Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Determines that FIDO U2F Security Keys Improve Security

eweek.com

Post reply on HN
Print view View original

21–30 of 69 posts

Re: Google Determines that FIDO U2F Security Keys Improve Security

#21

Post by willow9886 »

eridius wrote: post #6
willow9886 wrote: post #5

Earlier quoted context omitted.

There's always going to be a trade off between security, usability, and price. Physical keys are clearly more secure, but also come with increased price and some usability issues (e.g. if you don't have your key you're screwed). But as Google's research demonstrated, there are also usability issues with SMS OTP (3% avg failure rate vs 0% avg failure rate with keys). Net-net, it depends on how sensitive the data is th…

Given that NIST now explicitly says you shouldn't use SMS for 2FA, I'm not sure why we're even trying to compare U2F to SMS OTP. It's just not a useful comparison at all. Any company that is even considering supporting U2F should already be offering non-SMS-based OTP anyway.

OK...but Google and my bank still use OTP over SMS to two-factor authenticate me. So clearly there's room for discussion and evangelism here. NIST can say that pigs fly, but until I see it in the wild I'm going to take it with a grain of salt.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#22

Post by seanp2k2 »

eridius wrote: post #17
redbeard0x0a wrote: post #9

Earlier quoted context omitted.

Keeping your password and your OTP generator in 1Password is not TWO-factor-authentication (2FA). Since you only need your master password to get both. https://blog.agilebits.com/2015/01/26/totp-for-1password-use... (See the "Second Factor? No." bit). In the case where you need true second factor authentication, it needs to be another factor (i.e. device). This is a good place to have a Fido U2F key. In my experience…

You also need to have the password database. Having the master password alone is not sufficient, and having the password database is not sufficient. And of course the master password never gets transmitted over the network, so it's harder to get. If your threat model is an attacker that's compromised your specific computer (as opposed to a network attacker) then yeah, having the OTP code in your password manager isn'…

Or even better: google accounts with the Google Authenticator on your phone, then require a Duo push auth. ML with some hard rules for when to require a second or third factor, like "always" when it's an admin account.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#23

Post by spankalee »

willow9886 wrote: post #14
sctb wrote: post #12

Earlier quoted context omitted.

We reverted the title from “Google: FIDO keys more secure, easier to use, and more affordable than SMS OTP” to that of the article, since it appears to be neither misleading nor clickbait. https://news.ycombinator.com/newsguidelines.html

I don't totally agree with this title change. Of course FIDO security keys improve security. What is interesting about this article and the research conducted is the comparative effectiveness of FIDO keys versus the much more widely deployed mechanism of SMS OTP.

It only says "including" SMS OTP. If the study is based on Google internal use, it probably also includes Google's OTP app.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#25

Post by duaneb »

eridius wrote: post #17
redbeard0x0a wrote: post #9

Earlier quoted context omitted.

Keeping your password and your OTP generator in 1Password is not TWO-factor-authentication (2FA). Since you only need your master password to get both. https://blog.agilebits.com/2015/01/26/totp-for-1password-use... (See the "Second Factor? No." bit). In the case where you need true second factor authentication, it needs to be another factor (i.e. device). This is a good place to have a Fido U2F key. In my experience…

You also need to have the password database. Having the master password alone is not sufficient, and having the password database is not sufficient. And of course the master password never gets transmitted over the network, so it's harder to get. If your threat model is an attacker that's compromised your specific computer (as opposed to a network attacker) then yeah, having the OTP code in your password manager isn'…

If all the factors are on the same box, it's just one factor.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#26

Post by seanp2k2 »

arkadiyt wrote: post #8
eridius wrote: post #6

Earlier quoted context omitted.

Given that NIST now explicitly says you shouldn't use SMS for 2FA, I'm not sure why we're even trying to compare U2F to SMS OTP. It's just not a useful comparison at all. Any company that is even considering supporting U2F should already be offering non-SMS-based OTP anyway.

For the vast majority of users who are not the targets of government attacks, SMS OTP is still a huge win for account security. Alex Stamos put it well: https://twitter.com/jonoberheide/status/804363754842554375 "Nothing https://twitter.com/alexstamos/status/804367695860744192 "Seems like the right ordering, but when deployment is 98% < 2% < .5% < .01% complaining about SMS security is pretty silly."

