Soft U2F: A software-based U2F authenticator for macOS
githubengineering.com
Soft U2F: A software-based U2F authenticator for macOS
1–10 of 114 posts
Re: Soft U2F: A software-based U2F authenticator for macOS
#2Can someone explain how this is an improvement on phone-based, non-SMS 2FA?
This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.
Re: Soft U2F: A software-based U2F authenticator for macOS
#3Can someone explain how this is an improvement on phone-based, non-SMS 2FA? This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.
The improvement is accessibility. It's less secure than physical 2FA but more so than just 1FA. As the article says, "for many, the security of software-based U2F is sufficient and helps to mitigate against many common attacks such as password dumps, brute force attacks, and phishing related exploits."
Re: Soft U2F: A software-based U2F authenticator for macOS
#4You don't really[1] need to install this, if you're using Firefox. Just set the prefs 'security.webauth.u2f' and 'security.webauth.u2f_enable_softtoken' to true.
[1] (Unless you need the token to live in your Mac OS keychain, instead of the Firefox profile directory.)
Re: Soft U2F: A software-based U2F authenticator for macOS
#5Can someone explain how this is an improvement on phone-based, non-SMS 2FA? This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.
This is mostly against phishing.
A phisher can get users to insert a token from a USB device or a text into evil.com.
But U2F uses public key crypto, so your token derived for evil.com is not the same as for github.com
Re: Soft U2F: A software-based U2F authenticator for macOS
#6Can someone explain how this is an improvement on phone-based, non-SMS 2FA? This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.
Passwords are often already on the users phone. Such as if you use say Authy or Google Authenticator for your 2 factor, your phone if say an iPhone already stores all your passwords in your keychain which is accessible on your iPhone just like on your computer. Or if you use 1Password your passwords are accessible on your phone just like on your desktop. So still comes down to you having a strong master password for your keychain and or 1Password, etc that only you know.
If you use Authy on your phone, they have long had a chrome extension that allows you to get your codes on your computer, already for years and that works with all your existing codes rather than this which is limited to just GitHub currently it sounds.
But hopefully someone else can comment on the security improvements of Soft U2F or if its more just building a standard rather than people having to rely on Authy or such.
Re: Soft U2F: A software-based U2F authenticator for macOS
#7Can someone explain how this is an improvement on phone-based, non-SMS 2FA? This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.
I think the greatest practical threat to TOTP is phishing. U2F, regardless of where keys are stored, binds a keypair to an origin. Only authentication requests from `github.com` can use the `github.com` keys. For my money, any U2F implementation is a win over any TOTP.
Re: Soft U2F: A software-based U2F authenticator for macOS
#8This isn't also backed-up by SMS, is it? Because the majority of U2F-supporting services seem to be doing that - even Google (and for its own Google Prompt, too).
Re: Soft U2F: A software-based U2F authenticator for macOS
#9To Github people: I ordered your yubikey token but stayed away from U2F out of fear that I'd be locked out if I lost the hardware token.
But I didn't realize you could setup U2F and TOTP as a backup.
Re: Soft U2F: A software-based U2F authenticator for macOS
#10You don't really[1] need to install this, if you're using Firefox. Just set the prefs 'security.webauth.u2f' and 'security.webauth.u2f_enable_softtoken' to true. [1] (Unless you need the token to live in your Mac OS keychain, instead of the Firefox profile directory.)
My understanding is that the FF softtoken was intended to be temporary while they worked on their HID support. That might not be the case any longer though.