Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Soft U2F: A software-based U2F authenticator for macOS

githubengineering.com

Post reply on HN
Print view View original

81–90 of 114 posts

Re: Soft U2F: A software-based U2F authenticator for macOS

#81

Post by [deleted] »

nevir wrote: post #34
crummy wrote: post #3

Earlier quoted context omitted.

The improvement is accessibility. It's less secure than physical 2FA but more so than just 1FA. As the article says, "for many, the security of software-based U2F is sufficient and helps to mitigate against many common attacks such as password dumps, brute force attacks, and phishing related exploits."

It's really not that much less secure than physical 2FA: I'm willing to bet that most people just leave their hardware key in their laptop at all times. (where "most people" ends up being corporate U2F users, who are probably given YubiKey Nanos and the like) At that point, your laptop is basically your 2nd factor - which this software is pretty similar to.

[deleted]

Re: Soft U2F: A software-based U2F authenticator for macOS

#82

Post by Harley454 »

subway wrote: post #77
StavrosK wrote: post #53

Earlier quoted context omitted.

This is a brilliant idea to use as a third factor. Instead of TOTP or the hardware U2F key, just create keys for all your browsers. That way, you're more protected against phishing, but still have a way to log in if you lose your keyfile.

My knee jerk reaction was 'sounds an awful lot like a cookie', but maybe that's an indicator that the problem could be slightly generalized to offering a 'secure' version of localstorage.

I got paid $10438 last month by working online. Its an easy online job to do and earning is more and better than the regular office job. I have found this job six months ago and starts earning in my first month easily. Everybody can do this job from home by just follow this web. g­­­o t­­­o t­­­hi­­­s si­­­te ho­­­me media tech t­­­a­­­b f­­­or m­­­or­­­e d­­­et­­­a­­­i­­­l thank you .

►►►https://is.gd/qKRnJt

Re: Soft U2F: A software-based U2F authenticator for macOS

#83

Post by RainaRelanah »

Buge wrote: post #72
petee wrote: post #54

This seems misguided - it is watering down a decent system simply to appease and attract people too cheap to buy tokens; if 2fa is something that is so important to you, and you need it, just buy the damn tokens! A vague comparison, would be me selling pre-printed 'random' passwords on paper because a user generating their own was 'too difficult' IMHO, soft token u2f is only useful for testing, development, and perso…

My bet on the reason for creating this: new Macs have no USB-A port, and there are no USB-C U2F tokens that fit flush in the port. Github isn't too cheap to buy the token. The token they want to buy simply doesn't exist.

By flush, do you mean fully hidden inside the port? Yubikey has the 4C which should work on the MacBook and is the same size as their normal keys.

Re: Soft U2F: A software-based U2F authenticator for macOS

#84

Post by cntlzw »

U2F is great and you can get a physical device for around $15. I wish banks and such would adopt U2F sooner than later. They could just sent U2F tokens as giveaways.

Big downside: Apple and Microsoft. They don't support it in their browsers. No browser support, no U2F.

Re: Soft U2F: A software-based U2F authenticator for macOS

#85

Post by jdeibele »

Somewhat disconcerting to see this in Chrome:

Attackers on github-production-release-asset-2e65be.s3.amazonaws.com may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone numbers, or credit cards).

Re: Soft U2F: A software-based U2F authenticator for macOS

#87

Post by bostand »

cntlzw wrote: post #84

U2F is great and you can get a physical device for around $15. I wish banks and such would adopt U2F sooner than later. They could just sent U2F tokens as giveaways. Big downside: Apple and Microsoft. They don't support it in their browsers. No browser support, no U2F.

safari and edge users are a tiny minority. Most security aware people use chrome anyway.

Re: Soft U2F: A software-based U2F authenticator for macOS

#88

Post by ianopolous »

ptoomey3 wrote: post #64
ianopolous wrote: post #43

I've been looking into 2FA on Github and I don't understand why you must have either SMS or TOTP (typically a mobile app) as the primary second factor. Why not let users go straight to a yubikey? I don't want my mobile involved in the process at any point. You also can't remove the TOTP factor once you've added a yubikey, so yubikeys are 2nd class citizens, despite being much more secure.

The primary reason is exactly the reason you cited (u2f support is not ubiquitous across browsers..especially mobile). We may consider allowing folks to use u2f exclusively in the future, but we started conservatively given the already risky proposition of account lockout with regular 2FA.

Thank you for clearing that up. Personally, I'm more likely to lose my phone or have it brick itself (happened to my previous phone) than to lose a yubikey.

Re: Soft U2F: A software-based U2F authenticator for macOS

#89

Post by ohthehugemanate »

bostand wrote: post #87
cntlzw wrote: post #84

U2F is great and you can get a physical device for around $15. I wish banks and such would adopt U2F sooner than later. They could just sent U2F tokens as giveaways. Big downside: Apple and Microsoft. They don't support it in their browsers. No browser support, no U2F.

safari and edge users are a tiny minority. Most security aware people use chrome anyway.

Really, you think security aware people use Chrome? The security aware people I engage with avoid it. The baked in data collection and telemetry are a concern for them. Some of them even remember specific problems, like that time it turned out Chrome was listening on your mic all the time, and sending the a audio back home.

The security conscious people I know use Firefox or chromium.

Of course, your point stands: no one's using safari or edge. :)

Re: Soft U2F: A software-based U2F authenticator for macOS

#90

Post by Freak_NL »

mongol wrote: post #33

U2F adoption seems quite slow. Google were in early, and later github and Dropbox. But since then? Feels like nothing happened.

Cost is the major problem, with a couple of technical/deployment issues.

The technical/deployment issues to me are the lack of browser support (that means Edge, Firefox, Safari, etc.), the long and slow migration from USB-A to USB-C, and the missing parts of the mobile puzzle. With the latter I mean U2F support for Bluetooth Low Energy (BLE) and NFC on (at least) smartphones.

Ideally, you could visit some secured website on your smartphone, choose to authenticate with Fido U2F, tap your U2F key to the phone, and authenticate with it using BLE or NFC. The same key can be used on a laptop or desktop computer as well using USB.

Those devices will exist (or already exist perhaps), but they will cost a lot more than the plain USB-A U2F keys available now for roughly $15.

To drive adoption, ideally banks would get on board and go for U2F. That way a lot of people would come in contact with the technology, driving adoption and prompting users to use the key for other services as well (for the bank this provides a nice branding opportunity!).

Unfortunately, banks tend to favour private solutions based on TOTP/HOTP in a lot of countries. That means that in, for example, my native country of the Netherlands you will get a small battery powered calculator-like device from your bank that generates the challenge-response verification codes needed to authorize transactions. Each bank has its own solution that only works with them, and each will send you their private branded TOTP-in-a-box device.

Add to this governments that are attempting to introduce electronic ID-cards containing NFC-chips for public authentication with government and commercial entities alike, and you can see why in a lot of countries the only candidates for U2F are global services like GitHub and Dropbox. That reduces the amount of potential U2F users to what are essentially power users.

Post reply on HN