work !!! unrecognized hash

john-the-ripper --help

# Create a hash:  https://md5calc.com/hash/sha256/1234
# Paste into https://crackstation.net/

• Vault: store passwords.
• Generator: generate passwords based on a master password.

• Built into browser.
• Separate application that does paste or auto-type to browser.
• Separate application that uses a browser extension.

• Local-machine-only.
• Synced to a cloud account.
• Synced peer-to-peer.

• Price.
• Type:
  • Online: your passwords are stored online, which is bad (have to trust that place; what if they go bankrupt) and good (accessible from any device; backed up). Usually there will be a synchronized local copy of your password database, too.
  • Local application: your passwords are stored only on your device. You have to do backups.
  • Feature of a security suite: same as local application.
  • Browser feature: first implementations of this had some holes/bugs, no way to sync across different brands of browsers, maybe no way to sync across multiple devices.
  • Browser add-on, or bookmarklet (JavaScript): maybe same issues as browser-feature type.
• Devices supported (PC, smartphone, tablet, etc).
• OS's supported.
• Browsers supported (almost all managers use a related add-on in your browser).
• Syncing devices to each other.
• Cloud backup.
• Handles application passwords.
• Supports two-factor authentication to web sites.
• Handles credit card info.
• Handles bank account info.
• Supports fingerprint (biometric) or 2FA to open the password manager itself.
• Miscellaneous: form-filling, import from other managers, automatic login capture, profile info, notes, credit report monitoring, data breach monitoring, etc.

• Remember all your passwords ? There are too many to remember, and will encourage using short simple passwords.
  
  
• Use a paper notebook ? Vulnerable to physical theft, inconvenient to backup, inconvenient to search, doesn't have features such as TOTP, and will encourage using short simple passwords because of all the typing.
  
  
• Use browser's password manager ? Level of security is unclear, doesn't work for other browsers and applications (except on Android), probably can't store other data such as pictures of ID cards or 2FA cards.
  
  
• Use browser extension from external password manager ? Extensions are sort of inherently unsafe (compromise browser's sandbox), and I don't want a live connection between my entire password database and a networked app (browser) that is running tons of untrusted code (JavaScript).
  
  
• Copy passwords from external password manager to browser ? Now your passwords are visible (briefly) in the clipboard.
  
  

keepassxc-cli open PATHOFDATABASEFILE
# now in interactive mode
db-info
ls
ls GROUPNAME
search ENTRYPATTERN
show ENTRYPATH
close
quit

flatpak run --command=keepassxc-cli org.keepassxc.KeePassXC open /home/user1/myinfo.nocloudbackup/KeePassDatabase.kdbx
search reddit          # case-insensitive
show /Bill/Reddit      # use backslashes to escape any spaces in path
clip -a username /Bill/Reddit 45  # copy username to clipboard, clear after 45 secs
clip -t /Bill/Reddit 45           # copy TOTP to clipboard, clear after 45 secs
close
quit

• SMS can be subverted, via fooling the phone service provider into porting the phone number (SIM-swapping) or otherwise redirecting the messages (e.g. Sakari).
  
  
• There is a difference between using SMS for 2FA and using SMS for account recovery or password reset. When used in 2FA, attacker has to have password as well as subverting the SMS. For account recovery or password reset, maybe attacker only needs to subvert the SMS.
  
  
• Using SMS for 2FA is better than having no 2FA at all, even if it's possible (not easy) to subvert the SMS.
  
  
• Using SMS as the sole means of account recovery or password reset is a bad idea. Better to use security questions and (made-up) answers, or recovery codes, or some other mechanism.
  
  

man pcscd
man pcsc-tools
pcsc_scan
sudo systemctl status pcscd --full --lines 1000

opensc-tool --	list-readers
man card_eventmgr

man pam-pkcs11
# add pam_pkcs11.so to cat /etc/pam.d/login ?

p11tool --list-tokens
p11-kit list-modules

sudo gpg --card-status
sudo gpg --edit-card
man scdaemon

• One or more of USB, NFC, Bluetooth.
• Do crypto interaction with computer/phone.
• User has to type a PIN into the computer/phone, or type a PIN on a keypad on the key, or just tap a single button on the key.
• Contains a password manager, and appears as a keyboard to the computer to type usernames and passwords.
• Can do OATH TOTP (time-based ?).
• Can do HOTP (counter-based).
• Supports SSH authentication.
• Supports OpenPGP.
• Provides general-purpose encrypted storage (USB drive).

