Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Determines that FIDO U2F Security Keys Improve Security

eweek.com

Post reply on HN
Print view View original

11–20 of 69 posts

Re: Google Determines that FIDO U2F Security Keys Improve Security

#11

Post by hamandcheese »

redbeard0x0a wrote: post #9
eridius wrote: post #2

Highly misleading headline (EDIT: Title has now been changed). From the article: > including One Time Passwords (OTP)via SMS phone messages That "SMS" bit is critical. OTP over SMS sucks. OTP using the same app that already manages my passwords (1Password) is a breeze. Sure, if I had a U2F Security Key already plugged in, then it would probably be even faster, but the downside is I need to have a physical key plugged…

Keeping your password and your OTP generator in 1Password is not TWO-factor-authentication (2FA). Since you only need your master password to get both. https://blog.agilebits.com/2015/01/26/totp-for-1password-use... (See the "Second Factor? No." bit). In the case where you need true second factor authentication, it needs to be another factor (i.e. device). This is a good place to have a Fido U2F key. In my experience…

Even so, there are other benefits, such as your TOTP key never being sent over the network (unlike your generated password).

Re: Google Determines that FIDO U2F Security Keys Improve Security

#12

Post by sctb »

willow9886 wrote: post #4

Updated the title to specify SMS OTP.

We reverted the title from “Google: FIDO keys more secure, easier to use, and more affordable than SMS OTP” to that of the article, since it appears to be neither misleading nor clickbait.

https://news.ycombinator.com/newsguidelines.html

Re: Google Determines that FIDO U2F Security Keys Improve Security

#13

Post by darpa_escapee »

arkadiyt wrote: post #8
eridius wrote: post #6

Earlier quoted context omitted.

Given that NIST now explicitly says you shouldn't use SMS for 2FA, I'm not sure why we're even trying to compare U2F to SMS OTP. It's just not a useful comparison at all. Any company that is even considering supporting U2F should already be offering non-SMS-based OTP anyway.

For the vast majority of users who are not the targets of government attacks, SMS OTP is still a huge win for account security. Alex Stamos put it well: https://twitter.com/jonoberheide/status/804363754842554375 "Nothing https://twitter.com/alexstamos/status/804367695860744192 "Seems like the right ordering, but when deployment is 98% < 2% < .5% < .01% complaining about SMS security is pretty silly."

State actors aren't the only ones threatening the security of SMS OTP.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#14

Post by willow9886 »

sctb wrote: post #12
willow9886 wrote: post #4

Updated the title to specify SMS OTP.

We reverted the title from “Google: FIDO keys more secure, easier to use, and more affordable than SMS OTP” to that of the article, since it appears to be neither misleading nor clickbait. https://news.ycombinator.com/newsguidelines.html

I don't totally agree with this title change. Of course FIDO security keys improve security. What is interesting about this article and the research conducted is the comparative effectiveness of FIDO keys versus the much more widely deployed mechanism of SMS OTP.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#15

Post by agwa »

arkadiyt wrote: post #8
eridius wrote: post #6

Earlier quoted context omitted.

Given that NIST now explicitly says you shouldn't use SMS for 2FA, I'm not sure why we're even trying to compare U2F to SMS OTP. It's just not a useful comparison at all. Any company that is even considering supporting U2F should already be offering non-SMS-based OTP anyway.

For the vast majority of users who are not the targets of government attacks, SMS OTP is still a huge win for account security. Alex Stamos put it well: https://twitter.com/jonoberheide/status/804363754842554375 "Nothing https://twitter.com/alexstamos/status/804367695860744192 "Seems like the right ordering, but when deployment is 98% < 2% < .5% < .01% complaining about SMS security is pretty silly."

SMS-based 2FA doesn't stop phishing, which is a significant security benefit of U2F.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#16

Post by late2part »

jrockway wrote: post #7
eridius wrote: post #2

Highly misleading headline (EDIT: Title has now been changed). From the article: > including One Time Passwords (OTP)via SMS phone messages That "SMS" bit is critical. OTP over SMS sucks. OTP using the same app that already manages my passwords (1Password) is a breeze. Sure, if I had a U2F Security Key already plugged in, then it would probably be even faster, but the downside is I need to have a physical key plugged…

I have a Yubikey Nano in each of my computers, that are registered with everything that supports U2F (currently only Google and Github). I also have a Yubikey Neo that's on my keychain. Between all of these, I never have any U2F problems. Except my iPhone, which can't get OTP codes over NFC like Android phones can. So actually I have Google Authenticator for TOTP codes.

You must not be using the new macbooks...

