Google Determines that FIDO U2F Security Keys Improve Security
1–10 of 69 posts
Re: Google Determines that FIDO U2F Security Keys Improve Security
#2Highly misleading headline (EDIT: Title has now been changed). From the article:
> including One Time Passwords (OTP)via SMS phone messages
That "SMS" bit is critical. OTP over SMS sucks. OTP using the same app that already manages my passwords (1Password) is a breeze. Sure, if I had a U2F Security Key already plugged in, then it would probably be even faster, but the downside is I need to have a physical key plugged in, and if I don't have that key with me then I'm screwed (whereas with 1Password I can get at my OTP codes from any of my devices).
Re: Google Determines that FIDO U2F Security Keys Improve Security
#3The comparison is to "One Time Passwords (OTP)via SMS phone messages."
Given the vulnerabilities in GSM, that's not a high bar. http://security.stackexchange.com/questions/11493/
Re: Google Determines that FIDO U2F Security Keys Improve Security
#4Updated the title to specify SMS OTP.
Re: Google Determines that FIDO U2F Security Keys Improve Security
#5Highly misleading headline (EDIT: Title has now been changed). From the article: > including One Time Passwords (OTP)via SMS phone messages That "SMS" bit is critical. OTP over SMS sucks. OTP using the same app that already manages my passwords (1Password) is a breeze. Sure, if I had a U2F Security Key already plugged in, then it would probably be even faster, but the downside is I need to have a physical key plugged…
There's always going to be a trade off between security, usability, and price. Physical keys are clearly more secure, but also come with increased price and some usability issues (e.g. if you don't have your key you're screwed). But as Google's research demonstrated, there are also usability issues with SMS OTP (3% avg failure rate vs 0% avg failure rate with keys).
Net-net, it depends on how sensitive the data is that your are protecting, and whether you prefer increased security or ease of use.
Re: Google Determines that FIDO U2F Security Keys Improve Security
#6Highly misleading headline (EDIT: Title has now been changed). From the article: > including One Time Passwords (OTP)via SMS phone messages That "SMS" bit is critical. OTP over SMS sucks. OTP using the same app that already manages my passwords (1Password) is a breeze. Sure, if I had a U2F Security Key already plugged in, then it would probably be even faster, but the downside is I need to have a physical key plugged…
There's always going to be a trade off between security, usability, and price. Physical keys are clearly more secure, but also come with increased price and some usability issues (e.g. if you don't have your key you're screwed). But as Google's research demonstrated, there are also usability issues with SMS OTP (3% avg failure rate vs 0% avg failure rate with keys). Net-net, it depends on how sensitive the data is th…
Given that NIST now explicitly says you shouldn't use SMS for 2FA, I'm not sure why we're even trying to compare U2F to SMS OTP. It's just not a useful comparison at all. Any company that is even considering supporting U2F should already be offering non-SMS-based OTP anyway.
Re: Google Determines that FIDO U2F Security Keys Improve Security
#7Highly misleading headline (EDIT: Title has now been changed). From the article: > including One Time Passwords (OTP)via SMS phone messages That "SMS" bit is critical. OTP over SMS sucks. OTP using the same app that already manages my passwords (1Password) is a breeze. Sure, if I had a U2F Security Key already plugged in, then it would probably be even faster, but the downside is I need to have a physical key plugged…
I have a Yubikey Nano in each of my computers, that are registered with everything that supports U2F (currently only Google and Github). I also have a Yubikey Neo that's on my keychain. Between all of these, I never have any U2F problems.
Except my iPhone, which can't get OTP codes over NFC like Android phones can. So actually I have Google Authenticator for TOTP codes.
Re: Google Determines that FIDO U2F Security Keys Improve Security
#8Earlier quoted context omitted.
There's always going to be a trade off between security, usability, and price. Physical keys are clearly more secure, but also come with increased price and some usability issues (e.g. if you don't have your key you're screwed). But as Google's research demonstrated, there are also usability issues with SMS OTP (3% avg failure rate vs 0% avg failure rate with keys). Net-net, it depends on how sensitive the data is th…
Given that NIST now explicitly says you shouldn't use SMS for 2FA, I'm not sure why we're even trying to compare U2F to SMS OTP. It's just not a useful comparison at all. Any company that is even considering supporting U2F should already be offering non-SMS-based OTP anyway.
For the vast majority of users who are not the targets of government attacks, SMS OTP is still a huge win for account security. Alex Stamos put it well:
https://twitter.com/jonoberheide/status/804363754842554375 "Nothing https://twitter.com/alexstamos/status/804367695860744192 "Seems like the right ordering, but when deployment is 98% < 2% < .5% < .01% complaining about SMS security is pretty silly."
Re: Google Determines that FIDO U2F Security Keys Improve Security
#9Highly misleading headline (EDIT: Title has now been changed). From the article: > including One Time Passwords (OTP)via SMS phone messages That "SMS" bit is critical. OTP over SMS sucks. OTP using the same app that already manages my passwords (1Password) is a breeze. Sure, if I had a U2F Security Key already plugged in, then it would probably be even faster, but the downside is I need to have a physical key plugged…
Keeping your password and your OTP generator in 1Password is not TWO-factor-authentication (2FA). Since you only need your master password to get both. https://blog.agilebits.com/2015/01/26/totp-for-1password-use... (See the "Second Factor? No." bit).
In the case where you need true second factor authentication, it needs to be another factor (i.e. device). This is a good place to have a Fido U2F key.
In my experience, it takes about the same amount of time to use the key vs. using the OTP token from 1password (assuming you keep your key on you).
Re: Google Determines that FIDO U2F Security Keys Improve Security
#10Highly misleading headline (EDIT: Title has now been changed). From the article: > including One Time Passwords (OTP)via SMS phone messages That "SMS" bit is critical. OTP over SMS sucks. OTP using the same app that already manages my passwords (1Password) is a breeze. Sure, if I had a U2F Security Key already plugged in, then it would probably be even faster, but the downside is I need to have a physical key plugged…
Keeping your password and your OTP generator in 1Password is not TWO-factor-authentication (2FA). Since you only need your master password to get both. https://blog.agilebits.com/2015/01/26/totp-for-1password-use... (See the "Second Factor? No." bit). In the case where you need true second factor authentication, it needs to be another factor (i.e. device). This is a good place to have a Fido U2F key. In my experience…
With 1password you have to have both the password database (one factor) and the password to unlock it. (another) It's not traditional 2FA but it fits pretty close. (a thing you have and a thing you know)