• YubiKey
  
  Very large, confusing product line.
  Costs $40 or $50 per key.
  
  Models:

  • YubiKey 4 Family: newest, multiple form factors to choose from, all support U2F, OTP, Smart Card, PGP, etc, all support up to a 4096 bit key length, no NFC.
    
    
  • YubiKey NEO: only keychain form factor, all support U2F, OTP, Smart Card, PGP, etc, only up to a 2048 bit key length, support NFC. Yubico NEO-n: no longer sold.
    
    
  • Yubico Security Key: only keychain form factor, only supports U2F, but cheapest YubiKey.
    
    

  sn-Fifteen's "What the heck is a Yubikey and why did I buy one?"
  Yubico's "Compare Products"
  Naomi Brockwell video
  
  [From /u/SoCleanSoFresh on reddit.]

  
  My questions:

  [I'm a Windows 10 Home user, a normal home PC user.]
  
  

  • How do I recover from a lost YubiKey ?
    
    Easiest way is to have a second YubiKey. But it has to be registered to all the same accounts and logins as the first key. No way to just clone a YubiKey, or declare two YubiKeys to always have equal credentials.
    
    If you don't have a second YubiKey, you'll have to exercise whatever "account recovery" options there are for all of your accounts, one at a time. There are no "emergency codes" or "recovery codes" you can save and use to generate a new YubiKey that is equal to the lost one, or bypass the requirement to have your YubiKey. But many accounts will use your email and/or phone as primary means of recovery, and if those are locked by the lost YubiKey, you're stuck.
    
    
  • Can a YubiKey be required for my PC's system/BIOS login ?
    
    But this wouldn't really protect my information on disk, if that disk is unencrypted. A thief could just take out the disk and attach it to another PC to get access to the data.
    
    Answer seems to be no, unless you install some custom boot-loader.
    
    
  • A YubiKey can be required for my Windows 10 user login, in addition to the password.
    
    But this wouldn't really protect my information on disk, if that disk is unencrypted. A thief could just take out the disk and attach it to another PC to get access to the data.
    
    Would the Yubikey protect upon login when waking up from sleep or hibernation, or only upon initial user login ?
    
    
  • Can a YubiKey be required for my Android phone's system login ? I have a Samsung Galaxy S4 I9505 (does have NFC) running LineageOS 14.
    
    
  • Can a YubiKey be required to mount a hardware-encrypted WD Passport Ultra external hard disk onto my computer ?
    
    Answer seems to be no.
    
    
  • Can a YubiKey be required to mount a software-encrypted container (using VeraCrypt or LUKS or Bitlocker, for example) onto my computer ?
    
    Answer seems to be yes for LUKS: "man systemd-cryptenroll".
    
    

  
  Windows:

  Apparently there are two ways to use YubiKey with Windows login:
  
  

  • If you use YubiKey for Windows Hello app, the YubiKey enables login without entering the Windows user password: article2.
    Does not operate with system/BIOS login, only Windows user login.
    Works with a local Windows account or a cloud account.
    Uses CCID mode on the YubiKey.
    
    
    
  • If you use YubiKey with Yubico's Windows Logon app, the user must have both the password and the YubiKey to login: article3.
    Does not operate with system/BIOS login, only Windows user login ?
    Works with a local Windows account only.
    Uses challenge-response using HMAC-SHA1 mode on the YubiKey.
    
    
    

  
  Willi Mutschler's "Security steps with Yubikey" (Linux)
  Cal Bryant's "How to get the best out of your Yubikey with GPG" (mostly Linux-only)
  drduh's "Guide to using YubiKey as a SmartCard for GPG and SSH" (mostly Linux-only)
  Hugo Barrera's "Using a Yubikey for GPG"
  Vivek Gite's "How to install YubiKey Manager GUI on Linux"
  Veres and Wellbrock's "How to use a YubiKey with Fedora Linux"
  kmille's "How to Yubikey: a configuration cheatsheet"
  
  
  
  
• Feitian.
  
