LemonLDAP::NG 2.21 is out!
This new release includes improvements on OpenID Connect and CAS protocols, Loki logger, public notifications and much more.
Read our release notes: https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2-21-0-is-out/
Recent searches
Search options
Administered by:
#fido2
1 post1 participant0 posts today
Continued thread
@keno3003 (2/2) Der einzige Schutz dagegen ist, wenn man physische #FIDO2-Tokens verwendet ("device-bound passkeys" nur in der "roaming-authenticator"-Variante!), die das Auslesen des Geheimnisses prinzipiell ausschließen. Dies ist also die einzige wirklich Phishing-resistente Authentifizierungsmethode.
IMO sollten also die Tipps am Ende vom Video *mit Fokus auf Sicherheit* anders lauten:
- am besten 2 #FIDO2 HW-Tokens besorgen und für alle #Passkeys verwenden (für #IDAustria Österreich: https://www.oesterreich.gv.at/dam/jcr:972a25a0-65e6-4c2e-9422-a2e02ce16f2d/20230613_ID-Austria_FIDO.pdf)
- keine phishing-gefährdeten Fall-Back-Mechanismen verwenden: also nur den 2. FIDO2-Token
- jede 2FA ist besser als keine
- niemals Passwörter in die Cloud schicken (Cloud-PW-Manager)
HTH 
I'd love if there was a website like https://www.passkeys.io/who-supports-passkeys which showed which websites also support *non-resident* #FIDO2 authentication as opposed to resident #Passkey. Let's reward sites that have that support!
www.passkeys.ioWebsites and Apps with Passkey SupportSee which websites and applications already support Passkeys as an authentication method or are currently working on integrations.
Replied in thread
@yacc143 FYI: #Passkeys and #FIDO2 (= "device-bound #passkey" which can be divided into "platform-" and "roaming-authenticators") are identical except the #cloud-sync mechanism (as of my current understanding).
So unfortunately, they get mixed up or are considered as totally different things. Both is wrong.
In reality, they are very similar except that FIDO2 hardware tokens ("device-bound passkeys" only in their "roaming-authenticator" variant) are designed that way, that Passkeys are not being able to extracted from the device (at least for the moment).
Therefore, users of HW tokens can't be tricked into transferring their passkey to a rogue third party, which is possible with all other Passkey variants. Therefore: passkeys are NOT #phishing-resistant in the general case.
#TroyHunt fell for a #phishing attack on his mailinglist members: https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/
Some of the ingredients: #Outlook and its habit of hiding important information from the user and missing #2FA which is phishing-resistant.
Use #FIDO2 with hardware tokens if possible (#Passkeys without FIDO2 HW tokens are NOT phishing-resistant due to the possibility of being able to trick users with credential transfers: https://arxiv.org/abs/2501.07380) and avoid Outlook (or #Microsoft) whenever possible.
Further learning: it could happen to the best of us! Don't be ashamed, try to minimize risks and be open about your mistakes.
Note: any 2FA is better than no 2FA at all.
Troy Hunt · A Sneaky Phish Just Grabbed my Mailchimp Mailing ListYou know when you're really jet lagged and really tired and the cogs in your head are just moving that little bit too slow? That's me right now, and the penny has just dropped that a Mailchimp phish has grabbed my credentials, logged into my account and exported the mailing
Replied in thread
@0xF21D Any more reason to switch to FIDO2 with hardware tokens or #Passkeys.
The latter only if you trust the service providers and if you don't need protection against phishing. With Passkeys and their optional delegation feature you can be tricked into transferring to a hacker. 
With a #FIDO2 hardware token, you're really safe.
Google Cloud (ex. Mandiant): https://cloud.google.com/blog/topics/threat-intelligence/session-stealing-browser-in-the-middle/
Mandiant details in this article Browser-in-the-Middle (BitM) attacks, a sophisticated session stealing technique that bypasses multi-factor authentication. Unlike traditional transparent proxies like Evilginx2 that require extensive customization, BitM offers attackers a streamlined approach to compromise web application sessions with minimal configuration. The article describes Mandiant's internal tool 'Delusion' for performing BitM attacks and demonstrates how attackers can steal authenticated sessions even when protected by MFA. The authors recommend implementing hardware-based MFA solutions like FIDO2 security keys and client certificates as effective countermeasures against these attacks.
Google Cloud BlogBitM Up! Session Stealing in Seconds Using the Browser-in-the-Middle Technique | Google Cloud BlogThe browser in the middle technique can enable compromises, especially if defenses and MFA aren't properly implemented.
To anyone who is familiar with #ios #iphone multi device management #mdm
Could one prepare a recent iPhone via MDM in a way that it can register a software #passkey either in the icloud keychain or preferrably in a #keepass DB via eg. KeePassium?
