Security, account logins, 2FA, Hardware Key support
tracked
Paige Addams
It is wonderful we now have a strong implementation of 2FA support in both the viewers and the LL websites. To make the use of this easier without weakening security I would like to see support added for Hardware Keys such as Yubico and OnlyKey. This would allow users who wish to use a hardware key rather than entering a changing code. Depending on setup at implementation it is possible to make this more secure than is now and not make it more difficult or simply setup to be most flexible so providing support for this would provide a lot of flexibility. In addition, perhaps LL could become a partner of say Yubico (there are many others, but this is one of the most popular ones), perhaps even OnlyKey as well this would also provide another source of income for LL and make it easier for users that don't wish to find and purchase the key(s) themselves. Considering how many users are in SL this could be a massive deal for LL and companies they might partner with.
Log In
NeuroCognitive Resident
Maestro Linden Many thanks for merging my thread! I appreciate it!
I saw in this thread that people were questioning if you can utilize Yubikey with Second Life!
To an extent, yes. You can have your Yubikey plugged into your computer, or phone; run the 'Yubico Authenticator' Software on your computer (or phone), click the "accounts" button under the "home" button on the left side of the application (for desktop), enter your OATH password to access the accounts section, and then once entered into the accounts section, on the right press the "Add Account" button under the "Setup" section.
This will open up a menu that shows the credential detail windows which need to be entered in order to begin using Yubikey for the current MFA (Which, isn't really using it's cryptographic potential, but if you'd rather use Yubico Authenticator and your Yubikey as your own version of Google Authenticator or another service for the same type of authentication, you definitely can still do that with the current state of MFA on Second Life!
There'll be a button in the centre of the window up near the top under the words "Add account" (it's a bit further to the right, very much so in the centre) that button will say "Scan QR Code"; this does not require a camera, BUT, you will have to go to your MFA authentication setup window over on Second Life's website, and initiate the setup process. [ https://accounts.secondlife.com/mfa/status?lang=en-US ] Here's the link in English for getting to Second Life's MFA setup window.
You'll want to click "Get Started" on Second Life's website at the link that I put in thread up in the previous paragraph. This will take you to another window with a QR Code right at the very tippy top of it, a big one.
Go back to your Yubico Authenticator app, make sure the Yubico Authenticator app is not covering the QR code in the Second Life web browser window (Actually move the authenticator window off of the QR code if it's blocking it, fully.) and then click the Scan QR Code button in the Yubico Authenticator App.
Now all you gotta do is click "Save" in the bottom right of the Yubico Authenticator Window, as it should have scanned the details from the QR code already.
[Hit character limit so I gotta continue this in further messages.]
NeuroCognitive Resident
[I'll quickly run over doing this manually too without the QR Code before getting to the next step since it's possible that the QR code system might not work for some people (I've never heard of it not working, but I'd rather account for the possibility that somehow it doesn't.)
So as you do in the way you do with scanning the QR code, go to the same window by clicking "Add Account" in the Yubico Authenticator App.
There'll be three fields where you can type stuff into the window: Issuer, Account Name and Secret Key.
Issuer you can leave completely blank or put whatever the hell you want in it, doesn't really matter, could name it poop or whatever if you wanted.
As for account name, just throw your username in there so you know that it's for your second life account, I personally put (Second Life) beside it just to be certain.
And then for the Secret Key Field, you'll want to grab the key below the QR Code on the Second life website that comes after the text : "If you do not have a camera available or wish to use a manual setup key instead, your key is : xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx [x's are whatever your key is]"
Copy and paste all of that key into the "Secret Key" field in Yubico Authenticator.
The settings below the secret key field, should not have to be changed but I'll explain them anyway since this is the basic MFA cryptographic system currently available for MFA security on Second Life.
Pressing 'Require Touch', only pertains to your hardware key and utilizing it to make the Time based password visible INSIDE the Yubico Authenticator App (Yes, you cannot tap your key to have it spew out the One Time Password in your viewer or the website when asked for authentication, that is one of the cruxes of the current MFA cryptographic system, it's outdated, rigid, and no different than using Google Authenticator or any other typical time based OTP generating Authenticator currently for Second Life with MFA. You have to use the Yubico Authenticator App still because the Yubikey itself, doesn't have an internal clock and for Time Based One Time Passwords, the Yubikey will have to rely on the application to supply it the current time.)
Leave the next button beside require touch on "Time Based".
