Security Key for safer logins with a touch • Hacker News Board

Re: Security Key for safer logins with a touch

#21

Post by cesarb » Thu, Jan 26, 2017, 4:19 PM UTC

artursapek wrote: post #13

grandsham wrote: post #10

I am slightly disappointed that this doesn't work in Firefox, despite the fact that I have an add-on[1] installed to add U2F support. Github for instance is able to detect U2F support and let me use it. That said, I understand the lack of support since I am an extremely small niche, and this did prompt me to finally add 2FA to facebook (U2F and code generation from my Yubikey Neo) [1] https://addons.mozilla.org/en-US…

I don't understand how it has taken them so long to add it natively... they just shipped FLAC audio support but still don't care about U2F?

FLAC audio support is simpler, it's just adding a self-contained FLAC decoding library, and wiring it to the already-existing audio code.

For U2F, they have to write code to interact with the operating system USB API (for each operating system), plus the main U2F code, plus a Javascript API, all while taking care to not cause any new privacy leaks or worse.

If you want to follow, the main bugzilla item seems to be this one: https://bugzilla.mozilla.org/showdependencytree.cgi?id=10657...

Re: Security Key for safer logins with a touch

#22

Post by aftbit » Thu, Jan 26, 2017, 4:20 PM UTC

lisper wrote: post #19

DINKDINK wrote: post #8

Happy to see Facebook finally supporting U2F but haven't assessed how robust their implementation is. Another U2F hardware key is the Trezor bitcoin hardware wallet ( https://blog.trezor.io/secure-two-factor-authentication-with... ) which has the added benefit that you can backup all your U2F private keys. I'm not aware of how you could do this with a Yubico U2F key -- if someone knows, please enlighten me.

If you are concerned about the implementation, here is a security token you can flash yourself: https://sc4.us/hsm/index.html (Full disclosure: this is my company.)

This is pretty exciting, but it looks like your user manual has not been updated in 8 months. What are you working on these days?

Re: Security Key for safer logins with a touch

#23

Post by forgottenpass » Thu, Jan 26, 2017, 4:21 PM UTC

I've been a big fan of yubikeys for years, but I'd never use mine for something like Facebook.

I work in computer security, so I know this sounds crazy. But my brain has been rewired to work in failure modes by the not-security domain I happen to do security stuff in.

The obvious argument for TFA is to reduce the chances that my Facebook account is subject to the bad consequences of that come from a compromised Facebook account.

I'd much rather they reduce or eliminate the severity of the failure mode in the first place. TFA is only a mitigation that reduces the likelihood of account compromise. It shouldn't be possible for someone who swipes my yubikey to do any more than cause a minor social annoyance.

Unfortunately the presence of the mitigation (TFA) will - if adopted to significant numbers - combine with Facebook's other incentives to produce more severe failure effects for account compromise.

Remember back when facebook was still in it's just-college phase? And dicking around on your friend's facebook account if they left their computer unlocked was normal? And when you saw someone acting unusual, you sorta assumed someone was messing with their account? Yeah, I don't want a compromise of my facebook account to ever be more severe than it was back then.

Re: Security Key for safer logins with a touch

#24

Post by baq » Thu, Jan 26, 2017, 4:27 PM UTC

cesarb wrote: post #21

artursapek wrote: post #13

Earlier quoted context omitted.

I don't understand how it has taken them so long to add it natively... they just shipped FLAC audio support but still don't care about U2F?

FLAC audio support is simpler, it's just adding a self-contained FLAC decoding library, and wiring it to the already-existing audio code. For U2F, they have to write code to interact with the operating system USB API (for each operating system), plus the main U2F code, plus a Javascript API, all while taking care to not cause any new privacy leaks or worse. If you want to follow, the main bugzilla item seems to be th…

holy crap.

   Reported:	2014-09-10 16:07 PDT by Axel Nennker
   Modified:	2017-01-26 08:24 PST (History)
   CC List:	419 users (show)

Re: Security Key for safer logins with a touch

#25

Post by lisper » Thu, Jan 26, 2017, 4:33 PM UTC

aftbit wrote: post #22

lisper wrote: post #19

Earlier quoted context omitted.