The iPhones, MDM and #FIDO2 RP would all be under our control.
Ist das jetzt schon Hoarding oder eine angemessene #Backup Strategie? Auf jeden Fall ein Haufen #fido2 #passkey Token
Mehr dazu in meinem Vortrag auf den CLT @clt_news https://chemnitzer.linux-tage.de/2025/de/programm/beitrag/188
Replied to David Nelson
@dmnelson I keep one in a fire-proof safe at home and one is on my keyring with the house keys, with quick-release. You could also keep one at the office and carry the other. That way it's fairly easy to register both keys for each new service. And wondering what the USB-thumb is - that's #Tails for emergency computing in strange places 
. #Yubikey #MFA #Fido2
People who use hardware security keys: Storing them in geographically diverse locations is a wise move but makes it impossible to quickly onboard. How do you keep track of where you’ve registered each key? A checklist in a spreadsheet is obvious but cumbersome. Is there a better way? (Yes I use passkeys extensively but for certain services like email, iCloud, and my password manager, a hardware option is desirable if not mandatory.) #YubiKey #YubiKeys #FIDO #FIDO2 #FIDOKey #FIDOKeys #Security
Replied in thread
@red_rooster
Du kannst auch einen FIDO2 Stick verwenden - wo das halt geht.
Auf den #clt werde ich einen Vortrag zu passwortlosen Logins mit #PassKey halten. Insbesondere zu den Gefahren des Lock Ins in eine Hersteller-Cloud, zu Hardware Tokens und natürlich zur #Kryptographie dahinter
https://chemnitzer.linux-tage.de/2025/de/programm/beitrag/188
chemnitzer.linux-tage.deChemnitzer Linux-Tage 2025 · Vortrag: Passwortlose Logins mit PassKeysDie Chemnitzer Linux-Tage sind eine Veranstaltung rund um das Thema Linux und Open Source für jedermann, die Linux-Nutzer, Insider und Unternehmen zusammenbringt.
Alles, was man wissen muss in vier Zeilen?
JemandSchnapptExistierendeTechnologieUndBrandetSie S8E23?
Was haben Mama und Papa dir über die Leute aus dem Marketing gesagt??? 
#passkey #FIDO2 #marketing
Replied in thread
Okay... ein besonderes Teil, möchte ich Euch auch noch anbieten, denn #nocciverkauftdinge
Heute kann ich Euch eine limitierte Edition des SoloKeys v2
NFC anbieten.
Limitiert, weil es sich um eine spezielle Produktion handelt, die Glitzer im Epoxy hat. (siehe Video) 
... und außerdem in einem gewagten Lila daher kommt.
#Glitzer Leute, Glitzer und Sicherheit für Euren Passwortsafe, Webanwendungen (Webauthn), Fido2 und so weiter... mit ein wenig Arbeit kann man sich sogar so an seinem Laptop anmelden (hatte ich mal)
Das Ding ist noch original verpackt und enthält neben dem USB Key, den man übrigens nie verkehrt einstecken kann (wow!), noch zwei Überzieher. 
Okay... der hat mich mal so knapp 60€ gekostet und wenn ich 45€ inkl. Versand (Ein Maxibrief als Einschreiben) bekommen kann, dann wäre ich mehr als Dankbar.
Gerne wieder 
Danke!
#solokey #fido2 #webauthn
00:05
Replied in thread
@g you know I just tried it and TL;DR my account is locked, the restore process doesn't work, can't get the chat AI to restore it either, have to wait for office hours to get a human to intervene xD
Setting up the passkey
I was using my Yubikey and it went without any issues. The onboarding process was smooth-ish.
Then, as expected was instructed to login again and I got disonnected.
Re-login process
The "use a passkey" prompt was covering my 1Password prompt in the username field, but ok. I don't imagine non technical people loving this...
Anyway, the passkey was accepted at this point but I still had to solve a puzzle to prove that I a human (isn't that the entire point with FIDO2? Especially with a physical key that also has a mandatory PIN)
BUT in spite of all this, the passkey was not actually enough to let me in. There was a full page message telling me to please scan the QR Code with my passkey device (lol that's a Yubikey) or get a link via email and, again, scan something with the same device (lol again)
Account recovery
No go.
Actually, it went smoothly: got the email that my passkey was disabled, got the email that my password was changed.
But I can't get in.
Sad.
This is the way I config PAM to authenticate with my USB keys in NetBSD.
I type a password to decrypt the disk, and that's it.
No passwords to log-in, unlock the screen or run doas. Only the key.
vsis.onlineAuthentication with U2F in NetBSD