Pre-Sales Antwort? Einsatz Win10 / Keepass

Nitrokeys
1

Hallo

ich habe zweimal Nitrokey auf die Supportmail geschrieben, aber nie eine Antwort erhalten. Versuche es nochmals hier.
Wir überlegen uns den neuen Nitrokey FIDO2 zu kaufen. Neben Websiten Logins haben wir zwei spezifische Anwendungsfälle:

  1. Login Windows 10: Wie ich verstehe kann ich den Key für das Login in Windows 10 mit Fingerabdruck auf dem Key verwenden. Ist dies richtig? Gibt es Voraussetzungen dafür (z.B. Windows Version)? Wenn ich hier im Forum schaue gibt es auch Anfragen, die Probleme mit Win10 haben

  2. Wir verwenden Keepass auf Windows 10 und möchten den FIDO2 key gerne auch als Masterpasswort mittels Fingerabdruck verwenden. Geht dies? Leider sind die Produktinformationen nicht sehr klar, es wird sehr viel allgemeines über Login, Sicherheit, Benutzerfreundlichkeit usw. geschrieben, aber konkrete Anwendungsfälle, welche die meisten User (die nicht Security Experten sind) interessieren, fehlen.

danke

2

Hi!

I am sorry, but in the winter break holidays we have increased reply time on emails. Please feel free to write here as long as it is not confidential.

  1. Windows 10 login works only, when coupled with AD. Otherwise it is not possible, and not planned by Microsoft to be added too.
    AFAIR the problems mentioned on the forum came from misunderstanding in what conditions this feature work (Microsoft was not clear about it for some time as well).

  2. KeePassXC support for FIDO2 is not yet available, but planned by its developers (no schedule yet). See keepassxc#3560 for details.

3

thanks for your feedback
about 1: What you mean with “AD”?

about 2: Yubikey has an implementation with Keepass, see here https://keepass.info/help/kb/yubikey.html. however, they do not have a key with fingerprint recognitation. As I understand you right, also nitrokey has no usb keys with fingerprint, which would support password entering as described here https://keepass.info/help/kb/yubikey.html?

4
  1. AD is from Active Directory (sorry for not mentioning). In general to use FIDO2 device for login to Windows 10 is about using workstation in a Windows directed network, with AD enabled.
  2. Indeed Nitrokey does not offer any devices with fingerprint readers. Access is protected with user configurable PINs.
  3. Both KeePass2 and KeePassXC (which I have mentioned earlier) do not support FIDO2 directly at the moment, which we hope will change. We have decided to opt for a general solution instead of developing another custom interface for the challenge-response, hence the FIDO2 and PKCS#11 tickets have our full support. This is a design decision, not a hardware limitation.
    Alternatively, Nitrokey Pro and Nitrokey Storage feature OTP codes, which allows to unlock the KeePass2 database.