Re: Google Determines that FIDO U2F Security Keys Improve Security

#17

Post by eridius »

redbeard0x0a wrote: post #9
eridius wrote: post #2

Highly misleading headline (EDIT: Title has now been changed). From the article: > including One Time Passwords (OTP)via SMS phone messages That "SMS" bit is critical. OTP over SMS sucks. OTP using the same app that already manages my passwords (1Password) is a breeze. Sure, if I had a U2F Security Key already plugged in, then it would probably be even faster, but the downside is I need to have a physical key plugged…

Keeping your password and your OTP generator in 1Password is not TWO-factor-authentication (2FA). Since you only need your master password to get both. https://blog.agilebits.com/2015/01/26/totp-for-1password-use... (See the "Second Factor? No." bit). In the case where you need true second factor authentication, it needs to be another factor (i.e. device). This is a good place to have a Fido U2F key. In my experience…

You also need to have the password database. Having the master password alone is not sufficient, and having the password database is not sufficient. And of course the master password never gets transmitted over the network, so it's harder to get. If your threat model is an attacker that's compromised your specific computer (as opposed to a network attacker) then yeah, having the OTP code in your password manager isn't 2FA. But if your threat model is a networked attacker, or alternatively, is the remote site being compromised and your password leaked, then having OTP in your password manager is effectively 2FA because the attacker doesn't have either your password database (a thing you have) or your master password (a thing you know), they just have your site password.

So really it comes down to what your threat model is and what risk profile you're willing to accept for a given site. For me, all I really care about is TOTP and not having "real" 2FA. But of course if you're talking about something like an AWS account that controls access to your company's data, it's probably worth investing in a YubiKey or similar.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#18

Post by mikecb »

eridius wrote: post #2

Highly misleading headline (EDIT: Title has now been changed). From the article: > including One Time Passwords (OTP)via SMS phone messages That "SMS" bit is critical. OTP over SMS sucks. OTP using the same app that already manages my passwords (1Password) is a breeze. Sure, if I had a U2F Security Key already plugged in, then it would probably be even faster, but the downside is I need to have a physical key plugged…

Phishing is a top threat to users and enterprises both. OTPs, whether from SMS or not, can be easily phished as well as passwords, while U2F cannot. So the answer seems fairly clear.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#19

Post by matt_wulfeck »

mnutt wrote: post #10
redbeard0x0a wrote: post #9

Earlier quoted context omitted.

Keeping your password and your OTP generator in 1Password is not TWO-factor-authentication (2FA). Since you only need your master password to get both. https://blog.agilebits.com/2015/01/26/totp-for-1password-use... (See the "Second Factor? No." bit). In the case where you need true second factor authentication, it needs to be another factor (i.e. device). This is a good place to have a Fido U2F key. In my experience…

With 1password you have to have both the password database (one factor) and the password to unlock it. (another) It's not traditional 2FA but it fits pretty close. (a thing you have and a thing you know)

Let's call it 1.5 factor auth.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#20

Post by KirinDave »

eridius wrote: post #2

Highly misleading headline (EDIT: Title has now been changed). From the article: > including One Time Passwords (OTP)via SMS phone messages That "SMS" bit is critical. OTP over SMS sucks. OTP using the same app that already manages my passwords (1Password) is a breeze. Sure, if I had a U2F Security Key already plugged in, then it would probably be even faster, but the downside is I need to have a physical key plugged…

No offense, but uh... please read the article?

You quoted: including One Time Passwords (OTP)via SMS phone messages

The sentence that phrase is lifted from: U2F is an alternative to other forms of two factor authentication (2FA) including One Time Passwords (OTP)via SMS phone messages.

So you either deliberately or carelessly misquoted. What's more, I quote:

> Additionally, Google's research found that with OTP based authentication there was an average failure rate of three percent. In contrast, with the U2F Security Key approach, Google experienced zero authentication failures. The improved efficiency of using Security Keys instead of OTP is estimated by Google's support organization to have saved the company thousands of hours per year.

And further:

> "While any 2-SV mechanism is better than having only a password on your account, FIDO U2F provides strong authentication that's resistant to many forms of advanced phishing attacks that traditional 2-SV doesn't protect against," Brand said. "It also provides for a much better user experience."

So no. The headline is not misleading and in fact your hot take and comparison to 1Pass is a misunderstanding.

For people curious what these keys look like in the wild, by far the most famous brand name most people in our space would see is Yubico, which you can see here: https://www.yubico.com/products/yubikey-hardware/fido-u2f-se...

You _can_ integrate this approach into your product, into your AWS environment, into your Azure environment, or into your linux servers. And it works, and it can be self-hosted if that is a priority for you.

Oh, and if you'd like to try the best of ALL THREE WORLDs, LastPass directly supports Yubikey FIDO keys. And also lacks 30s of impromptu vault animations and supports touchid. They're working on facial recognition for Windows as a 3rd factor as well, I'm told. That'll be great.

Post reply on HN