NeuroCognitive Resident
The next button beside that on SHA-1, (That's the simple secure hashing algorithm that utilizes a 160 bit message digest on a time based algorithm that works with the secret key to combine itself via the HMAC-SHA1 mathematical algorithm to output the variables that will cycle and be generated on a timer which you will be using for authenticating and accessing your account. HMAC-SHA1 is very very old and not as secure anymore in terms of it's cryptographic capabilities or encryption, buuut it's the best we have currently and it's what you're going to get in terms of using MFA systems with Second Life currently, my condolences. Your Yubikey is still incredibly good, you're just adding an account MFA TOTP generator onto it just as you would Google Authenticator something else. (It's why I made a biiiiig post earlier today suggesting that Linden Labs should consider possibly begin utilizing hardware keys and integrating FIDO2 or FIDO U2F as an available cryptographic option for MFA for users (And for certain, to start using it themselves as staff at the office since it's pretty important for security of administrative infrastructure for people working in tech related fields; or for example, those working in intelligence. [We all use that stuff, it's a requirement. It works really well and keeps stuff safe.] )
The other options under SHA-1 are SHA-256 and SHA-512, those are SHA-2 family cryptographic algorithms using higher hash values. Those are not for you unfortunately if you want this to work with second life, second life's authentication system is only SHA-1 currently. No touching, leave it on SHA-1. (Trying to use SHA-2 algorithms will most likely without a doubt, cause a failure to authenticate, and would cause an invalid login, again, no touchin'.)
Next button beside SHA-1, is the timer button, should be on 30 seconds; usually you'd use this to change the amount of time that the cycle of codes being generated would be present before they cycle out again. From what I'm aware, 30 seconds is hardcoded into Second Life's MFA system, so no touching that either, sorry. (If you don't keep it at 30 seconds, chances are trying to authenticate with any other variable will cause an invalid login and failure to authenticate.)
NeuroCognitive Resident
Last button will be the digits; it should be set on 6 digits, there's options for more digits, but again, the MFA system on Second Life is not set up for more digits, leave it on 6. (If you don't keep it at 6, same thing as the timer, likely failure to authenticate resulting in an invalid login.)
Now after all that, you can just click save on the bottom right, should be good. If you want to use two authenticators such as both Yubico and Google Authenticator, just scan the QR code with your Google Authenticator before moving onto the next step.
Now for the next step, comes entering the tokens. Go back to the Second Life webpage with the QR code, go down to the bottom and click the "Enter Tokens" button (So long as you follower the above steps correctly either for the QR code method manual setup method.)
If you take a look at the account that is now present in your Yubico Authenticator window, there should be a numerical token generated to the right of it with a little pie shaped timer going down to the left of the numerical token. The token will be 6 digits long, type those 6 digits in the first field (Which says "First Token:") of the Second Life Web Page. You don't need to add the space between both of the 6 digits between each half of the 3 on each side, just type the entire token at once, all 6 digits into that field, no spaces.
Now you'll want to type into the next field that says "Wait for the next token to appear, then enter it:" quite literally what it says, which is the next numerical token that comes after the one you just entered, you should see the little pie shaped timer slowly getting tinier and then a new numerical token will generate, type that one into the field on the Second Life Web Page. (Also doesn't need any spaces either.)
And then just click the button below the two fields, and.. you should now have your account set up to use the mutli-factor authentication with your hardware key's digital authenticator app, which your hardware key, will have your Secret Key's HMAC-SHA1 combined variable stored on it, so it can just be plugged into your phone or whatever else has Yubico Authenticator on it and you'll be able to access your Time Based One Time Passwords whenever you need to and have your hardware key on you.
NeuroCognitive Resident
Right now, we do not have the exciting and much more secure option of FIDO2 or FIDO U2F where we can just have our hardware key plugged in and have our viewer or the second life webpage going "Just tap your key and you'll be logged in.", but if you have a hardware key and want to use it with Second Life currently in the stage of MFA that we currently have, you still can in terms of Yubico's Yubikey. (I'd assume that whatever companies probably make security keys hopefully would allow the same thing, but I haven't looked into any other manufacturers too in depth since Yubico tends to be the best in terms for their security and cryptography [as well as general versatility.])
All in all, hope that can help some of the users who want to actually use their keys and the key's authentication software with Second Life. It likely is not what you currently want, but it is the option you currently have for utilizing a hardware key with Second Life given our current MFA system running SHA1 architecture. The set up of this stuff can be a little bit convoluted, but I hope that the way that I elaborated upon it would help make it a little bit more easy for folk to understand that have a difficult time figuring out how to use these things. Once you get the hang of it, it becomes easy as pie! And the QR Code system helps make sure that folk who don't want to try and run through all of the manual set up can get it done in a much quicker and easier fashion.
All the best!
[My apologies again for all the messages, forgot that the character limit was that small and had no clue that my explanation on how this stuff works would be over 10,000 characters, whoops!]