  Chinese company.
  
  
  
• Solo (formerly U2F Zero)
  
  solokeys / solo1
  Kim Schulz's "Using SoloKey for Linux Login"
  Kim Schulz's "Password-less linux login with SoloKeys"
  /r/Solokeys
  
  Open-source. And can buy a developer version "Solo Hacker".
  
  No button or keypad on the key; have to type a PIN into the computer/phone when you use the key. [But now there are multiple models, some support tap ?]
  
  
  
• OnlyKey
  
  Open-source.
  Does FIDO/U2F 2FA, is a password manager (24 accounts), and does TOTP.
  Can do encrypted backup of its internal password manager database.
  Self-destruct feature.
  
  
  
• Nitrokey
  
  Nitrokey Start is open-source; Nitrokey Pro is not fully open-source.
  USB-only.
  Does FIDO/U2F 2FA, is a password manager (16 accounts), and does TOTP.
  Provides general-purpose encrypted storage.
  
  
  
• Thetis
  
  USB-only.
  
  
  
• Google Titan
  
  USB/NFC/Bluetooth.
  U2F only.
  article1, article2, article3
  
  
  

• Hardware device that connects to computer via USB or NFC or something, and talks crypto through client to a server (U2F, or FIDO2-WebAuthn-CTAP2).
  
  
• Hardware device that connects to computer via USB or NFC or something, and talks crypto to the client (HMAC-SHA1 challenge/response). Smart card ?
  
  
• Software app on protected device (such as smartphone) that uses Bluetooth to connect to computer, and talks crypto through client to a server (FIDO2-WebAuthn-CTAP2). Dan Goodin's "How Apple, Google, and Microsoft will kill passwords and phishing in one stroke"
  
  
• Software app that uses network as a back-channel to communicate between devices. WebAuthn-enabled, such as Windows Hello, Apple's Face ID/Touch ID, and Chrome WebAuthn ? Camera-and-QR-code such as desktop WhatsApp login ?
  
  
• Hardware device that gives you a time-limited number (OATH TOTP) or counter-based number (HOTP) to type in.
  
  
• Software app that gives you a time-limited number (OATH TOTP) to type in.
  
  
• Site uses custom app on your phone to send you a time-limited code to type in.
  
  
• Site uses email or WhatsApp to send you a time-limited code to type in or a link to click on.
  Dmitry Frank's "Treating Email More Like a Password Manager"
  
  
• Site uses SMS or voice call to your phone to send you a time-limited code to type in or a link to click on.
  
  
• "Remember this device" via browser cookie.
  
  
• No 2FA: just username and password to type in.
  
  
• No 2FA: just username and password to type in, and username is your email address.
  
  

I like passwords. They're standard strings, cross-platform, easy to back up. Unlike a hardware device, they're free, and you can make N backup copies. They don't depend on having phone service or internet access or access to a server; I can store them in a local-only password manager. No central server can see all the places I log in to.

Use a password manager and create good passwords. And set the password manager to paste creds only into the proper domain, to resist phishing.

No, I think passwordless and hardware tokens and SMS are bad ideas. Give me passwords and software TOTP 2FA.

• Your phone loses service (no SMS, no voice calls).
• You lose your device.
• You lose your device while traveling, and the backup device is at home.
• The device is stolen.
• The device dies or is destroyed.
• The device battery runs out.
• You have to change your phone number.
• You have to reinstall the security application (which may change the security ID).
• You want to log in through some other computer (if using the no-phone option).
• The security app vendor (such as Google) disables your account.
• The security app vendor goes out of business.

I do everything (creds, TOTP, recovery codes, etc) inside KeePassXC.

It's not a "something you own" second-factor, but still it's better than no-2FA:

• It adds a time-based component to the login info going over the wire.
• I hope sites are storing the TOTP secrets separately from the password hashes (that would be best practice, wouldn't it ?).
• Might reduce the harm of someone shoulder-surfing as I use my password manager.
• Makes phishing harder (phisher has to write more code, account for more cases).
• Slows down login a bit, making me less likely to get phished (I have time to think twice).
• Makes the site less likely to fire off fraud triggers due to me using a VPN and Firefox and Linux and script-blockers etc.

