Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device
1–10 of 147 posts
Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device
#2This looks similar to the Feitan Bluetooth LE-compatible key they also recommend that you purchase if you enable their Advanced Protection feature on your Google account:
https://www.amazon.com/Feitian-MultiPass-FIDO-Security-Key/d...
Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device
#3I don't think I'm all that opposed to competition in this space. Yubico has a virtual monopoly on high-quality Fido U2F keys at the moment. Google is a giant admittedly, and could crush Yubico overtime though. Not sure if this is just a cheaply made Feitian Key though rebranded for Google Cloud, or if it is a new product in itself.
However, I've heard that Google is kind of going on a tangent with its own U2F implementations, emphasizing an old-school implementation instead of the Web Authentication Standard that's pushed by the W3C. Google's entry and dominance in the security key industry could be detrimental overtime by limiting the actual implementation of FIDO U2F, or it could push security keys into the mainstream too, and with that, open the floodgates for supply.
Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device
#4Can someone explain this?
> “Yubikey cost Google less than their own authenticator app,” Ehrensvärd said, and there have been no account takeovers since the program was implemented, Google says.
Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device
#5It sure would be nice if AWS would support FIDO U2F. Currently, only TOTP codes are supported. I guess most orgs are implementing that in their SSO solution, but for those of us that still have regular IAM users, U2F would be a big improvement in usability.
Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device
#6Can someone explain this? > “Yubikey cost Google less than their own authenticator app,” Ehrensvärd said, and there have been no account takeovers since the program was implemented, Google says.
Perhaps he is factoring is the human cost. Yubikeys save a couple of minutes multiple times per day.
Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device
#7I don't think I'm all that opposed to competition in this space. Yubico has a virtual monopoly on high-quality Fido U2F keys at the moment. Google is a giant admittedly, and could crush Yubico overtime though. Not sure if this is just a cheaply made Feitian Key though rebranded for Google Cloud, or if it is a new product in itself. However, I've heard that Google is kind of going on a tangent with its own U2F impleme…
> However, I've heard that Google is kind of going on a tangent with its own U2F implementations, emphasizing an old-school implementation instead of the Web Authentication Standard that's pushed by the W3C.
Chrome has supported "U2F" (the first FIDO spec) for a while and all support for Security Keys in the last few years has been via this protocol.
But we're implementing the W3C Web Authentication (webauthn) spec and you can already use it in Chrome in place of U2F. All effort is going into webauthn now and the U2F code is frozen. At some point I'll announce a sunset date for U2F support in Chrome and happily delete that code. (Just the API, U2F keys will continue to work via webauthn.)
Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device
#8I don't think I'm all that opposed to competition in this space. Yubico has a virtual monopoly on high-quality Fido U2F keys at the moment. Google is a giant admittedly, and could crush Yubico overtime though. Not sure if this is just a cheaply made Feitian Key though rebranded for Google Cloud, or if it is a new product in itself. However, I've heard that Google is kind of going on a tangent with its own U2F impleme…
> However, I've heard that Google is kind of going on a tangent with its own U2F implementations, emphasizing an old-school implementation instead of the Web Authentication Standard that's pushed by the W3C. Chrome has supported "U2F" (the first FIDO spec) for a while and all support for Security Keys in the last few years has been via this protocol. But we're implementing the W3C Web Authentication (webauthn) spec a…
Can you use local storage and upload local applets to these new keys?
The main use case is authenticating under Secure Shell on a Chromebook without having to configure the key on e.g. Linux first:
https://groups.google.com/a/chromium.org/forum/#!topic/chrom...
https://chromium.googlesource.com/apps/libapps/+/HEAD/nassh/...
Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device
#9It sure would be nice if AWS would support FIDO U2F. Currently, only TOTP codes are supported. I guess most orgs are implementing that in their SSO solution, but for those of us that still have regular IAM users, U2F would be a big improvement in usability.
Yes! I don't understand why it has taken so long. The benefit for protecting root accounts and scenarios where federation is not applicable is significant.
I find the usability to be a particular drag during local development.
Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device
#10This looks similar to the Feitan Bluetooth LE-compatible key they also recommend that you purchase if you enable their Advanced Protection feature on your Google account: https://www.amazon.com/Feitian-MultiPass-FIDO-Security-Key/d...
Dang. That's more than similar - that's nearly identical form factor, for both that and the USB key.