SL Feedback
Merged in a post:
Implementation of Advance Cryptographic Multi-Factor Authentication Systems and Security Infrastructure (Including Support for Hardware Authentication Outside SHA-1 TOTP MFA)
NeuroCognitive Resident
Greetings,
I just wanted to ask a question and make a suggestion about if the possibility of better cryptographic multi-factor authentication methods would be further implemented in the future?
I'm unsure if Linden Labs uses Physical Hardware Cryptographic Keys in their own offices such as Yubico's Yubikey's, but throughout the tech industry in management of social media platforms, as well as in Intelligence Agencies, Corporate Infrastructure, Banking/Trading/Stock Markets/Platforms, as well as countless Social Media and Email platforms (And I'm sure many others.) have stepped into the realm of providing the capability of utilizing advanced cryptographic multi-factor authentication methods like physical security keys! They honestly are incredibly useful pieces of tech that are borderline impossible to be cracking into without manually having the physical key that is attached to the owner of the key that has registered it and assigned it to an account, or signed it with Certificates that they can set a time limit on to need updating. Many of them can be used as well with implementing keys for security door systems inside the office (Which may help at Linden Labs if you guys aren't using that already; kind of like a fob.) along with many other security implementations.
Many of them such as Yubikey, will use FIDO, specifically FIDO2, FIDOU2F, OpenPGP, PIV, OATH, as well as their own OTP system. But, they also aren't incapable of using the typical time based 30-sec, 6 digit count time based SHA-1 Cryptographic Multifactor Authentication system that is currently used on the user end for MFA that isn't email authentication. You can also set up the physical keys to store and register those authentication systems as well, along with modulating them to be counter based, 8 digits, SHA-256/512, and have up to a 60 second count time for the tokens generated for authentication in the MFA system.
These Keys can have registered digital signatures for your corporation so that updated certificates must be signed by administration (This part is more intended towards Linden Labs employees and Sec-admins themselves.) ensuring that tampering of certificates or credentials are not possible without authorization of those who manage the key themselves, which the keys are practically air-gapped with how they work, ensuring that tampering through cracking open the key is basically impossible unless you have tens of thousands of dollars of scientific equipment and have the ability to run electronic diagnostics equipment such as oscilloscopes to gauge variations of load by measuring microswitches which were fundamental to the infineon cryptographic library's non-modular inversion processes, also requiring prior knowledge of the key owner's account credentials or access PINs; this crack all had to be done when the key was operating (Which actually was fixed a while ago with new firmware patches which Yubico completely ensured would be impossible even with how mythological that kind of crack is in the first place, and they completely phased out Infineon's cryptographic systems and began using their own proprietary cryptographic system post the Yubikey Firmware 5.7+ Versions, since that crack was done by Ninjalab in terms of seeing if they could crack one of the most difficult cryptographic security tools to crack out there [That crack, was called EUCLEAK, if you're ever interested in reading up about it. (Ninjalab is a collective of security researchers that do stress testing of security systems like this and expose flaws for government agencies and security infrastructure corporations; they're incredibly good at their work and in helping out with stuff like that! So don't let them being able to actually find a flaw in something like that let it throw you off.)
The keys at least made by Yubico, as I said are basically airgapped in terms of their firmware they're shipped with being non-updateable, meaning tampering with them as I said is basically impossible for threats outside of anyone who'd be watching over your shoulder at your desk trying to see you type in your credentials or PIN that decided to yank your key out of your system or hands.
There's further implementation into these systems such as biometrics and maaany other things, many of them already have NFC capability so that if you have to use them on your phone but don't have a USB adapter, or a key that fits your phone or mobile devices output, you can just enable NFC and scan the key that way when requested by whatever system that is asking for it to authorize authentication.
I may sound like a paid shill for Yubico or Security Corporations that make these things, but I am most certainly not! I just work in a lot of fields that require these things and I've had experience with them for years with my own work, and the one key I've had for around 5+ years now, still works like a dream and keeps a bunch of my security systems and accounts safe! So I figured that suggesting it, if Linden Labs doesn't already use them in their offices, would possibly be a good idea and might be helpful to their own corporate security as well as would help out the userbase for anyone that does use them or desires to acquire one eventually and utilize advanced cryptographic authentication systems to protect their account security.
