111–120 of 218 posts
Earlier quoted context omitted.
Every place that I use my key gives you a set of one-time-use recovery codes. To log into your account, you can use either the key or a code. (You still need your password.) Codes can be regenerated at any time. To revoke a key, you simply remove it from your account.
Can you give a list of all these places? Gandi doesn't even have a non-human method of recovery.
Okay, so I have two Yubico U2F keys and two other U2F keys so far. I don't think I'll buy a fifth and sixth anytime soon. But hopefully U2F will actually work in non-Chrome browsers in the near future.
So this needs a new yubikey? I can have passwordless login on linux right now with my old yubikey.
The conversation here is blowing my mind. People are actually worried that their yubikey might get lost or stolen when likely most of your passwords are already all over the internet. I got an email from Twitter just a few days ago stating that they'd leaked my password. Twitter! Not Joe's Auto-Body who's website is being run by a high-schooler, but one of the pioneers of internet companies. They messed up. Your pass…
> I got an email from Twitter just a few days ago stating that they'd leaked my password Clearly you didn't read the email. The password was potentially logged to twitter's servers in plaintext. They have no evidence anyone collected those passwords, but various employees could, in theory, have seen those logs. Presumably those logs are now all deleted. Even if you didn't reset your twitter password, it's very likely…
Earlier quoted context omitted.
I doubt that. Friends or family can't read your mind, but they can steal your physical key. People putting pins on their phones or password on their laptop are not afraid of being pirated. This is a vague, abstract threat to them. Becoming part of a botnet is really not important to them, and they getting their credit card stolen from the web is really not credible enough for non tech saavy user. What they are afraid…
Friends and family can also steal your credit card, but this is not where the majority of credit card theft comes from. Your example of people leaving the key with the laptop is a good example of one of the potential flaws, but just like if your credit card gets lost or stolen, you report it and it becomes unusable. I agree that there is room for 2FA, but this is also surely preferable to the current system.
This is a false equivalence because knowing someone's credit card data only allows you to do one thing which happens to be pretty detectable: using their credit card for yourself.
Knowing someone's password allows you to know one or more of their secrets, including many applications that are virtually untraceable for the average user. So the deterrence factor is much lower in the second example making it much more likely that a nosy parent / sibling / SO will take a person's key.
Earlier quoted context omitted.
This size is much better, but I assume it lacks the "touch" protection against remote attacks, like the other ones? I still wonder about the exposed connector - what its durability. After all, I would like for such a tool to serve me for years fault-free.
I personally have the nano version. > but I assume it lacks the "touch" protection against remote attacks It has the touch protection. There is a small strip of metal that protrudes beyond the USB port that you touch. > what its durability I've used it daily for about a year. Granted this is not "years" but so far it still feels very solid.
Earlier quoted context omitted.
Um, if we use public key cryptography, the only thing websites can log or leak is your public key. Since it's public, that doesn't break anything.
accept that your public key is useless if twitter accidently logs challenges. or even worse your hardware is useless if key generation is too weak. or even more worse the protocol is so complex that chances are high that even implementations can contain bugs. or ... most engineers have trouble implementing simple logins with password. do you really think that having a complex system will be better?
Good. After all the roundabout bullshit of "factors" ("2FA") and password managers, people have finally come to their senses that physical tokens are a very natural evolution of analog keys and the only real security, and should have been used from the get-go.
Keys are not the only real security... real security includes something you are, something you have, and something you know. Having something like this combined with the something you know (passphrase) would be real closer security. Now anyone with your token can access everything that key gets access to, without you needing to be there, or sharing a passphrase. That's less secure imho.
Can someone explain why CTAP was created? What exactly was wrong / not enough about the original U2F protocol?
- CTAP2 supports "user verification", such as PIN or biometric authentication locally on the hardware key. This enables using the key as both 1st and 2nd factor without need for a server-side password.
- CTAP2 supports storing the private key along with some metadata on the device, whereas U2F instead encrypts the private key and stores the ciphertext on the server. While the encryption approach allows for simpler hardware and an unlimited number of registrations, the local storage approach allows login without even having to type (or even have) a username. CTAP2 supports both.
- CTAP2 has an extensions framework in which an authentication vendor and server can cooperate to implement custom features without the browser having to understand them.
- CTAP2 - or at least the companion web API, Web Authentication - is compatible with more existing TPMs and such hardware. For example, it's theoretically possible that some Android phones could receive software upgrades that turn their fingerprint sensors into WebAuthn authenticators.
What I'd find interesting is using U2F (or FIDO2, which seems to be an evolution of this) as a second factor for SSH logins. But that doesn't seem possible without changes to SSH itself. And I hope that this might trigger more widespread support for U2F and similar mechanisms in browsers and websites.
No need to touch SSH itself, PAM is a thing (unless you're on OpenBSD). Here's an example of pam-u2f with OpenSSH: https://aprilmacdonald.com/two-factor-ssh-authentication-wit... I actually use a Yubikey for SSH in a different way: with gpg-agent. E.g. https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey-NEO....
And if you are on OpenBSD, there's login_yubikey [0] (although it uses OTP instead of U2F).