Sod the Yubikey. Get a Pebble Time watch and install the QuickAuth app. One press of a button on my watch and I get a list of two factor auth codes for my various services, now including Github. Doesn't require plugging anything into my laptop. Doesn't require my phone to be near me or on. Doesn't require Internet access.
GitHub supports Universal 2nd Factor authentication
41–50 of 85 posts
Re: GitHub supports Universal 2nd Factor authentication
#42When will Amazon get U2F/2FA? I have heard it's good for AWS but what about for us plebs who just buy stuff?
Re: GitHub supports Universal 2nd Factor authentication
#43This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?
I've used a YubiKey for 2FA for a year or so now. It just sits in my USB port and it feels too convenient - steal my laptop and you get my key. At least my phone has a PIN.
I use it for my email, and have set it up with yubikey + password, given that you need both it's not like you can brute-force the login anyways
Re: GitHub supports Universal 2nd Factor authentication
#44This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?
For me that key is the emergency key. I have it on my keychain. I use Google Authenticator normally. I don't yet have U2F key always inserted the computer in my home but I think it would be convenient. I have a regular Yubikey inserted in the USB slot in my monitor to unlock Password Safe with a 25 char password. I don't think I would like it permanently inserted on a device I carry outside of my home.
Re: GitHub supports Universal 2nd Factor authentication
#45Although I think Yubikey is great, I use Plug-Up key to test U2F. http://sk.happlink.com/plugup/en/
It was cheaper but is more fragile, worked well to test it out.
Now when U2F is getting more support, I think I will buy a Yubikey with U2F.
Re: GitHub supports Universal 2nd Factor authentication
#46Earlier quoted context omitted.
You're expressing a preference for convenience over security. The truth is that most people pick bad passwords, and even good passwords can be cracked. 2FA with a physical component is generally the best way to achieve the goal of "information flows with me". With a password only, you can more aptly describe the situation as "information flows with anyone who knows my password".
In that case, can we do 2FA with something biometric? Or even 2 passwords? A physical component has a lot of issues: * It can be stolen or robbed at gunpoint. Torture, drugging, and hypnosis aside, your mind is much more secure. * It can run out of batteries. * It's one more thing you can lose. It's already annoying enough to have to remember to carry 7 or 8 things every day, including a phone, bike light, smart watc…
The Yubikey does not run on batteries. It requires no cellular service. It can be damaged by the elements but not easily. Most electronics would break before it does. Of course you can lose it, but you can lose anything. Attach it to something you care about, such as your regular keychain. If you want to give access to someone, register a second key and lend that key to them. Then revoke when they don't need it.
Re: GitHub supports Universal 2nd Factor authentication
#47Earlier quoted context omitted.
The point is that without it, information just as freely flows to someone with your password across the world. Getting USB sticks like this is a win for me, I hate using my phone for 2FA as well, but something I can just toss on my key ring? Hardly a burden.
What if the thing you're trying to access from doesn't have a USB port? Like, an intelligent table surface, a digital wall, a smart goggle device, or even an tablet that only has a micro-USB port? Information flow protocols and hardware should be abstracted and separated in the same way that we generally separate church and state in most modern nations. Otherwise, the innovation of either is going to be pulled behind…
Likely the next step for those will be NFC communication. Yubikey NEO has this for example, and can be used with Android phones. Note that U2F uses challenge - response protocol so sniffing the radio waves will not reveal the secret.
Re: GitHub supports Universal 2nd Factor authentication
#48Earlier quoted context omitted.
Yubikey has a "always available" form factor if you're already bringing your laptop to work in the neo-n: http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7... . It just lives in your USB port. The user experience is also better with U2F than previous 2FA systems. When GitHub prompts you for U2F, you press the yubikey and are instantly logged in. No typing random numbers with n seconds, no fake keyboard. YM…
I think the issue is that I have a laptop at home and iMac at work so I don't bring my computer on my commute. Also, I like the extra security of the fingerprint scanner on my iPhone.
In that case, I might prefer an authenticator to a keyfob that requires insertion too. The yubikey is slightly more secure since it's actually signing a message from the server rather than sending a password that can be (briefly) intercepted and replayed. But it's probably not 'better enough' to encourage someone not to use 2FA at all if U2F isn't convenient.
If user security has taught us anything in the last 20 years, it's that security features have to be convenient or may as well not exist. I think we'll be seeing a lot more 2FA options in the next few years. In this segment, user choice is a huge improvement in and of itself. I've also been testing Duo push for some internal stuff, which is a phone-based experience that's as smooth as silk. To each their own!
Re: GitHub supports Universal 2nd Factor authentication
#49This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?
Github will support a token generating app on your phone: https://help.github.com/articles/providing-your-2fa-authenti...
It already does. Been using 2fa for a year or so.
Re: GitHub supports Universal 2nd Factor authentication
#50Earlier quoted context omitted.
Yubikey has a "always available" form factor if you're already bringing your laptop to work in the neo-n: http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7... . It just lives in your USB port. The user experience is also better with U2F than previous 2FA systems. When GitHub prompts you for U2F, you press the yubikey and are instantly logged in. No typing random numbers with n seconds, no fake keyboard. YM…
I think the issue is that I have a laptop at home and iMac at work so I don't bring my computer on my commute. Also, I like the extra security of the fingerprint scanner on my iPhone.
Your iPhone is completely covered with your fingerprints. Also, if your phone gets hacked/compromised the attacker could steal the secret used to generate your TOTPs. This is not possible with the Yubikey, it is absolutely impossible to extract the private key.
I have a Yubikey on my keychain (it can easily withstand this), and it takes very little effort to plug it into the USB port when I require it. Less than it would be to take my phone out.
As a side-note, some time ago the Yubikey had a vulnerability with its GPG module so they shipped out new ones for free. I now have the old key (with no GPG keys loaded on it) permanently plugged into my USB hub at my desktop. It is amazingly convenient.