Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Determines that FIDO U2F Security Keys Improve Security

eweek.com

Post reply on HN
Print view View original

61–69 of 69 posts

Re: Google Determines that FIDO U2F Security Keys Improve Security

#61

Post by jrockway »

late2part wrote: post #16
jrockway wrote: post #7

Earlier quoted context omitted.

I have a Yubikey Nano in each of my computers, that are registered with everything that supports U2F (currently only Google and Github). I also have a Yubikey Neo that's on my keychain. Between all of these, I never have any U2F problems. Except my iPhone, which can't get OTP codes over NFC like Android phones can. So actually I have Google Authenticator for TOTP codes.

You must not be using the new macbooks...

I guess Yubico is working on a Bluetooth-based key for that use case (as well as phones).

https://www.yubico.com/products/yubikey-for-mobile/

But yeah, I use a Surface Pro and a Chromebook Pixel. The Surface is annoying in that it only has one USB port, my Yubikey Nano is actually on the dock and I use the portable key otherwise. The Chromebook Pixel is fine, two USB-C ports, two USB A ports.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#63

Post by chaz6 »

tokenizerrr wrote: post #38
carlosdp wrote: post #35

Yea seems right, U2F keys are very sound security-wise. The biggest challenge I've found is the obvious: ease of use. It can be kinda clunky to need to pull out a key and plug it in to a USB port in order to log in to Github, for example. That said, this is mitigated pretty well usually with the "thumbnail USB" style key (like Yubikey has) where you pretty much keep it plugged in all day and click it when you need to…

The yubikey neo support NFC. Comparison here: https://www.yubico.com/products/yubikey-hardware/ (Edited my comment to correct a mistake)

An alternative to this is http://www.fidesmo.com/ - are there any others?

Re: Google Determines that FIDO U2F Security Keys Improve Security

#64

Post by pfg »

Corrado wrote: post #60

One thing that struck me while reading this announcement is that if Apple had gotten on board with this idea the latest MacBook Pro may have had a better reception. Imagine hardware specifically built into your laptop to facilitate FIDO U2F security keys. Whether that's a device like those offered by YubiKey or an NFC reader, making U2F available and simple to use would be a great thing. Maybe it could even replace G…

I'm holding out hope that they'll add support for U2F/UAF via TouchID once W3C is done with the Web Authentication API[1].

[1]: https://www.w3.org/TR/webauthn/

Re: Google Determines that FIDO U2F Security Keys Improve Security

#66

Post by eridius »

KirinDave wrote: post #56
eridius wrote: post #34

Earlier quoted context omitted.

Partial quoting? I quoted the relevant bit. I may as well accuse you of partial quoting too since you "only" quoted one sentence and not the surrounding sentences. > But the burden is on you to update it make it clear what you're referring to. Not when I can't edit the comment anymore. When I edited my comment to say the title has been changed, the title had just been changed to say "SMS OTP" instead of "OTP", so it…

The primary problems with OTPs include input error and expiration windows. These are not fixed by making them push notifications. Further, there are many platforms where push is not an option or were SMS vs Push would not make a difference. So no. Absolutely not. SMS is an additional problem, but OTPs in general suffer from logistic issues separate from their medium.

TOTP doesn't use Push.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#67

Post by duaneb »

manicdee wrote: post #57
duaneb wrote: post #25

Earlier quoted context omitted.

If all the factors are on the same box, it's just one factor.

The main concern for people using TOTP from a password vault is attacks against the websites they are visiting, not compromise of their password vault. So no, the two factors are not on the same box being attacked, in the threat modes of interest. For the threat of "my stuff was stolen" then both factors are in the same box, so even having a separate piece of hardware is no use (unless you can convince the thief to n…

> The main concern for people using TOTP from a password vault is attacks against the websites they are visiting, not compromise of their password vault.

Well, if they gain access to your machine, they can't access your iphone. Or yubikey. Just don't kid yourself—you use the same password for everything, and that's your only factor.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#68

Post by fulafel »

nickik wrote: post #48
spqr0a1 wrote: post #3

The comparison is to "One Time Passwords (OTP)via SMS phone messages." Given the vulnerabilities in GSM, that's not a high bar. http://security.stackexchange.com/questions/11493/

The even more relevant comparison is to TOTP. Many places support 2Fa over TOTP, far viewer support 2Fa over U2F. The big problem with TOTP is that real time attacks can still get you when you get MITM. Edit: I now understand you were talking about the article, not the technology itself

Also totp hardware tokens suck (get out of sync) and totp smartphone apps suck because Android phones are so insecure/malware ridden.

Re: Google Determines that FIDO U2F Security Keys Improve Security

#69

Post by KirinDave »

eridius wrote: post #66
KirinDave wrote: post #56

Earlier quoted context omitted.

The primary problems with OTPs include input error and expiration windows. These are not fixed by making them push notifications. Further, there are many platforms where push is not an option or were SMS vs Push would not make a difference. So no. Absolutely not. SMS is an additional problem, but OTPs in general suffer from logistic issues separate from their medium.

TOTP doesn't use Push.

The medium of delivery is not the problem here. In fact, most stuff I've read suggests TOTP had an even higher fail rate than push or SMS OTP.
Post reply on HN