Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Key for safer logins with a touch

facebook.com

Post reply on HN
Print view View original

81–90 of 105 posts

Re: Security Key for safer logins with a touch

#81

Post by jeff_marshall »

tptacek wrote: post #40
unknownsavage wrote: post #30

Earlier quoted context omitted.

This is really awful, for it to work well you would need to buy multiple keys and each time use them all to register (which precludes the option of storing the backup key somewhere safe). Straight from the yubico website: "It is recommended that users register at least two U2F devices with every service provider should a U2F device be misplaced" That's just a plain usability nightmare, and not to mention expensive. T…

Part of the point of hardware tokens is that you can't back up and restore their keys. If backup and restore is important to your userbase, you should stick with soft tokens.

I disagree that it's undesirable for back-up and restore to be impossible in all cases.

Instead, I would argue that plain-text export of private and secret keys is undesirable, as it removes any protections the HSM was supposed to provide (2 man rule for access, audit of use, etc). Back-up schemes that export these keys (in encrypted form) to another HSM that enforces the same rules as the original HSM can be useful, IMO.

Re: Security Key for safer logins with a touch

#82

Post by edraferi »

nickik wrote: post #62
AdmiralAsshat wrote: post #7

I'm happy with Authy and TOTP, for the moment. Getting a YubiKey has been on my to-do list for awhile, but I'm not sure that everything I currently have 2FA for will accept it. In which case, I don't like the idea of half-migrating to Yubikey while still having to keep Authenticator around.

You can use your Yubikey + Yubico Authenticater to replace Authy. It does not add that much security, but you add device switch ability without Cloud Sync.

I had a lot of problems with Yubico Authenticator. Wound up switching back to a generic app.

Re: Security Key for safer logins with a touch

#83

Post by edraferi »

draw_down wrote: post #65
nickik wrote: post #64

Earlier quoted context omitted.

In the Google security setting you can create new App-Passwords, use those in your Apple Mail or whatever. It should work fine.

If only a comment on Hacker News saying something should work made it so :)

You can view the documentation here:

https://support.google.com/accounts/answer/185833?hl=en

One key caveat with these -- they grant access to your whole account, just like your real password. They don't give access to a specific scope (e.g. calendar) even through that might be all the application you're syncing needs.

Re: Security Key for safer logins with a touch

#84

Post by DashRattlesnake »

tptacek wrote: post #36
forgottenpass wrote: post #23

I've been a big fan of yubikeys for years, but I'd never use mine for something like Facebook. I work in computer security, so I know this sounds crazy. But my brain has been rewired to work in failure modes by the not-security domain I happen to do security stuff in. The obvious argument for TFA is to reduce the chances that my Facebook account is subject to the bad consequences of that come from a compromised Faceb…

Has someone else read this and understood the argument? Because I don't follow it.

I think he was saying something along the lines of:

If you increase the strength of the authentication on an account, then you increase the expectation (in others) that anyone authenticated to the account was authenticated legitimately.

So, for example, if you have weak authentication and illegitimate access is common, then others are accustomed to distrusting the service and will react accordingly (for instance, by discounting weird behavior as the result of a hack).

However, if you have strong authentication (via 2FA) and illegitimate access is uncommon, then people are accustomed to trusting the service, so they will be less likely to correctly discount and distrust weird things posted by illegitimate actors.

Basically, I think he was saying that for something low-value like Facebook, 2FA is a bad bargain because it trades a stronger social mitigation for a weaker technical one.

Re: Security Key for safer logins with a touch

#85

Post by james_pm »

tptacek wrote: post #43
james_pm wrote: post #12

Earlier quoted context omitted.

I had SMS as my backup and in testing this morning, FB sends the SMS by default, even before you either tap the key or say you want to use another method (like SMS). That's a big flaw to me. It should only send the SMS if I specifically say, "Use my backup SMS method". I switched to use an authenticator app instead as a result.

I'm not sure I see the security advantage to opt-in SMS over opt-out SMS (both are bad). If the button exists to override the hardware token with a text message, the attacker will simply push the button after hijacking your phone number.

True that. More of an annoyance then with my phone lighting up with an SMS notification that I didn't need. Reminded me to disable SMS 2FA and stick with the authenticator app.

Re: Security Key for safer logins with a touch

#86

Post by tptacek »

jeff_marshall wrote: post #81
tptacek wrote: post #40

Earlier quoted context omitted.

Part of the point of hardware tokens is that you can't back up and restore their keys. If backup and restore is important to your userbase, you should stick with soft tokens.

I disagree that it's undesirable for back-up and restore to be impossible in all cases. Instead, I would argue that plain-text export of private and secret keys is undesirable, as it removes any protections the HSM was supposed to provide (2 man rule for access, audit of use, etc). Back-up schemes that export these keys (in encrypted form) to another HSM that enforces the same rules as the original HSM can be useful,…

I wouldn't personally recommend backing up and restoring 2FA secrets; there's a reason that the printable backup codes you get are one-time-use. But if you're going to do that, don't bother with hardware tokens. I mean, use them if they make you feel cool (I'm not being derisive; there's value in feeling better), but understand that you're effectively turning your hardware token into a software token by doing that.

My point is not that backup and restore is intrinsically evil; it's a legit security/usability tradeoff. I think most people should use software tokens.

Re: Security Key for safer logins with a touch

#87

Post by tptacek »

samatman wrote: post #74
tptacek wrote: post #40

Earlier quoted context omitted.

Part of the point of hardware tokens is that you can't back up and restore their keys. If backup and restore is important to your userbase, you should stick with soft tokens.

Could you elaborate on this, please? It's contrary to my intuition, and I respect your opinions on the subject. Having an auditable hardware token shouldn't preclude backup and restore? It still reduces the surface area for vulnerabilities to an object with no radio.

I'm worried at this point that I'd be repeating a comment I've made on this branch of the thread, so can I ask if you have any questions about those responses?

Re: Security Key for safer logins with a touch

#88

Post by tptacek »

ec109685 wrote: post #37
mtgx wrote: post #6

Earlier quoted context omitted.

That looks like a requirement, not a choice. So as usual, the U2F standard being adopted by companies these days is only as strong as SMS 2FA, because of this requirement. Can someone tell me what's the point then? Is it that they hope that in the end U2F will get popular enough that they'll remove that requirement? I would hope that's it. Otherwise, I don't see the point. I wish they at least allowed you to opt-out…

Having something like yubikey is better than just SMS given the phishing attack scenario will have to convince you to type in the SMS code, which should set off alarm bells if you have a functioning yubikey installed on the device you are logging in from.

No, that's not the problem with SMS. The problem with SMS is that SMS is itself insecure; in fact, there are large parts of the world where it's overtly and directly state-controlled. You won't have to enter your SMS code; the attacker will do it for you.

Re: Security Key for safer logins with a touch

#90

Post by Freak_NL »

grandsham wrote: post #10

I am slightly disappointed that this doesn't work in Firefox, despite the fact that I have an add-on[1] installed to add U2F support. Github for instance is able to detect U2F support and let me use it. That said, I understand the lack of support since I am an extremely small niche, and this did prompt me to finally add 2FA to facebook (U2F and code generation from my Yubikey Neo) [1] https://addons.mozilla.org/en-US…

Facebook engineers responded to this in the U2F issue on the Firefox issue tracker. It turns out that for this particular technology determining whether or not your browser supports U2F is not yet feasible, so they resort to user agent sniffing. You can use Firefox with the third party plugin if you spoof the user agent to Chrome.
Post reply on HN