Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico launches its dual USB-C and Lightning two-factor security key

techcrunch.com

Post reply on HN
Print view View original

41–50 of 178 posts

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#41

Post by archi42 »

munchbunny wrote: post #35
archi42 wrote: post #15

That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe), I found the most common problem was that websites/services don't tread these keys as first class citizens. For example GitHub: I have my two keys setup there, but I can't opt-out of SMS authentication. If I knew I could use my keys at more services, I would a…

I'm surprised that you can't remove/disable the fallback SMS number. One thing you can do to mitigate that problem is to create a Google Voice number. Those are harder to port as long as you created it on Google Voice.

You're right, but I dislike that route for three reasons:

1. It should just be plain unnecessary to apply such a hack.

2. There is still a single weak point for all services.

3. While this prevents against the run-of-the-mill "attacker activates another SIM card for my mobile number and steals my crypto cash from $online_wallet" coming up here every few month, a more sophisticated attacker can just route the SMS to himself via SS7 (I suppose the SIM variant is easier to pull off with less traces, and obviously requires much less technical expertise).

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#42

Post by Freak_NL »

aequitas wrote: post #20
knd775 wrote: post #5

Earlier quoted context omitted.

> cloning a Yubico key This should be impossible.

It might not be impossible, but surely non-trivial. Add to that that it has to be done in a undetectable way and the key owner needs to be parted for the key in the time it takes to make the clone.

You'd probably destroy the key's shell in the process of getting to the microchip (you can't get to the private key via the USB connector by design, so decapping is probably the only way to do it), so you would have to have a clone ready that looks exactly like the key you've just disfigured to get to the secret key.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#43

Post by giancarlostoro »

devonkim wrote: post #31
giancarlostoro wrote: post #21

Earlier quoted context omitted.

Impresive, have they had external security firms try to steal the private key? Thats my final thought. I guess it makes sense. By the time an adversary gets your key you would of noticed and have locked that key from your account.

Lockheed has a great deal of their MFA keys compromised because the factory that manufactured them had been breached for a while and nobody had noticed. Supply chain attacks are performed constantly against large, known entities and this case shows why they are so pedantic about security and justified in their paranoia. The problems have been execution of the policy and the costs of compliance.

Ah this sounds familiar... Probably saw the article here on HN ages back and forgot. I mostly ask cause I don't have one of these keys but if I were to consider getting one I'd want to know what a good option would be.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#44

Post by munchbunny »

jeromegv wrote: post #39
munchbunny wrote: post #35

Earlier quoted context omitted.

I'm surprised that you can't remove/disable the fallback SMS number. One thing you can do to mitigate that problem is to create a Google Voice number. Those are harder to port as long as you created it on Google Voice.

A solution often mentioned but not available to anyone outside the US.

Can you create one that doesn't forward to your phone? Could a US friend create one for you in a new account and hand that account over to you?

It's more about sinking that second factor somewhere that can't be redirected and only you can theoretically access by logging into Google Voice. You don't have to forward the messages to your actual phone.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#45

Post by somepig »

cj wrote: post #24
archi42 wrote: post #15

That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe), I found the most common problem was that websites/services don't tread these keys as first class citizens. For example GitHub: I have my two keys setup there, but I can't opt-out of SMS authentication. If I knew I could use my keys at more services, I would a…

Last year I got the Google Titan security keys and connected it with all of my work + personal accounts that support it. The #1 weakness is the simple fact that many services don't allow you to disable alternate forms of 2fa. Github is an example, you can always trigger the fallback SMS 2fa code. Dashlane is another example (and arguably the most important). It's impossible to make your security key the only form of…

regular "app based" is just OATH-TOTP in most cases. This uses a shared secret and the time to generate one time codes.

The Yubikey explicitly supports TOTP, and will happily store your secret on the key. You can then use Yubioath to pull codes from the Yubikey as needed.

