51–60 of 105 posts
Shameless plug: if you want this to work on Linux without diddling the device node permissions, install this: https://github.com/amluto/u2f-hidraw-policy I need to get around to integrating this with upstream udev so it can stop being needed as a standalone project.
Shameless plug: if you want this to work on Linux without diddling the device node permissions, install this: https://github.com/amluto/u2f-hidraw-policy I need to get around to integrating this with upstream udev so it can stop being needed as a standalone project.
Or the Yubico official https://developers.yubico.com/libu2f-host/ - that will do the same
No, really, it is. Theirs is a little list of known U2F devices from known U2F device vendors. Mine actually detects the the device is a U2F device regardless of its make and model. As far as I know, Yubico wrote that spec, so I'm a bit surprised they didn't implement it in the udev rule.
Does anybody know why the comments under this post are like that, at least for me? Is there a particular reason why people from Myanmar (some with latin name?) would comment this much more than any other?
I've been a big fan of yubikeys for years, but I'd never use mine for something like Facebook. I work in computer security, so I know this sounds crazy. But my brain has been rewired to work in failure modes by the not-security domain I happen to do security stuff in. The obvious argument for TFA is to reduce the chances that my Facebook account is subject to the bad consequences of that come from a compromised Faceb…
Has someone else read this and understood the argument? Because I don't follow it.
You don't have to mitigate failures modes that don't matter.
When you have existing mitigation in place, you can add more failure modes/effects "for free."
Earlier quoted context omitted.
Has someone else read this and understood the argument? Because I don't follow it.
https://en.wikipedia.org/wiki/Failure_mode_and_effects_analy... You don't have to mitigate failures modes that don't matter. When you have existing mitigation in place, you can add more failure modes/effects "for free."
We started using these for internal services and Google accounts where I work. It's unfortunately a big pain in the butt- you can't use Safari, you can't use the Mac/iPhone calendar app to see your meetings. It's web apps in Chrome or nothing, more or less. The one type of key supposedly uses Bluetooth, but that functionality isn't built yet or something, so you get to carry around a little 4-inch microUSB cord with…
Earlier quoted context omitted.
You can use a TOTP code generator (e.g. Authy) as your backup. No need to rely upon SMS.
You can, but is there a way to do it such that Facebook won't under any circumstances send an SMS message?
Earlier quoted context omitted.
https://en.wikipedia.org/wiki/Failure_mode_and_effects_analy... You don't have to mitigate failures modes that don't matter. When you have existing mitigation in place, you can add more failure modes/effects "for free."
I don't understand, and I'm really trying. What's the additional failure mode --- one I don't already have --- that might get added because of the moral hazard of me having a U2F token?
Edit: I don't want my facebook account to become the _kind_ of thing I'd want to protect with 2FA = I won't use 2FA for facebook.
We started using these for internal services and Google accounts where I work. It's unfortunately a big pain in the butt- you can't use Safari, you can't use the Mac/iPhone calendar app to see your meetings. It's web apps in Chrome or nothing, more or less. The one type of key supposedly uses Bluetooth, but that functionality isn't built yet or something, so you get to carry around a little 4-inch microUSB cord with…
Huh? I use the Google applications --- and, particularly, their calendar --- all the time without using Chrome, and U2F is my first-priority 2FA mechanism. You can mint static random application keys for your native applications, and use TOTP as a backup for when you want to use a different browser (really, though, you should use Chrome as much as you can; it's significantly more secure).
Using a web app on my Mac isn't the end of the world, but I can't see my meetings on my phone in any type of way, and I'm already missing them sometimes because the little notification on the phone is what reminds me that I have a meeting to go to.
Earlier quoted context omitted.
Or the Yubico official https://developers.yubico.com/libu2f-host/ - that will do the same
My version is waaaay better. No, really, it is. Theirs is a little list of known U2F devices from known U2F device vendors. Mine actually detects the the device is a U2F device regardless of its make and model. As far as I know, Yubico wrote that spec, so I'm a bit surprised they didn't implement it in the udev rule.
