Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Who else is uncomfortable with hardware 2FA for personal use?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 13 posts

Ask HN: Who else is uncomfortable with hardware 2FA for personal use?

#1

Post by aunterste »

I just 'aborted' my Yubikey purchase again as I started to think through how many I would need to buy and where to leave them to be sure I always have access, even if my house burns down and/or the hardware key breaks, one gets lost etc.

I think hardware 2FA is great in a corporate environment where there is an administrator that can enable/disable accounts and issue a new HW key if required.

For personal accounts though, I somehow feel uneasy about reliance on a small piece(s) of HW. Having a great password manager, lots of 2FA (with TOTP, where I own and back-up the secrets) and have all of that secured with a cloud backup with a super strong password that I don't know or have to write down, but can recreate if need be (e.g. an MD-5 hash of a specific segment of a public text).

Too much? Anyone else has the same concerns or am I missing something?

Re: Ask HN: Who else is uncomfortable with hardware 2FA for personal use?

#2

Post by joshenders »

I purchased three keys for each family member for Christmas. They’re not the most technically savvy and it hasn’t been an issue for them at all.

(One is on their keychain with an AirTag, one is stored securely in their home. One is stored offsite.)

Every site I’ve registered them with has allowed me to register all three keys. Nobody has lost a key yet (thanks AirTag) but it wouldn’t be a huge ordeal if they did. Just delete that key from their services and use a backup.

Re: Ask HN: Who else is uncomfortable with hardware 2FA for personal use?

#3

Post by raxxorraxor »

I mostly use a prefix generated from the name of the service + the yubikey button to paste the rest. If my key would fail I still have pwd reset options and I keep a copy of it in a password safe. That said, the dongle is a few years old and it still seems to work just fine while being subjected to mechanical strain from other keys.

I dislike any form of 2FA with my phone involved. Low battery, low privacy, phones just generally suck if they are involved in security. I would even prefer the old SMS while being staunchly aware that and code will be send in free text.

Still better than some shitty random app from the shitty app store.

I would be careful about a hash of a public text. I certainly would at least XOR it with secret value, even if its appearance in rainbow tables is very unlikely.

Re: Ask HN: Who else is uncomfortable with hardware 2FA for personal use?

#4

Post by h2odragon »

Do you really need that much security? What is it you're securing, exactly? Neither my cookie recipe nor the extensive collection of h0rse is worth a great deal of effort to deny others access; I don't have need for obtrusive security measures.

If you do have secrets that are valuable enough to justify the effort; have you really put in the effort to secure them? Or have you got multifactor authentication and fancy encryption happening on a system that's physically available to anybody from the janitorial services company all night? The equivalent of a big impressive vault door standing alone without walls around it.

Re: Ask HN: Who else is uncomfortable with hardware 2FA for personal use?

#5

Post by jqpabc123 »

For personal accounts though, I somehow feel uneasy about reliance on a small piece(s) of HW.

Most people already have a small piece of hardware called a phone that can be applied to the same effect.

Free/open source TOTP apps are readily available for both iOS and Android. This isn't rocket science, it's a simple SHA hash that either works or it doesn't.

What if you lose your phone? Remember --- this is 2FA so you need more than my phone to access my accounts. My TOTP app is password protected and I have a backup of the keys so I can easily transfer to another phone or use a desktop app to access my accounts.

What happens if you lose your hardware key? Perfect security does not exist.

Re: Ask HN: Who else is uncomfortable with hardware 2FA for personal use?

#6

Post by aunterste »

jqpabc123 wrote: post #5

For personal accounts though, I somehow feel uneasy about reliance on a small piece(s) of HW. Most people already have a small piece of hardware called a phone that can be applied to the same effect. Free/open source TOTP apps are readily available for both iOS and Android. This isn't rocket science, it's a simple SHA hash that either works or it doesn't. What if you lose your phone? Remember --- this is 2FA so you n…

I think that's my point though, I can easily lose my phone, no harm done if one has the seed-values for the TOTPs and they are protected on the phone.

It's not so much asking for 'perfect' security - I agree, that doesn't exist.

But do HW security tokens create a probability of a hard lock-out that outweighs the security/convenience they provide.

Re: Ask HN: Who else is uncomfortable with hardware 2FA for personal use?

#7

Post by jqpabc123 »

aunterste wrote: post #6
jqpabc123 wrote: post #5

For personal accounts though, I somehow feel uneasy about reliance on a small piece(s) of HW. Most people already have a small piece of hardware called a phone that can be applied to the same effect. Free/open source TOTP apps are readily available for both iOS and Android. This isn't rocket science, it's a simple SHA hash that either works or it doesn't. What if you lose your phone? Remember --- this is 2FA so you n…

I think that's my point though, I can easily lose my phone, no harm done if one has the seed-values for the TOTPs and they are protected on the phone. It's not so much asking for 'perfect' security - I agree, that doesn't exist. But do HW security tokens create a probability of a hard lock-out that outweighs the security/convenience they provide.

But do HW security tokens create a probability of a hard lock-out that outweighs the security/convenience they provide.

If you lose your key, you're locked out --- simple as that.

About the only reasonable way to create a backup is by buying/using/registering multiple keys. But at $40+ each, the cost adds up quickly.

It is hard to beat your phone for overall convenience. My phone is always with me and with my TOTP keys backed up to secure on-line storage, I can easily restore these to another device if/when needed and continue with only a minor hesitation. For most people, this is the most convenient/least expensive/best all around solution IMO.

Re: Ask HN: Who else is uncomfortable with hardware 2FA for personal use?

#9

Post by shaftway »

I would never use a hardware 2FA on any service with no other way in. But that doesn't make them not-valuable. For me the ideal setup is a service that offers a SMS verification code or a 2FA token. The 2FA is far more convenient for me, but if I don't have it the SMS is there as a backup and I can get in to unregister or register a new 2FA token.

Re: Ask HN: Who else is uncomfortable with hardware 2FA for personal use?

#10

Post by unstatusthequo »

shaftway wrote: post #9

I would never use a hardware 2FA on any service with no other way in. But that doesn't make them not-valuable. For me the ideal setup is a service that offers a SMS verification code or a 2FA token. The 2FA is far more convenient for me, but if I don't have it the SMS is there as a backup and I can get in to unregister or register a new 2FA token.

I’d rethink SMS as a secure authentication vector. Too easy for SIMjacking to happen.
Post reply on HN