Earlier quoted context omitted.
You must not be using the new macbooks...
What's preventing USB-C Yubikeys? So you need an adapter right now...
The Yubikey nano is ridiculous with an adapter.
Google Determines that FIDO U2F Security Keys Improve Security
41–50 of 69 posts
Re: Google Determines that FIDO U2F Security Keys Improve Security
#42It would be nice if Google helped to fix the bug which causes Chromium to crash on *BSD when presented with a U2F auth req.
(https://bugs.chromium.org/p/chromium/issues/detail?id=451248)
Ever since adopting a security key, I've had to set my user-agent to Firefox (to prevent the U2F auth attempt) and fall back to Google Authenticator for 2FA.
Re: Google Determines that FIDO U2F Security Keys Improve Security
#43Earlier quoted context omitted.
Phishing is a top threat to users and enterprises both. OTPs, whether from SMS or not, can be easily phished as well as passwords, while U2F cannot. So the answer seems fairly clear.
OTPs must be phished and then used very rapidly. The ROI for a successful phishing is much lower: a database of old OTPs is much less useful. (I'm sure you could use that to break the secret, but it's definitely not storing the secret.)
Only if you are using TOTP. If you're configured to use HOTP, then that phished credential is much more valuable.
Re: Google Determines that FIDO U2F Security Keys Improve Security
#44Earlier quoted context omitted.
You also need to have the password database. Having the master password alone is not sufficient, and having the password database is not sufficient. And of course the master password never gets transmitted over the network, so it's harder to get. If your threat model is an attacker that's compromised your specific computer (as opposed to a network attacker) then yeah, having the OTP code in your password manager isn'…
No, it by absolutely no means whatsoever is 2FA, no matter how you slice it. Regardless of where your password database is, the attacker only needs to compromise 1 password on the website to access your account. It doesn't matter how they got that password, your physical devices are irrelevant. With 2FA, the attacker would also need access to the secondary device that has the secondary authentication, whether that be…
> Regardless of where your password database is, the attacker only needs to compromise 1 password on the website to access your account.
What are you talking about? The whole point of TOTP is if the attacker compromises your password, they still can't log in because they don't have the TOTP code.
Re: Google Determines that FIDO U2F Security Keys Improve Security
#45Yea seems right, U2F keys are very sound security-wise. The biggest challenge I've found is the obvious: ease of use. It can be kinda clunky to need to pull out a key and plug it in to a USB port in order to log in to Github, for example. That said, this is mitigated pretty well usually with the "thumbnail USB" style key (like Yubikey has) where you pretty much keep it plugged in all day and click it when you need to…
The yubikey neo support NFC. Comparison here: https://www.yubico.com/products/yubikey-hardware/ (Edited my comment to correct a mistake)
Most yubikeys = only the Neo
Re: Google Determines that FIDO U2F Security Keys Improve Security
#46Yea seems right, U2F keys are very sound security-wise. The biggest challenge I've found is the obvious: ease of use. It can be kinda clunky to need to pull out a key and plug it in to a USB port in order to log in to Github, for example. That said, this is mitigated pretty well usually with the "thumbnail USB" style key (like Yubikey has) where you pretty much keep it plugged in all day and click it when you need to…
The yubikey neo support NFC. Comparison here: https://www.yubico.com/products/yubikey-hardware/ (Edited my comment to correct a mistake)
The only one that supports it appears to be an outdated model that isn't undergoing the latest certifications and lacks other features (like ECC p384)
Re: Google Determines that FIDO U2F Security Keys Improve Security
#47How can I use U2F for Windows sign-on? Windows 10 "Hello" stuff is apparently in the pipeline, but I need U2F domain authentication for Windows 7+.
Also curious if I can use a U2F for anything PGP-related, signing or encrypting regular stuff.
All this to save $20/piece!
Re: Google Determines that FIDO U2F Security Keys Improve Security
#48The comparison is to "One Time Passwords (OTP)via SMS phone messages." Given the vulnerabilities in GSM, that's not a high bar. http://security.stackexchange.com/questions/11493/
The even more relevant comparison is to TOTP. Many places support 2Fa over TOTP, far viewer support 2Fa over U2F.
The big problem with TOTP is that real time attacks can still get you when you get MITM.
Edit: I now understand you were talking about the article, not the technology itself
Re: Google Determines that FIDO U2F Security Keys Improve Security
#49So is Yubikey and implementation of this standard or a competitor?
Yubikeys support all the different standards. Together with the Yubico Authenticator App you can use TOTP, to replace your Google Authenticator. It supports HOTP but that is used less often. Yubico itself defined a something new that is just a addition to HOTP (HOTP + Identity) and some services implement this (for example, LastPass Password Manager).
In some ways they are in technical competition but the company is making money regardless because they just implement both.
Re: Google Determines that FIDO U2F Security Keys Improve Security
#50Earlier quoted context omitted.
The yubikey neo support NFC. Comparison here: https://www.yubico.com/products/yubikey-hardware/ (Edited my comment to correct a mistake)
The only one that supports it appears to be an outdated model that isn't undergoing the latest certifications and lacks other features (like ECC p384)
I was really disappointed when Yubikey 4 came out but did not have NFC. I really want to have a RSA 4096/ECC p384 smartcard with NFC and I really wanted to be able to do U2F over NFC.
I have some hope that a product like that is coming, I just don't know when.