I'm a huge fan of the ability to use either U2F or TOTP with the same hardware token.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#46

Post by rurban »

giancarlostoro wrote: post #2

> Security keys offer almost unbeatable security and can protect against a variety of threats, including nation-state attackers. Alright, I'm not a security expert, but I'm not completely illiterate to basic computer security. Anyone care to chime in how this is much more secure than a two-factor app? Sure there's the obvious, nobody can just copy the two-factor app off my phone with all the codes and have the same c…

It isn't. SW can be updated and is usually open-source and mostly secure. HW not so.

At least two HW backdoors have been found in chips such as this one in earlier versions, the first using an improper RSALib RSA variant (developed by NSA or Mossad). The source for the second, SCADA, is unknown.

So any nation state wanting the most people to use it, will advertise it as such. "unbeatable security and can protect against a variety of threats, including nation-state attackers."

This happened with the Infineon backdoor, the SCADA backdoor, the earlier Crypto AG backdoors. https://acmccs.github.io/papers/p1631-nemecA.pdf

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#47

Post by pja »

haunter wrote: post #37

I tried the quiz to get a recommendation but it finishes in an endless loop > learn more > quiz starts again https://www.yubico.com/quiz/ Also can anyone explain the multiple models too me? https://www.yubico.com/products/yubikey-hardware/ Say I want an USB-A key, I can choose from three and they all have different prices. The Security Keys are less secure than a FIPS or a 5? Maybe I'm just too end user but the multi…

It’s not entirely obvious from the description, but the main difference is (I believe) that the cheap keys can only do FIDO 2-factor authentication whereas the expensive ones have secure storage so you do things like putting your pgp private keys on them.

If all you want is true 2-factor authentication for Gmail / Facebook / Github etc then the cheap keys are exactly what you need.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#48

Post by munchbunny »

archi42 wrote: post #41
munchbunny wrote: post #35

Earlier quoted context omitted.

I'm surprised that you can't remove/disable the fallback SMS number. One thing you can do to mitigate that problem is to create a Google Voice number. Those are harder to port as long as you created it on Google Voice.

You're right, but I dislike that route for three reasons: 1. It should just be plain unnecessary to apply such a hack. 2. There is still a single weak point for all services. 3. While this prevents against the run-of-the-mill "attacker activates another SIM card for my mobile number and steals my crypto cash from $online_wallet" coming up here every few month, a more sophisticated attacker can just route the SMS to h…

I agree with all of your points. Really Github should just let you remove any dependency on SMS entirely. I lucked out in that I never configured SMS as a fallback. I have backup codes printed out in a safe.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#49

Post by ericpauley »

ch wrote: post #10
sakisv wrote: post #6

I think I'd preferred if they offered a USB-C and USB-A combo.

Something like this would suffice, if it was simple to keep along side the key: https://tripplite.com/usb-c-female-to-usb-a-male-adapter~U32...

I use USB-C devices almost exclusively and opted the other way around, carrying a USB-A variant with a C-A adapter. A few reasons:

* The A variant yubikey is crush resistant and mechanically simple for a longer life.

* The adapter acts as a form of connector saver for my yubikey, since I usually keep it physically attached to the yubikey itself. With this approach both wear-prone sides (C male and A female) are on the adapter, which costs as little as 1/50th the price of the yubikey.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#50

Post by Macha »

cj wrote: post #24
archi42 wrote: post #15

That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe), I found the most common problem was that websites/services don't tread these keys as first class citizens. For example GitHub: I have my two keys setup there, but I can't opt-out of SMS authentication. If I knew I could use my keys at more services, I would a…

Last year I got the Google Titan security keys and connected it with all of my work + personal accounts that support it. The #1 weakness is the simple fact that many services don't allow you to disable alternate forms of 2fa. Github is an example, you can always trigger the fallback SMS 2fa code. Dashlane is another example (and arguably the most important). It's impossible to make your security key the only form of…

My understanding is the issues that lead to U2F being considered to be better than TOTP were mainly about it being phished easily compared something which will only dispense the right code with the right challenge.

But if you never actually login with TOTP, and always use your U2F key, then does it actually decrease security to have it as a backup/removal option and you know that's the only reason you'd enter it.

It feels like its competition there is "convince phone support with a sob story" and TOTP feels like a clear step up from that.

Post reply on HN