Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Key for safer logins with a touch

facebook.com

Post reply on HN
Print view View original

11–20 of 105 posts

Re: Security Key for safer logins with a touch

#11

Post by hdhzy »

DINKDINK wrote: post #8

Happy to see Facebook finally supporting U2F but haven't assessed how robust their implementation is. Another U2F hardware key is the Trezor bitcoin hardware wallet ( https://blog.trezor.io/secure-two-factor-authentication-with... ) which has the added benefit that you can backup all your U2F private keys. I'm not aware of how you could do this with a Yubico U2F key -- if someone knows, please enlighten me.

W.r.t yubico u2f you don't backup it you just register to or more tokens that work as backup keys.

Re: Security Key for safer logins with a touch

#12

Post by james_pm »

mtgx wrote: post #3

Does it rely on SMS as backup, though?

I had SMS as my backup and in testing this morning, FB sends the SMS by default, even before you either tap the key or say you want to use another method (like SMS).

That's a big flaw to me. It should only send the SMS if I specifically say, "Use my backup SMS method". I switched to use an authenticator app instead as a result.

Re: Security Key for safer logins with a touch

#13

Post by artursapek »

grandsham wrote: post #10

I am slightly disappointed that this doesn't work in Firefox, despite the fact that I have an add-on[1] installed to add U2F support. Github for instance is able to detect U2F support and let me use it. That said, I understand the lack of support since I am an extremely small niche, and this did prompt me to finally add 2FA to facebook (U2F and code generation from my Yubikey Neo) [1] https://addons.mozilla.org/en-US…

I don't understand how it has taken them so long to add it natively... they just shipped FLAC audio support but still don't care about U2F?

Re: Security Key for safer logins with a touch

#14

Post by tetrep »

pacaro wrote: post #2

This is great forward progress, I much prefer U2F where available. I hadn't even realized that FB supported 2fa, so I just tried to set it up on my iPhone, and either automatically or manually cannot get a test code to work. This tends to reduce my confidence in any other aspect of their implementation

counter-anecdote: I've had zero issues with FB 2FA and I'm pretty sure many, if not all (I would hope it's an internal policy, but idk...) FB employees have it enabled, so it'd be pretty difficult for them to not notice serious issues with the use of their implementation (as your post suggests exist).

Re: Security Key for safer logins with a touch

#15

Post by pacaro »

_joel wrote: post #4
pacaro wrote: post #2

This is great forward progress, I much prefer U2F where available. I hadn't even realized that FB supported 2fa, so I just tried to set it up on my iPhone, and either automatically or manually cannot get a test code to work. This tends to reduce my confidence in any other aspect of their implementation

The 2FA code generation has always worked perfectly for me for the past year (or two?) that I've had it enabled

I have to admit to being quite startled. But I just get "Security code was invalid. Please try again". I've tried again several times. I'll see if setting it up on the website works.

Re: Security Key for safer logins with a touch

#16

Post by tyingq »

mtgx wrote: post #6
tyingq wrote: post #5

Earlier quoted context omitted.

It looks like it gives you a choice: "Security keys for Facebook logins currently only work with certain web browsers and mobile devices, so we'll ask you to also register an additional login approval method, such as your mobile phone or Code Generator"

That looks like a requirement, not a choice. So as usual, the U2F standard being adopted by companies these days is only as strong as SMS 2FA, because of this requirement. Can someone tell me what's the point then? Is it that they hope that in the end U2F will get popular enough that they'll remove that requirement? I would hope that's it. Otherwise, I don't see the point. I wish they at least allowed you to opt-out…

>That looks like a requirement, not a choice.

A requirement to have one backup, which doesn't have to be SMS. It appears to allow a manually pregenerated list of codes, for example. See the ui: https://scontent-dft4-1.xx.fbcdn.net/v/t31.0-8/p720x720/1617...

Re: Security Key for safer logins with a touch

#17

Post by [deleted] »

artursapek wrote: post #13
grandsham wrote: post #10

I am slightly disappointed that this doesn't work in Firefox, despite the fact that I have an add-on[1] installed to add U2F support. Github for instance is able to detect U2F support and let me use it. That said, I understand the lack of support since I am an extremely small niche, and this did prompt me to finally add 2FA to facebook (U2F and code generation from my Yubikey Neo) [1] https://addons.mozilla.org/en-US…

I don't understand how it has taken them so long to add it natively... they just shipped FLAC audio support but still don't care about U2F?

[deleted]

Re: Security Key for safer logins with a touch

#18

Post by cesarb »

Last time I looked at Facebook 2FA, it didn't allow you to enable it unless you had a browser with old enough cookies from Facebook, which is not possible if you configure your browser to clear all cookies on exit (and close the whole browser at least once a day). Is that still the case?

Re: Security Key for safer logins with a touch

#19

Post by lisper »

DINKDINK wrote: post #8

Happy to see Facebook finally supporting U2F but haven't assessed how robust their implementation is. Another U2F hardware key is the Trezor bitcoin hardware wallet ( https://blog.trezor.io/secure-two-factor-authentication-with... ) which has the added benefit that you can backup all your U2F private keys. I'm not aware of how you could do this with a Yubico U2F key -- if someone knows, please enlighten me.

If you are concerned about the implementation, here is a security token you can flash yourself:

https://sc4.us/hsm/index.html

(Full disclosure: this is my company.)

Re: Security Key for safer logins with a touch

#20

Post by callahad »

artursapek wrote: post #13
grandsham wrote: post #10

I am slightly disappointed that this doesn't work in Firefox, despite the fact that I have an add-on[1] installed to add U2F support. Github for instance is able to detect U2F support and let me use it. That said, I understand the lack of support since I am an extremely small niche, and this did prompt me to finally add 2FA to facebook (U2F and code generation from my Yubikey Neo) [1] https://addons.mozilla.org/en-US…

I don't understand how it has taken them so long to add it natively... they just shipped FLAC audio support but still don't care about U2F?

Barring unforeseen complications, U2F support should land in stable Firefox this year.

The tree of bugs to follow is rooted at https://bugzilla.mozilla.org/show_bug.cgi?id=1065729

Post reply on HN