91–100 of 114 posts
U2F is great and you can get a physical device for around $15. I wish banks and such would adopt U2F sooner than later. They could just sent U2F tokens as giveaways. Big downside: Apple and Microsoft. They don't support it in their browsers. No browser support, no U2F.
What's wrong with client certificates? Instead of reinventing the wheel they should've just used those which would've given browser vendors a reason to improve their UX regarding client certs.
With software U2F I think you are right; client-side certs just work, now, in all major browsers. Installing them is a hassle, but it can be managed with good documentation (we use client-side certificates for authentication at the moment).
Personally, I don't think software U2F should exist outside of development and testing scenarios.
Earlier quoted context omitted.
safari and edge users are a tiny minority. Most security aware people use chrome anyway.
Really, you think security aware people use Chrome? The security aware people I engage with avoid it. The baked in data collection and telemetry are a concern for them. Some of them even remember specific problems, like that time it turned out Chrome was listening on your mic all the time, and sending the a audio back home. The security conscious people I know use Firefox or chromium. Of course, your point stands: no…
Chrome is more secure this means that you have less of a chance having your data compromised including any and all data on your machine by an unknown 3rd party. Since Chrome's data collection is known it can be incorporated into a simple threat model. You know what is collect and who collects it, most security aware people will be OK with Chrome collecting some metrics that in all fairness are likely to be collected anyhow unless they block every JavaScript and Cookie on the planet, do no use any Google service or a service that uses GA in exchange for not having to worry about their browsers being pwned.
Can someone explain how this is an improvement on phone-based, non-SMS 2FA? This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.
Of course, keeping the token on the same machine that you're using for logging in is reducing the security, but then, the token is stored in the Keychain and once you're at the point where malware is so deeply hooked into the system that it has access to the system Keychain, then it can also inject itself into your browser and get a 2FA token whenever you log in.
This seems a little restrictive if it doesn't have some sort of 2FA alternative, like a mobile TOTP app or something. I'd hate to be locked out of any accounts for losing my MacBook, or to be unable to use the accounts from mobile or a different platform. As a secondary/simpler 2FA alternative I like it, but the description here doesn't do much to explain how to get around the problem of only having this available on…
the solution for actual U2F tokens is to buy 2 and put one in a safe deposit box. not sure what the solution is for software version
U2F is great and you can get a physical device for around $15. I wish banks and such would adopt U2F sooner than later. They could just sent U2F tokens as giveaways. Big downside: Apple and Microsoft. They don't support it in their browsers. No browser support, no U2F.
To Github people: I ordered your yubikey token but stayed away from U2F out of fear that I'd be locked out if I lost the hardware token. But I didn't realize you could setup U2F and TOTP as a backup.
You can also order as many of the U2F devices as you wish and associate them all with any number of accounts. Yes, they do cost money, but the cheapest today is $10 shipped on Amazon. Even if you prefer the ergonomics of the more expensive ones, it's fine as a backup you keep locked in a safe at home.
Earlier quoted context omitted.
This is a brilliant idea to use as a third factor. Instead of TOTP or the hardware U2F key, just create keys for all your browsers. That way, you're more protected against phishing, but still have a way to log in if you lose your keyfile.
My knee jerk reaction was 'sounds an awful lot like a cookie', but maybe that's an indicator that the problem could be slightly generalized to offering a 'secure' version of localstorage.
Come to think of it, I'm not sure that's a problem with the cookie and not with TOTP.
U2F adoption seems quite slow. Google were in early, and later github and Dropbox. But since then? Feels like nothing happened.
Buy the cheapest u2f key that is certified by FIDO, currently under $10 on Amazon.
Disclaimer, not associated with any u2f company, but I have three of them (and now the github software version as well).