The security of these is actually somewhat DUE TO the low adoption rates. If all of my consumer services have SMS 2FA, attackers will currently just move on to the next account in their list. It's similar to the spam game: it doesn't have to be perfect, just enough to make it not economically viable to spend the time required to crack it. Once everyone has SMS 2FA, I'll move on to push or U2F and be ahead for another decade or so. It's just important that people are given an option, so lazy / don't know any better consumers can do the easy thing and get their accounts stolen, while people who actually care / know enough to know they should care can stay somewhat safer. The unbalance is unfortunate, but until we figure out a way to ACTUALLY secure things which companies will get onboard with (related: the US uses chip cards now...but still only requires a signature facepalm) staying one or two steps ahead of the general population makes you pretty safe against everything except targeted attacks.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#27

Post by duaneb »

mikecb wrote: post #18
eridius wrote: post #2

Highly misleading headline (EDIT: Title has now been changed). From the article: > including One Time Passwords (OTP)via SMS phone messages That "SMS" bit is critical. OTP over SMS sucks. OTP using the same app that already manages my passwords (1Password) is a breeze. Sure, if I had a U2F Security Key already plugged in, then it would probably be even faster, but the downside is I need to have a physical key plugged…

Phishing is a top threat to users and enterprises both. OTPs, whether from SMS or not, can be easily phished as well as passwords, while U2F cannot. So the answer seems fairly clear.

OTPs must be phished and then used very rapidly. The ROI for a successful phishing is much lower: a database of old OTPs is much less useful. (I'm sure you could use that to break the secret, but it's definitely not storing the secret.)

Re: Google Determines that FIDO U2F Security Keys Improve Security

#28

Post by seanp2k2 »

willow9886 wrote: post #21
eridius wrote: post #6

Earlier quoted context omitted.

Given that NIST now explicitly says you shouldn't use SMS for 2FA, I'm not sure why we're even trying to compare U2F to SMS OTP. It's just not a useful comparison at all. Any company that is even considering supporting U2F should already be offering non-SMS-based OTP anyway.

OK...but Google and my bank still use OTP over SMS to two-factor authenticate me. So clearly there's room for discussion and evangelism here. NIST can say that pigs fly, but until I see it in the wild I'm going to take it with a grain of salt.

Just so you know, you can also use Google Authenticator if you really dislike SMS. Make sure to back up those emergency keys though, and read about encrypting your iTunes backups so it'll actually back up the GA settings.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#29

Post by eridius »

KirinDave wrote: post #20
eridius wrote: post #2

Highly misleading headline (EDIT: Title has now been changed). From the article: > including One Time Passwords (OTP)via SMS phone messages That "SMS" bit is critical. OTP over SMS sucks. OTP using the same app that already manages my passwords (1Password) is a breeze. Sure, if I had a U2F Security Key already plugged in, then it would probably be even faster, but the downside is I need to have a physical key plugged…

No offense, but uh... please read the article? You quoted: including One Time Passwords (OTP)via SMS phone messages The sentence that phrase is lifted from: U2F is an alternative to other forms of two factor authentication (2FA) including One Time Passwords (OTP)via SMS phone messages. So you either deliberately or carelessly misquoted. What's more, I quote: > Additionally, Google's research found that with OTP based…

I did read the article, and if you have to say "no offense", then it's because you're giving offense. The bit you quoted is literally what I quoted, just with more (irrelevant) words quoted at the beginning, so I don't know why you're even accusing me of misquoting anything.

The real problem here is the fact that the title of this post was edited multiple times, and now bears very little resemblance to what my comment was responding to. The original title alleged that Google said FIDO U2F Security Keys were better than OTP, without any mention of the fact that the article was only comparing it to SMS-based OTP and therefore the headline was inaccurate because OTP does not mean SMS-based OTP, and I expect (well, I hope) that most commenters here don't even use SMS OTP but instead use TOTP with an app.

In any case, I did edit my comment to mention that the title has changed, so the fact that you're saying I'm wrong immediately after accusing me of not reading something is pretty hypocritical.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#30

Post by KirinDave »

eridius wrote: post #29
KirinDave wrote: post #20

Earlier quoted context omitted.

No offense, but uh... please read the article? You quoted: including One Time Passwords (OTP)via SMS phone messages The sentence that phrase is lifted from: U2F is an alternative to other forms of two factor authentication (2FA) including One Time Passwords (OTP)via SMS phone messages. So you either deliberately or carelessly misquoted. What's more, I quote: > Additionally, Google's research found that with OTP based…

I did read the article, and if you have to say "no offense", then it's because you're giving offense. The bit you quoted is literally what I quoted, just with more (irrelevant) words quoted at the beginning, so I don't know why you're even accusing me of misquoting anything. The real problem here is the fact that the title of this post was edited multiple times, and now bears very little resemblance to what my commen…

Partial quoting an article to the go on to disagree with the core premise and good security will net you no sympathy from me.

But the burden is on you to update it make it clear what you're referring to. If you think that this is truly unfair then I apologize for only reading your post and the linked article and not the entire historical context.

But I think even without that, you went on to make a point counter the article using article text as if it was a valid counterpoint is wrong.

Post reply on HN