Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Key for safer logins with a touch

facebook.com

Post reply on HN
Print view View original

31–40 of 105 posts

Re: Security Key for safer logins with a touch

#31

Post by willlll »

grandsham wrote: post #10

I am slightly disappointed that this doesn't work in Firefox, despite the fact that I have an add-on[1] installed to add U2F support. Github for instance is able to detect U2F support and let me use it. That said, I understand the lack of support since I am an extremely small niche, and this did prompt me to finally add 2FA to facebook (U2F and code generation from my Yubikey Neo) [1] https://addons.mozilla.org/en-US…

I just implemented U2F, and it's a bit of a pain to detect that the plugin is there. You have to load the real u2f js, then check if functions on the u2f object that are normally there aren't anymore, since the firefox plugin strips all of them off but 2. Doable, but a pain.

Re: Security Key for safer logins with a touch

#32

Post by CaveTech »

forgottenpass wrote: post #23

I've been a big fan of yubikeys for years, but I'd never use mine for something like Facebook. I work in computer security, so I know this sounds crazy. But my brain has been rewired to work in failure modes by the not-security domain I happen to do security stuff in. The obvious argument for TFA is to reduce the chances that my Facebook account is subject to the bad consequences of that come from a compromised Faceb…

I don't think I follow your reasoning of how increased security increases the severity of a compromise. Can you elaborate on that?

Re: Security Key for safer logins with a touch

#33

Post by NickBusey »

transfire wrote: post #26

Looks like a logistical nightmare to me. You think forgetting a password is a pain in the ass, just wait until you loose your security key. It won't be one service you have to reset through an alternate verification route, but every single one you ever used! I also foresee potential issues with data corruption on keys, and multiple-keys getting out of sync (e.g. work vs home). And I have no doubt that clever hackers…

I recently lost my security key. Now I have to pull out my phone and type in 6 digits from Google Authenticator instead. It's been such a nightmare, let me tell you..

Re: Security Key for safer logins with a touch

#34

Post by nothrabannosir »

CaveTech wrote: post #32
forgottenpass wrote: post #23

I've been a big fan of yubikeys for years, but I'd never use mine for something like Facebook. I work in computer security, so I know this sounds crazy. But my brain has been rewired to work in failure modes by the not-security domain I happen to do security stuff in. The obvious argument for TFA is to reduce the chances that my Facebook account is subject to the bad consequences of that come from a compromised Faceb…

I don't think I follow your reasoning of how increased security increases the severity of a compromise. Can you elaborate on that?

It lowers the barrier to adopting "login with facebook" on other platforms. "You get 2fa for free!"

Re: Security Key for safer logins with a touch

#35

Post by OJFord »

CaveTech wrote: post #32
forgottenpass wrote: post #23

I've been a big fan of yubikeys for years, but I'd never use mine for something like Facebook. I work in computer security, so I know this sounds crazy. But my brain has been rewired to work in failure modes by the not-security domain I happen to do security stuff in. The obvious argument for TFA is to reduce the chances that my Facebook account is subject to the bad consequences of that come from a compromised Faceb…

I don't think I follow your reasoning of how increased security increases the severity of a compromise. Can you elaborate on that?

If my network knows that I use PGP to login, they may well accept an (illegitimate) announcement that I'm changing my keys to {attacker-generated.asc}.

Of course, really such a login key should only be able to authenticate, and my network should only accept a proper revocation certificate that would need to have been generated by a different key with the 'Certify' action enabled.

How likely or damaging that is obviously depends a lot on who you are, and probably wouldn't be for many people at all. But I assume that's the sort of thing your parent commenter is alluding to.

Re: Security Key for safer logins with a touch

#36

Post by tptacek »

forgottenpass wrote: post #23

I've been a big fan of yubikeys for years, but I'd never use mine for something like Facebook. I work in computer security, so I know this sounds crazy. But my brain has been rewired to work in failure modes by the not-security domain I happen to do security stuff in. The obvious argument for TFA is to reduce the chances that my Facebook account is subject to the bad consequences of that come from a compromised Faceb…

Has someone else read this and understood the argument? Because I don't follow it.

Re: Security Key for safer logins with a touch

#37

Post by ec109685 »

mtgx wrote: post #6
tyingq wrote: post #5

Earlier quoted context omitted.

It looks like it gives you a choice: "Security keys for Facebook logins currently only work with certain web browsers and mobile devices, so we'll ask you to also register an additional login approval method, such as your mobile phone or Code Generator"

That looks like a requirement, not a choice. So as usual, the U2F standard being adopted by companies these days is only as strong as SMS 2FA, because of this requirement. Can someone tell me what's the point then? Is it that they hope that in the end U2F will get popular enough that they'll remove that requirement? I would hope that's it. Otherwise, I don't see the point. I wish they at least allowed you to opt-out…

Having something like yubikey is better than just SMS given the phishing attack scenario will have to convince you to type in the SMS code, which should set off alarm bells if you have a functioning yubikey installed on the device you are logging in from.

Re: Security Key for safer logins with a touch

#39

Post by tptacek »

AdmiralAsshat wrote: post #7

I'm happy with Authy and TOTP, for the moment. Getting a YubiKey has been on my to-do list for awhile, but I'm not sure that everything I currently have 2FA for will accept it. In which case, I don't like the idea of half-migrating to Yubikey while still having to keep Authenticator around.

Pretty much everyone I've talked to that uses a YK has the same configuration I do, by priority:

1. Security key

2. TOTP via phone authenticator app

3. Offsite saved backup keys

(4.) Disable SMS

This implies two things: first, that for pretty much every site you rely on, you're going to be both TOTP and U2F anyways, and second, that sites that don't support U2F yet will just start at step 2.

U2F is more convenient than TOTP and, because you're virtually never going to actually use it on a site you U2F into, U2F is still mitigating the phishing risk. You're carrying your phone with you anyways. It's pretty much win-win.

Re: Security Key for safer logins with a touch

#40

Post by tptacek »

unknownsavage wrote: post #30
hdhzy wrote: post #11

Earlier quoted context omitted.

W.r.t yubico u2f you don't backup it you just register to or more tokens that work as backup keys.

This is really awful, for it to work well you would need to buy multiple keys and each time use them all to register (which precludes the option of storing the backup key somewhere safe). Straight from the yubico website: "It is recommended that users register at least two U2F devices with every service provider should a U2F device be misplaced" That's just a plain usability nightmare, and not to mention expensive. T…

Part of the point of hardware tokens is that you can't back up and restore their keys. If backup and restore is important to your userbase, you should stick with soft tokens.
Post reply on HN