61–70 of 126 posts
The article says that any key will do. Is there any concern with buying a less expensive security key from a less established company, or even a third party seller on a site like Amazon? Could a malicious entity make an intentionally weak security key and sell it? How would such an attack be detectable?
The HyperFIDO Mini (U2F Security Key) is the cheapest and smallest key I've found so far for $10. (Amazon) The Yubico are probably the best key chain candidate. No one wants to trust their key to a weak nylon thread. You can also set up a Google account to use more than one U2F key. As for Google 2FA, I think Google caused a lot of confusion by how they set up the Google Authenticator app. Always opt for the text gen…
The article says that any key will do. Is there any concern with buying a less expensive security key from a less established company, or even a third party seller on a site like Amazon? Could a malicious entity make an intentionally weak security key and sell it? How would such an attack be detectable?
The only one I can generally suggest for most people right now, in spite of it being closed, is the yubikey 4. Mostly because it can be configured to require a physical touch for each operation. Something a remote attacker can't do.
I started putting some comparisons down here: https://github.com/lrvick/security-token-docs/blob/master/De...
Earlier quoted context omitted.
Sorry about that, I'm updating that FAQ next. The answer is that SMS is not a secure second factor (it's easy to hijack and eavesdrop on), and in some cases when you give a service a phone number, it becomes possible to take over the account with just control of the phone number.
Google now offers "Google prompt" which sends a push notification to your phone through the google app. How secure is this method?
It would be a reasonable backup in place of (or in addition to) Google Authenticator.
How does the communication between the USB key and Google in a browser work? Will it work on all operating systems and browsers?
As for the operating systems: in order to use it on your phone, you'll need to be careful to use a YubiKey with NFC support and have a phone that supports NFC. You won't have any trouble using it on Windows/Ubuntu/macOS. As for the browsers: Chrome/Chromium works fine. Firefox has an addon that adds security key support[0]. Unfortunately, this addon has a bug which causes high CPU load[1]. Firefox is also working on…
If you have a phone with USB Type-C and a Yubikey 4c you can just plug it in direct.
The article states: >If you're curious why it's important to not have a phone number on your account, see the security key FAQ. but this is not explained in the FAQ. I've never heard about this before, why is this important?
I guess because it's relatively easy to redirect/capture an sms/phone call. Trick the phone company into moving your number to a new sim for example
Earlier quoted context omitted.
Only Chrome supports U2F. Firefox has experimental support of you enable special flags in about:config but I never got it to work. U2F will be superseded by Web Authentication [0] that includes U2F and will be supported by all major browsers. Edge includes draft spec API that uses TPM to store keys. [0]: https://w3c.github.io/webauthn/
You can use U2F in firefox with extension. Last time I tried it worked. However I use chrome most of the time so I am not sure if it still does. https://addons.mozilla.org/en-Us/firefox/addon/u2f-support-a...
Thanks for writing this! One nitpick: the guide says "If you're curious why it's important to not have a phone number on your account, see the security key FAQ", but the linked security FAQ doesn't actually appear to say why it's important.
Would be interested in seeing contrasting views though!
"We'll remove the phone number later" Too late, Google now has it and can correlate my profile with other sources. There's literally no other reason why Google doesn't let you enable 2FA without a phone number. I wish I didn't have to choose between security and privacy.
I'll take the Pepsi challenge with anyone on Google bashing, but I think this one is not fair.
It does hold for Facebook, though :-)
I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token. Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link…