how does the security PIN feature work?

[adrian-gierakowski]

how long can the pin be?
does it support numbers from 0 to 9?
how would I enter the pin?

thanks!

[onlykey]

The PIN works similarly to the OnlyKey with some differences.

1. Corporate users who may only require features like FIDO2 can use device without a device PIN. The default is no device PIN if you plug in and start using OnlyKey DUO it will work just like other standard security key.

2. Users who desire a device PIN can set one in the OnlyKey App. The PIN can be entered two ways. The OnlyKey App will prompt for PIN entry via Keyboard or alternatively if a user is on the go they can still enter a PIN on the key itself. To do that press buttons to enter a 1,2,3 or hold to enter 4,5,6.

3. As with OnlyKey the PIN if set would need to only use numbers 1-6 if on device PIN entry is desired.

[dingwen07]

Smart solution! I wonder if the Onlykey classic could also not introduce keys 7, 8, 9 and 0 by holding 2 of its keys at the same time ... (but then it would no longer be compatible with the duo)

Then actually more than 10 digits could be covered.

[adrian-gierakowski]

Thank you for your answer @onlykey! One last question: is the OnlyKey App going to be available on desktop and mobile?

[paeony]

It would be great if a video was put up showing someone using the Duo to enter an 8 or 10 digit password using digits 1-6.

This would really help understand if the two button (with hold and such) interface is workable on a regular basis. E.g. is this something that would be workable the way it is with the 6 digit keypad on the existing device? Because among only keys many killer features (and why I own 4 of them) is that the device is secure if lost and it's even secure against an insecure PC or Phone so long as you don't program it from that device. But that security depends on being able to enter the access code onto the hardware, not via the PC/Phone.

[onlykey]

@paeony OnlyKey users are quite diverse. We have users that like yourself appreciate the on device PIN entry and then others that don't. We have the features there for users that want this but not required for users that don't like most larger business deployments don't want on device PIN. It's important to look at your own personal threat model when deciding what works best for you.

Good (comparable to standard FIDO2 security keys)- No device PIN required, FIDO2 PIN is still required, provides protection from phishing and other remote attacks.
Better (comparable to smart card) - Yes device PIN, entered via keyboard, provides additional physical protection from lost/stolen device.
Best - Yes device PIN, entered via device, provides additional protection from local system compromise by advanced adversary.

@adrian-gierakowski We will have the app on desktop and later release a mobile accessible web app as a feature of OnlyKey WebCrypt. A popular way to use a security key with mobile devices is to only use your key for the first login, (i.e. Enter your Lastpass master password and 2FA to set up Lastpass app) then use the on device MFA features like touch or face for login after that. This works better for most users rather than using a security key to login every time, many mobile devices also now have built-in FIDO2 security keys which we write about here.

[paeony]

@onlykey - yup, totally agree. Good is actually var better than most folks have. But the reason I went to OnlyKey versus its competitors is because I have more sophisticated needs and so wanted to understand if the Duo is focused on the "Best" case and it sounds like it isn't. Which is a bummer but fully understandable. For now I have a USB A to C adapter so I can use my existing OnlyKey with my phone.