I personally think that with the increasing threat to online security and data, as well as in general SQL databases, user accounts, and digital infrastructure in institutions, corporations and government departments...... primarily due to the rapidly increasing development of AI which is being trained by quite a few people to learn blackhat hacking methods and database cracking (Or in general, poking holes in source code or site infrastructure and managing to seep through the floorboards into places that it definitely should not be in. [Take Discord's problems that have been going on recently with numerous individuals having their accounts hijacked through a simple token/cookie exploit which would allow them to bypass countless user's account security and MFA if the user managed to fall for their phishing link and click it. (Which many did from what I've seen and experienced from a lot of friends having their accounts hijacked by people on that platform with that exploit. It happens nearly instantaneously once they click the link, and it's been spreading around the internet for a while now and has been an immense problem, as well as not a security exploit that has really been seen in a system or platform like that since the days of MSN, which I believe also suffered a similar exploit if I recall correctly. All of that stuff, as well as continued cryptographic declination of corporate systems and platforms which do not choose to recognize the looming threat of vulnerabilities in cryptographic systems which are outdated and not accounting for the worst possible outcomes (Such as AI.), is something that can pose an immense risk to the ROI and visible public relations or opinion of the Corporation or Institution that has a security breach like that which begins affecting much of it's userbase. We're currently not at the level of a threat we'd be at with Quantum Cryptography ever being readily made available to the public, but AI becoming more advanced in terms of it's development and capability of utilizing hardware and training data for understanding cryptographic computation and exposing security vulnerabilities, or blackhat hacking methods, is enough of a substantial threat that it would be similar to randomly throwing hardware capable of running quantum mechanical algorithms capable of cryptographic expression, formulation or problem solving. It's not great, remotely, to say in the least dramatic way possible.
But, I figured that if someone hasn't made the suggestion of these specific implementations to our platform's security systems for multi factor authentication, both on the user and staff side, as well as increasing server database security.... that it might be helpful to make a suggestion in the long format manner that I tend to with most things I bring up for bug reports or suggestions for implementing changes to the platform!
This kind of stuff is what I specialize in a bit more so I have a bit of an easier time explaining it and elaborating upon how important and useful it is.
Anyway, I hope this can help and maybe open the eyes of some of the people in middle-management or above it, as well as help the userbase if it gets implemented on the user end for keeping their accounts more secure. I'm sure that the price of implementing it would probably cost a liiittle bit of money, but it likely wouldn't be too much to wig out over given that it would be ensuring stability of any vulnerabilities to your platforms security infrastructure. From what I can tell, you guys tend to do a pretty good job already, but I tend to believe that it's better to be safe than sorry and not let a long term of having not many security threats popping up be the reason for not implementing new advanced security measures just because there hasn't been a threat yet which could destabilize the operation of the platform. There always inevitably will be a threat at some point, unless constant maintenance and awareness of what threats are out there and their capability for each type of security system out there. Since AI now exists readily within reach to the public, it's a gamble on "when" it's going to happen over how it will happen, so I honestly really think that preparing for it if you guys haven't been already would be a good idea!
Anyway! Thank you for your time once again in reading my excessively circumlocutory messages! Hope that I could help in some way with my suggestions; all the best to you!
(If my thread has been posted twice, my mistake; I tried uploading it once and didn't end up seeing it nor was I pushed to the thread, so I assumed a possible error.)
Maestro Linden
Merged in a post:
Add Yubikey support for MFA
JustinOld Goat
If possible, include an option to use a Yubikey or similar device for multi-factor authentication. Such a token generator can be more convenient than an authentication app. On desktop/laptop one can connect the key via USB to send a token with a finger swipe. On mobile one can pass the key over the phone and authenticate via NFC. For me it would eliminate the step of launching an authentication app and trying to accurately copy the key into the viewer.
Unless this is already possible, then please document the setup procedure.
Thank you
Alisyn Baxton
Definitely voting for this! I use Yubikey constantly throughout the day for work, and don't mind extending it to SL. Allow the ability to register more than one Yubikey, too! (I alternate between two, one USB-A and one USB-C, depending on which computer I'm on at the time).
Alisyn Baxton
I just found this is a duplicate of the older https://feedback.secondlife.com/feature-requests/p/security-account-logins-2fa-hardware-key-support
Alisyn Baxton
Definitely voting for this! I use Yubikey constantly throughout the day for work, and don't mind extending it to SL. Allow the ability to register more than one Yubikey, too! (I alternate between two, one USB-A and one USB-C, depending on which computer I'm on at the time).
Zanya Resident
Seconded.
Zia Underwood
I like this even if both my yubi keys are just chilling on my desk collecting dust lol
Jessica Hultcrantz
Please consider support for yubikeys (plural). It would be beneficial for us who keeps a backup key at hand. Big companies like Google already support this.
Paige Addams
With 2FA via a hardware key like those I mentioned above we can have the same security we do now or better and beyond setup on the user end would only require pressing a button on the key or similar. We could authenticate daily increasing security and only need to press the flashing button like on yubi key for example. There is no down side. Providing this support is not so much for a specfic device rather more an industry standard depending on protocol used. I would not drop the software 2FA we have now because if someone loses their hardware key they can still get in remove the lost key and setup a new one. Some orginazations also provide recovery code in case a key is lost or damaged. Additionally, this could be another revenue source for LL either through sales an supplying, referral to vendors or something else.
Load More
→