Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Determines that FIDO U2F Security Keys Improve Security

eweek.com

Post reply on HN
Print view View original

31–40 of 69 posts

Re: Google Determines that FIDO U2F Security Keys Improve Security

#31

Post by carlosdp »

eridius wrote: post #17
redbeard0x0a wrote: post #9

Earlier quoted context omitted.

Keeping your password and your OTP generator in 1Password is not TWO-factor-authentication (2FA). Since you only need your master password to get both. https://blog.agilebits.com/2015/01/26/totp-for-1password-use... (See the "Second Factor? No." bit). In the case where you need true second factor authentication, it needs to be another factor (i.e. device). This is a good place to have a Fido U2F key. In my experience…

You also need to have the password database. Having the master password alone is not sufficient, and having the password database is not sufficient. And of course the master password never gets transmitted over the network, so it's harder to get. If your threat model is an attacker that's compromised your specific computer (as opposed to a network attacker) then yeah, having the OTP code in your password manager isn'…

No, it by absolutely no means whatsoever is 2FA, no matter how you slice it.

Regardless of where your password database is, the attacker only needs to compromise 1 password on the website to access your account. It doesn't matter how they got that password, your physical devices are irrelevant.

With 2FA, the attacker would also need access to the secondary device that has the secondary authentication, whether that be a phone, RSA key, FIDO key, etc.

1Password is not "real" or "fake" 2FA, it's straight up not 2FA at all and doesn't claim to be. It's fine to not want 2FA if you don't handle high-risk data (though that's increasingly rare these days in reality), but lets not conflate the term =P

Re: Google Determines that FIDO U2F Security Keys Improve Security

#32

Post by r00fus »

late2part wrote: post #16
jrockway wrote: post #7

Earlier quoted context omitted.

I have a Yubikey Nano in each of my computers, that are registered with everything that supports U2F (currently only Google and Github). I also have a Yubikey Neo that's on my keychain. Between all of these, I never have any U2F problems. Except my iPhone, which can't get OTP codes over NFC like Android phones can. So actually I have Google Authenticator for TOTP codes.

You must not be using the new macbooks...

What's preventing USB-C Yubikeys? So you need an adapter right now...

Re: Google Determines that FIDO U2F Security Keys Improve Security

#34

Post by eridius »

KirinDave wrote: post #30
eridius wrote: post #29

Earlier quoted context omitted.

I did read the article, and if you have to say "no offense", then it's because you're giving offense. The bit you quoted is literally what I quoted, just with more (irrelevant) words quoted at the beginning, so I don't know why you're even accusing me of misquoting anything. The real problem here is the fact that the title of this post was edited multiple times, and now bears very little resemblance to what my commen…

Partial quoting an article to the go on to disagree with the core premise and good security will net you no sympathy from me. But the burden is on you to update it make it clear what you're referring to. If you think that this is truly unfair then I apologize for only reading your post and the linked article and not the entire historical context. But I think even without that, you went on to make a point counter the…

Partial quoting? I quoted the relevant bit. I may as well accuse you of partial quoting too since you "only" quoted one sentence and not the surrounding sentences.

> But the burden is on you to update it make it clear what you're referring to.

Not when I can't edit the comment anymore. When I edited my comment to say the title has been changed, the title had just been changed to say "SMS OTP" instead of "OTP", so it was still (I thought) clear what my comment was about. By the time I saw the post had had its more dramatic title change, my comment was past the edit period.

And yes, I do think it's unfair that you're accusing me of misquoting and writing an incorrect comment, when my comment was perfectly correct when written, and when it's impossible for me to "fix" it later (not to mention I didn't even know the title had been edited again until I saw your comment).

> But I think even without that, you went on to make a point counter the article using article text as if it was a valid counterpoint is wrong.

I did not use the article text as if it was a counterpoint. I used the article text to illustrate that the article was talking specifically about SMS OTP, and that the article did not even attempt to address non-SMS-based TOTP. And then gave my own opinion, which is that non-SMS-based TOTP is much better than SMS OTP and has some benefits as compared to a physical U2F device. Since the article didn't even address non-SMS-based TOTP, it can't be a point either for or against that opinion, but what it could be was context.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#35

Post by carlosdp »

Yea seems right, U2F keys are very sound security-wise. The biggest challenge I've found is the obvious: ease of use. It can be kinda clunky to need to pull out a key and plug it in to a USB port in order to log in to Github, for example.

That said, this is mitigated pretty well usually with the "thumbnail USB" style key (like Yubikey has) where you pretty much keep it plugged in all day and click it when you need to access something. Security is still maintained as we're mostly concerned about remote attackers, though still a good idea to pull the key out at the end of the day or if leaving the laptop for a considerable amount of time.

Physical ease of use will definitely be the trick for mass adoption. I recall seeing wireless U2F keys at some point?

Re: Google Determines that FIDO U2F Security Keys Improve Security

#37

Post by willow9886 »

macrael wrote: post #33

So is Yubikey and implementation of this standard or a competitor?

Yubikey implements the FIDO open authentication standard. Yubico, the vendor that produces the Yubikey, is a co-author of the standard.

Read this for some background.[1]

[1] https://www.yubico.com/about/background/fido/

Re: Google Determines that FIDO U2F Security Keys Improve Security

#38

Post by tokenizerrr »

carlosdp wrote: post #35

Yea seems right, U2F keys are very sound security-wise. The biggest challenge I've found is the obvious: ease of use. It can be kinda clunky to need to pull out a key and plug it in to a USB port in order to log in to Github, for example. That said, this is mitigated pretty well usually with the "thumbnail USB" style key (like Yubikey has) where you pretty much keep it plugged in all day and click it when you need to…

The yubikey neo support NFC. Comparison here: https://www.yubico.com/products/yubikey-hardware/

(Edited my comment to correct a mistake)

Re: Google Determines that FIDO U2F Security Keys Improve Security

#39

Post by vitus »

r00fus wrote: post #32
late2part wrote: post #16

Earlier quoted context omitted.

You must not be using the new macbooks...

What's preventing USB-C Yubikeys? So you need an adapter right now...

Apparently, lack of market demand [0].

As for adapters: they significantly increase the profile of the yubikey nano, which I feel is a dealbreaker in that particular case, as the main selling point of the nano (to me, at least) is the always-plugged-in capability (see the image on the far right in [1]).

[0] https://www.yubico.com/2016/07/yubikey-route-usb-c/

[1] https://www.yubico.com/products/yubikey-hardware/yubikey4/

Re: Google Determines that FIDO U2F Security Keys Improve Security

#40

Post by mikecb »

duaneb wrote: post #27
mikecb wrote: post #18

Earlier quoted context omitted.

Phishing is a top threat to users and enterprises both. OTPs, whether from SMS or not, can be easily phished as well as passwords, while U2F cannot. So the answer seems fairly clear.

OTPs must be phished and then used very rapidly. The ROI for a successful phishing is much lower: a database of old OTPs is much less useful. (I'm sure you could use that to break the secret, but it's definitely not storing the secret.)

True, but not difficult.
Post reply on HN