• Store acctname/URL/username/password in one password manager database (the EVERYDAY database),
  
  
• Store OATH TOTP secrets in a hardware token that can generate OATH TOTP codes, and
  
  
• Store all of that info plus recovery codes and security questions etc in a second password manager database (the MASTER database) that is kept very secure and closed and offline.

• Store everything (MASTER database), with standardized columns/formats for TOTP secret codes, security questions and answers, recovery codes, maybe hardware token IDs or something.
  
  
• One-button operation to export all of the entry names (e.g. "Joe's PayPal acct") and associated TOTP secrets to a hardware token.
  
  
• One-button operation to strip out columns or export a stripped (EVERYDAY) copy of the database (strip out TOTP secrets and recovery codes and security questions/answers etc).

• Email accounts.
• Domain/DNS account (especially if email goes through DNS MX record).
• Financial accounts: bank, credit card, PayPal, money-transfer, crypto-currency, Privacy.com, etc.
• Any item-purchasing accounts that are auto-connected to your bank account or credit card: Amazon or other retail, gaming, phone apps with in-app purchasing.
• Cloud accounts (Apple, Google, Microsoft) that could be used to remote-disable or remote-wipe your devices.
• Any account you'd really hate to lose, such as a social media account where you've built up a huge following, or a domain-registar account, or web-site-hosting account, or source-control account.
• Password manager (mainly, if cloud).

• Maybe login doesn't work if you don't have cell service.
• If you lose your authentication device or it dies or it runs out of battery charge, now you can't access email etc through your computer too. Unless and until you have some emergency method, and it's close to hand.
• If you take your laptop somewhere, you have to take your 2FA device or phone with you too.
• Some carriers charge for SMS messages.
• Login is slower.
• Some forms of 2FA damage your privacy/anonymity, by tying account to a phone number.
• There may be a charge for the authentication device or service.
• If the authentication device plugs into a USB port, some places (internet cafe, library, etc) may not allow that.

• Don't care about the account; fast login more important than security.
• Only form of 2FA supported would damage your privacy/anonymity, by tying account to a phone number.
• Only form of 2FA supported requires something you don't have, such as phone or token.
• Need to have multiple people access one account, and the supported form of 2FA doesn't support that.

• If you have an account at the site involved, and the SMS is for password-reset, it means someone has your username (maybe email address) or phone number, that's all. Those essentially are public information.
  
  
• If you have an account using two-factor authentication at the site involved, and the SMS is to confirm account login (asking for the second factor), it means someone has your username or phone number AND PASSWORD, that's bad. Go to the site or app (not through the message) and change your password.
  
  
• If you don't have an account at the site involved, it means someone has your username (maybe email address) or phone number, and is trying to create an account using them. Not much you can do. Blocking the number the SMS comes from may block other sites too.
  
  

• Use already-authenticated account to authenticate for new account. E.g. send link to email.
  
  
• User sees biometric, but behind the scenes a password is being sent. E.g. Apple's Face/Touch ID gating a stored password.
  
  
• Locally authenticate (with PIN or biometric) to a smartcard or token, which then uses crypto keys to authenticate to the service. E.g. smartcard-based authentication or FIDO2-based authentication.
  
  

Already-authenticated "Passwordless" login

Site A uses your email account E as a method of authentication. So you have no password for your account on site A. It just knows your email address.

You go to site A and enter your email address. It says "we'll send you an email containing a link; click on the link to log in". You go to your email account E, get the email, click on the link. Either your existing page on site A says "okay, logged in", or the link causes a new page to open on site A that says "okay, logged in".

Advantages: No need for a password on site A, so fewer passwords and 2FA methods. Email accounts usually offer good security such as 2FA, so pretty secure.

Disadvantages: Slower login (email transit time), with more clicks. If someone gets into your email account, they get access to every other site that uses it for login. Internet and email service are points of failure.