Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Key for safer logins with a touch

facebook.com

Post reply on HN
Print view View original

71–80 of 105 posts

Re: Security Key for safer logins with a touch

#71

Post by secalex »

mtgx wrote: post #6
tyingq wrote: post #5

Earlier quoted context omitted.

It looks like it gives you a choice: "Security keys for Facebook logins currently only work with certain web browsers and mobile devices, so we'll ask you to also register an additional login approval method, such as your mobile phone or Code Generator"

That looks like a requirement, not a choice. So as usual, the U2F standard being adopted by companies these days is only as strong as SMS 2FA, because of this requirement. Can someone tell me what's the point then? Is it that they hope that in the end U2F will get popular enough that they'll remove that requirement? I would hope that's it. Otherwise, I don't see the point. I wish they at least allowed you to opt-out…

You can configure U2F+Code Generator+Backup Codes and end up with no reliance on the security of SMS for either authentication or account recovery.

Re: Security Key for safer logins with a touch

#72

Post by nickik »

draw_down wrote: post #65
nickik wrote: post #64

Earlier quoted context omitted.

In the Google security setting you can create new App-Passwords, use those in your Apple Mail or whatever. It should work fine.

If only a comment on Hacker News saying something should work made it so :)

Well you said yourself that you are not an expert. I encourage you to actually play around with the settings a litte. I have used it multible times in different context and it has worked like a charm every time.

So maybe if you spend some time on it, you can make it work.

Re: Security Key for safer logins with a touch

#73

Post by batuhanicoz »

I wish Facebook brings something similar to the Instagram.

I recently got hacked and lost my account and my first name username for good[0]. They don't even allow 2 factor auth on accounts with low followers there.

[0] https://medium.com/@batuhan/i-got-hacked-and-i-dont-think-in...

Re: Security Key for safer logins with a touch

#74

Post by samatman »

tptacek wrote: post #40
unknownsavage wrote: post #30

Earlier quoted context omitted.

This is really awful, for it to work well you would need to buy multiple keys and each time use them all to register (which precludes the option of storing the backup key somewhere safe). Straight from the yubico website: "It is recommended that users register at least two U2F devices with every service provider should a U2F device be misplaced" That's just a plain usability nightmare, and not to mention expensive. T…

Part of the point of hardware tokens is that you can't back up and restore their keys. If backup and restore is important to your userbase, you should stick with soft tokens.

Could you elaborate on this, please? It's contrary to my intuition, and I respect your opinions on the subject. Having an auditable hardware token shouldn't preclude backup and restore? It still reduces the surface area for vulnerabilities to an object with no radio.

Re: Security Key for safer logins with a touch

#77

Post by mtgx »

baq wrote: post #24
cesarb wrote: post #21

Earlier quoted context omitted.

FLAC audio support is simpler, it's just adding a self-contained FLAC decoding library, and wiring it to the already-existing audio code. For U2F, they have to write code to interact with the operating system USB API (for each operating system), plus the main U2F code, plus a Javascript API, all while taking care to not cause any new privacy leaks or worse. If you want to follow, the main bugzilla item seems to be th…

holy crap. Reported: 2014-09-10 16:07 PDT by Axel Nennker Modified: 2017-01-26 08:24 PST (History) CC List: 419 users (show)

Yeah, Google implemented it in Chrome in 2014...I guess it's just not a high priority for Mozilla right now.

Re: Security Key for safer logins with a touch

#78

Post by arnarbi »

forgottenpass wrote: post #23

I've been a big fan of yubikeys for years, but I'd never use mine for something like Facebook. I work in computer security, so I know this sounds crazy. But my brain has been rewired to work in failure modes by the not-security domain I happen to do security stuff in. The obvious argument for TFA is to reduce the chances that my Facebook account is subject to the bad consequences of that come from a compromised Faceb…

Let me see if I understand your points:

1. You ensure your FB account isn't valuable, in order to decrease the bad effects of it being hijacked.

2. You argue that hardening against hijacking means eventually the stakes of hijacks get higher, and therefore we shouldn't be hardening. Is that correct understanding? If so, that's short-sighted at best.

Many accounts are extremely valuable. It can be in terms of actual money, career, influence, politics, etc. For some people it is the primary vehicle for their livelihood. Same goes for many other online services, that open possibilities for people to earn a living, partake in politics/governance, and maintain social relations that they otherwise could not.

Re: Security Key for safer logins with a touch

#79

Post by arnarbi »

greggman wrote: post #27

And yet I'm told by other security minded people I should epoxy over my USB ports. So which is it?

Don't plug anything in your computer that you don't trust. And "trust" doesn't just mean "trust them to be non-malicious", but also "trust them to competently secure themselves against malware"

Re: Security Key for safer logins with a touch

#80

Post by arnarbi »

transfire wrote: post #26

Looks like a logistical nightmare to me. You think forgetting a password is a pain in the ass, just wait until you loose your security key. It won't be one service you have to reset through an alternate verification route, but every single one you ever used! I also foresee potential issues with data corruption on keys, and multiple-keys getting out of sync (e.g. work vs home). And I have no doubt that clever hackers…

That's like saying you shouldn't lock your house because you might lose the key.

w.r.t:

> I also foresee potential issues with data corruption on keys, and multiple-keys getting out of sync (e.g. work vs home).

and

> Also, it just doesn't seem as secure as an SMS code b/c the SMS code doesn't exist but for a short window of time and is transmitted by a completely separate communications channel

Are you talking about U2F? There are no synchronization issues there. And it is more secure than OOB codes because they can be phished. For U2F your browser is in the loop, and the origin to which you are authenticating is folded into the signature. Thus it is detectable by the RP if the signature was generated on a phisher's non-legitimate website.

Post reply on HN