Until Yubikey releases a USB-c version of their nano, I think I'll use this. Since I've had to transition to a keychain U2F device instead of one I can leave in my laptop, I find myself using it far less.
Soft U2F: A software-based U2F authenticator for macOS
21–30 of 114 posts
Re: Soft U2F: A software-based U2F authenticator for macOS
#22You don't really[1] need to install this, if you're using Firefox. Just set the prefs 'security.webauth.u2f' and 'security.webauth.u2f_enable_softtoken' to true. [1] (Unless you need the token to live in your Mac OS keychain, instead of the Firefox profile directory.)
Does this actually work for you? I could never get that to work. (Firefox 54 on Windows)
Re: Soft U2F: A software-based U2F authenticator for macOS
#23Earlier quoted context omitted.
on an unrelated note: can someone explain why SMS based 2FA was every considered to be a good idea? That crap drives me NUTS.
It feels inherently insecure to blast a 2FA code across every device where you've got Hangouts installed. (And if you've got Hangouts installed on the PC where you're logging into, then it's not 2FA anymore.)
> It feels inherently insecure to blast a 2FA code across every device where you've got Hangouts installed.
I think that may be Project Fi specific. To my knowledge, Hangouts doesn't do SMS anymore except for Project Fi customers, and even prior to them forcibly removing SMS handling from Hangouts on my Samsung and telling me to find something else after an update, it never synced SMS messages it to other Hangouts instances.
Re: Soft U2F: A software-based U2F authenticator for macOS
#24This seems a little restrictive if it doesn't have some sort of 2FA alternative, like a mobile TOTP app or something. I'd hate to be locked out of any accounts for losing my MacBook, or to be unable to use the accounts from mobile or a different platform.
As a secondary/simpler 2FA alternative I like it, but the description here doesn't do much to explain how to get around the problem of only having this available on my macs.
Re: Soft U2F: A software-based U2F authenticator for macOS
#25This isn't also backed-up by SMS, is it? Because the majority of U2F-supporting services seem to be doing that - even Google (and for its own Google Prompt, too).
> even Google (and for its own Google Prompt, too).
Just for iOS, or for Android as well? Is Android intercepting Google sourced SMS messages so it doesn't appear to be SMS, or are you referring to the iPhone experience?
Re: Soft U2F: A software-based U2F authenticator for macOS
#26I tried it but it didn't work for me. I'm running Mavericks. Do I need to reboot or something?
Re: Soft U2F: A software-based U2F authenticator for macOS
#27This seems a little restrictive if it doesn't have some sort of 2FA alternative, like a mobile TOTP app or something. I'd hate to be locked out of any accounts for losing my MacBook, or to be unable to use the accounts from mobile or a different platform. As a secondary/simpler 2FA alternative I like it, but the description here doesn't do much to explain how to get around the problem of only having this available on…
the solution for actual U2F tokens is to buy 2 and put one in a safe deposit box. not sure what the solution is for software version
Re: Soft U2F: A software-based U2F authenticator for macOS
#28Can someone explain how this is an improvement on phone-based, non-SMS 2FA? This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.
This is mostly against phishing. A phisher can get users to insert a token from a USB device or a text into evil.com. But U2F uses public key crypto, so your token derived for evil.com is not the same as for github.com
Also, if your machine is compromised, your the cookies used to authenticate you post-login can be stolen just as well. RTFA.
Re: Soft U2F: A software-based U2F authenticator for macOS
#29This seems a little restrictive if it doesn't have some sort of 2FA alternative, like a mobile TOTP app or something. I'd hate to be locked out of any accounts for losing my MacBook, or to be unable to use the accounts from mobile or a different platform. As a secondary/simpler 2FA alternative I like it, but the description here doesn't do much to explain how to get around the problem of only having this available on…
In general, U2F doesn't work on iPhones - so most sites offer multiple methods of secondary authentication (including Github, Facebook, and Google).
So, it is a bit of a convenience - but it also more secure because it matches hostnames.
Re: Soft U2F: A software-based U2F authenticator for macOS
#30If you're already into Bitcoin the hardware wallets also can be used for U2F