With the introduction of iOS/iPadOS 16.3, we can now also use security keys to give our Apple IDs extra security protection. After writing my hands-on experience with passkeys, I started researching other technical details behind FIDO and the corresponding WebAuthn open source authentication services, so I’d like to take this opportunity to introduce what a security key is and how it differs from the passkeys we’ve introduced before.
Most security keys look like everyday USB flash drives from the outside, and all authentication information is stored directly on the security key. Unlike a USB flash drive, a security key can only write authentication information and no one or program can read data from the security key. Because of this write-only feature, security keys are often used for encryption, password substitution, or multi-factor authentication. A security key can host different encryption protocols at the same time, such as FIDO for pass-through keys, PGP for encrypting emails and files, OTP for one-time encryption, and U2F for universal two-step authentication.
FIDO2 aims to create passwordless login, while U2F aims to create a universal two-step authentication protocol, as well as PIV smart cards, etc.
Captcha, or more strictly speaking two-step authentication, sometimes called double authentication, can prevent someone from accessing your account even if they know your password.
You may think that since there are SMS verification codes, or in-app QR codes, or time-based one-time passwords. TOTP, which is a one-time password that changes over time, there seems to be no need to use a security key. SMS is now widely used as a dual authentication and even as the only credential for login in many services. However, as a protocol defined in 1986, SMS is now outdated and there have been many studies on the insecurity of SMS communication channels, and cases of telecom fraud using GSM hijacking and SMS sniffing abound. So while it is convenient, SMS is really not suitable as the primary (or even the only) means of dual authentication from a security perspective.
Many websites and services use time-based one-time passwords TOTP, which is indeed much more secure than SMS. First of all, compared to traditional static passwords, TOTP dynamically generated one-time passwords are more secure because they are only valid for a specific period of time and the generation process is based on a shared key and the same time, while the shared key will only be exchanged at the initial setup.
Secondly, the implementation of TOTP technology is very inexpensive because it does not require specialized hardware, and users only need to install a software that supports TOTP. Finally, TOTP is also very easy for websites and services to connect to authentication systems, so TOTP is widely supported.
However, TOTP also has its own limitations, the biggest problem of TOTP is that it is not resistant to man-in-the-middle attacks. In a Man-in-the-middle (MitM) attack, the attacker inserts his own device between the two ends of the communication to intercept, tamper and steal data. If a user is under a MitM attack, the attacker will not only spoof a login box with a username and password, but will also spoof a page that looks like an authentication token, asking the user to enter their token information. The attacker can then use this information to spoof the real authentication server and successfully access the user’s account.
In addition to not being able to resist MitM, I also find the steps of using TOTP a bit troublesome. If you use a password management tool to quickly fill in the password, you often need to open a separate TOTP software to manually enter the string of authentication code; if you save the TOTP to the same password management tool, you are suspected of putting “all the eggs in one basket”.
The method of storing and generating one-time passwords with security keys, also known as U2F (Universal Second Factor), is also effective against MItM attacks based on the security key’s “software can only write the key but not read it” feature.
When we use security key for authentication, the web page will first send a “challenge” to the security key, and the security key will unlock this “challenge” and return the corresponding result to the server according to the private key (which can be understood as the key of mailbox) stored inside. No one can see the private key placed in the security key, and only the correct public key encrypted message on the server can be unlocked by the private key, because the deliverer can send the letter to you only if he knows the mailbox is you. In addition to more security, the security key naturally has the feature of easy to use. On the computer platform, it can be directly inserted into the USB interface for other programs to call, and only one extra touch is needed for identity verification. As for on the mobile, in addition to plugging into the interface for authentication, you can also scan NFC on NFC-enabled devices for verification.
As we mentioned earlier, security keys also support storing a variety of different encryption types. If a website or service does not support U2F, many security keys, such as Yubikey’s products, also support storing the more widely supported TOTP, which can be filled in automatically with a simple touch of the security key. Some other encryption types can also be useful in specific scenarios, for example, PIV smart cards can be used to replace access cards, and OpenPGP is a common way to encrypt files and emails. The small size of the security key can also be considered an advantage, as it is very easy to carry; however, it is also a disadvantage, as the small size also means that it can be easily lost. If the device is lost, not only will you need to reconfigure the authentication process, but you may also be blocked from authentication. So if you want to use a security key for encryption types other than FIDO2, my advice is to have an extra security key for backup; and FIDO2, as the cornerstone for implementing communication keys, can be set up additionally using the phone and other supported software around.
If a website only wants to use SMS or private authentication for two-step authentication, security keys are not helpful; the cost of using security keys is also not low, after all, you need to buy 2 at a time, and if you lose them, you need to buy them again, which is not worth it for most people. However, so far the security key has solved my previous complaints when using software TOTP, and made some of my accounts more secure by the way.
If you already have a security key on hand (preferably more than one), then it’s time to talk about its use. Secure Key currently supports many systems including Windows, macOS, iOS, Android, and major Linux distributions, as well as online use in major browsers such as Chrome, Edge, Firefox, and Safari.
However, since different keys support different types of encryption, I will introduce you how to use secure keys according to my own common scenarios. The security key itself supports the FIDO2 protocol used for communication keys, so sites that support using communication keys for login or two-step authentication are also able to enter security keys.
In addition to FIDO2, U2F is another more widely used encryption type, but as mentioned above it can only be used for two-step authentication, so if you’ve seen this screen before when adding a communication key, it means that the service and website uses U2F encryption. For example, 1Password currently only accepts traditional security keys, as does Apple’s Apple ID security key mechanism introduced in 16.3. Please refer to the official Yubikey website for further information on compatibility.
Many security keys also support storing TOTP related data. Although the security key itself does not have a battery and there is no internal clock, the security key can store TOTP by itself and pass out the authentication codes of different services with the help of power supply and time provided by the cell phone or computer. This method is more secure than storing directly in the software locally and can still be synchronized between multiple devices without going through the network; however, this method also has some drawbacks, such as: the number of TOTPs that can be saved by the security key is relatively small, etc.
In addition to the authentication of web services, security keys are widely used in other authentication scenarios, the most common scenario in my daily use is SSH authentication, which has various encryption types available, but the simplest method is U2F encryption.
There are many different brands of hardware keys on the market, but after I gathered some experiences, I finally chose YubiKey, which in my opinion has the following advantages.
Wide range of supported protocols: YubiKey supports all the encryption protocols I can think of.
Good compatibility: As long as the service provides a supported encryption protocol, YubiKey can be bound successfully.
Easy to use: Even without official initialization, it can be used directly; the initialization process is simple.
Ecologically rich: the firmware itself is open source, and there are many third-party plug-ins.
Yubikey also provides different types of hardware keys. The one I purchased is the USB-C type hardware key Yubikey 5C NFC with NFC support, which can be used on all the devices I have at hand. The devices I have on hand all have a USB-C port, and on the iPhone it can be scanned and read via NFC.
Yubikey 5Ci may be a good choice if you still want to use it on iPhones and iPads that do not support the Lighting interface for NFC reading. If you have to use it on A-port only devices, YubiKey 5 NFC is a good choice. And for compact size, the YubiKey 5 nano and 5C nano are not to be missed. But either one can be hung on a keychain and never forgotten as long as you remember to bring your keys. Another thing is not to forget to prepare a second hardware key. The two security keys can be of completely different brands and models from each other, as long as they support the same protocol.