If you are concerned about the implementation, here is a security token you can flash yourself: https://sc4.us/hsm/index.html (Full disclosure: this is my company.)

This is pretty exciting, but it looks like your user manual has not been updated in 8 months. What are you working on these days?

I'm still working on it, but it's a one-man company at the moment and I have more than one product so I'm spread pretty thin. But yes, I need to update the manual at the very least to mention that it now supports U2F. Thanks for pointing that out.

Re: Security Key for safer logins with a touch

#26

Post by transfire » Thu, Jan 26, 2017, 4:36 PM UTC

Looks like a logistical nightmare to me. You think forgetting a password is a pain in the ass, just wait until you loose your security key. It won't be one service you have to reset through an alternate verification route, but every single one you ever used! I also foresee potential issues with data corruption on keys, and multiple-keys getting out of sync (e.g. work vs home). And I have no doubt that clever hackers will find ways to get the codes off those keys (they will be plugged into a computer all the time and at the very least even the most cautious are susceptible to phishing). Also, it just doesn't seem as secure as an SMS code b/c the SMS code doesn't exist but for a short window of time and is transmitted by a completely separate communications channel -- but I suppose that's also why the big companies want to get rid of it, SMS costs more money.

The more I think about it, it seems to me that the Internet itself really needs to be a two-channel system. If communication has two separate physical channels then it becomes much easier to ensure security.

Re: Security Key for safer logins with a touch

#27

Post by greggman » Thu, Jan 26, 2017, 4:39 PM UTC

And yet I'm told by other security minded people I should epoxy over my USB ports.

So which is it?

Re: Security Key for safer logins with a touch

#28

Post by Analemma_ » Thu, Jan 26, 2017, 4:40 PM UTC

transfire wrote: post #26

Looks like a logistical nightmare to me. You think forgetting a password is a pain in the ass, just wait until you loose your security key. It won't be one service you have to reset through an alternate verification route, but every single one you ever used! I also foresee potential issues with data corruption on keys, and multiple-keys getting out of sync (e.g. work vs home). And I have no doubt that clever hackers…

Is it really that big a deal? I just have it on my key ring, which I'm not really in danger of losing. And if it is a concern, get something like Tile or TrackR. Seems less likely than forgetting the 15-character fully random passwords we're supposed to memorize.

Re: Security Key for safer logins with a touch

#29

Post by gst » Thu, Jan 26, 2017, 4:41 PM UTC

cesarb wrote: post #18

Last time I looked at Facebook 2FA, it didn't allow you to enable it unless you had a browser with old enough cookies from Facebook, which is not possible if you configure your browser to clear all cookies on exit (and close the whole browser at least once a day). Is that still the case?

I've used Facebook 2FA for quite a long time now and all of my browsers are configured to clear cookies on exit (and to disallow 3rd party cookies). Didn't have any issues with activating 2FA.

Re: Security Key for safer logins with a touch

#30

Post by unknownsavage » Thu, Jan 26, 2017, 4:44 PM UTC

hdhzy wrote: post #11

DINKDINK wrote: post #8

Happy to see Facebook finally supporting U2F but haven't assessed how robust their implementation is. Another U2F hardware key is the Trezor bitcoin hardware wallet ( https://blog.trezor.io/secure-two-factor-authentication-with... ) which has the added benefit that you can backup all your U2F private keys. I'm not aware of how you could do this with a Yubico U2F key -- if someone knows, please enlighten me.

W.r.t yubico u2f you don't backup it you just register to or more tokens that work as backup keys.

This is really awful, for it to work well you would need to buy multiple keys and each time use them all to register (which precludes the option of storing the backup key somewhere safe).

Straight from the yubico website: "It is recommended that users register at least two U2F devices with every service provider should a U2F device be misplaced"

That's just a plain usability nightmare, and not to mention expensive.

The trezor one works a lot more sanely for u2f, you get a recovery key when you first set it up (it uses the screen to output it, so even if your computer has malware it can't be compromised) and can leave it in a safe at your friends place.