How do you know the YubiKey isn't going to attack your machine through the USB port?
How do you know your mouse or keyboard isn't going to attack your machine through the USB port?
GitHub supports Universal 2nd Factor authentication
51–60 of 85 posts
Re: GitHub supports Universal 2nd Factor authentication
#52Earlier quoted context omitted.
The point is that without it, information just as freely flows to someone with your password across the world. Getting USB sticks like this is a win for me, I hate using my phone for 2FA as well, but something I can just toss on my key ring? Hardly a burden.
What if the thing you're trying to access from doesn't have a USB port? Like, an intelligent table surface, a digital wall, a smart goggle device, or even an tablet that only has a micro-USB port? Information flow protocols and hardware should be abstracted and separated in the same way that we generally separate church and state in most modern nations. Otherwise, the innovation of either is going to be pulled behind…
Then you fall back to using TOTP (Google Authenticator), or SMS codes, or printed backup verification codes.
Re: GitHub supports Universal 2nd Factor authentication
#53It's always exciting to see the list of services supporting U2F for 2FA grow. It now includes Google, Dropbox, and GitHub.
Re: GitHub supports Universal 2nd Factor authentication
#54"Note: FIDO U2F authentication is currently only available for the Chrome browser." https://help.github.com/articles/providing-your-2fa-authenti...
Here's the issue for the feature in Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=1065729
Yeah this stuff won't be "universal" until at least all browsers support it... which would be GREAT
Re: GitHub supports Universal 2nd Factor authentication
#55It's always exciting to see the list of services supporting U2F for 2FA grow. It now includes Google, Dropbox, and GitHub.
Duo also supports it.
Re: GitHub supports Universal 2nd Factor authentication
#56This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?
Some phones actually provide U2F. I think the SGS6 does. The secret in stored in the harware backed credentials storage.
Re: GitHub supports Universal 2nd Factor authentication
#57Uh. U2F feels incredibly limited compared to PKCS#11 I really wonder why it was chosen (and somewhat disappointed by the choice.)
With a smartcard that can hold an key pair, one can both authenticate (sign) and encrypt messages, using a same single key (or multiple keys if wish for multiple identities). With U2F all one can is authenticate, using a distinct securely-stored PSK for each remote party.
Re: GitHub supports Universal 2nd Factor authentication
#58I would have used it if it used Google Authenticator.
Re: GitHub supports Universal 2nd Factor authentication
#59I would have used it if it used Google Authenticator.
You've been able to use Google Authenticator with Github for years.
Re: GitHub supports Universal 2nd Factor authentication
#60I would have used it if it used Google Authenticator.
You've been able to use Google Authenticator with Github for years.
I dug through 2 links and found it, thanks for letting me know:
https://help.github.com/articles/about-two-factor-authentica...