51–60 of 178 posts
* https://www.yubico.com/products/yubikey-hardware/compare-yub...
Seems the main questions to ask yourself are:
* is NFC desired?
* do you need/want USB-A or USB-C?
This product adds a Lightning option.
I think I'd preferred if they offered a USB-C and USB-A combo.
Or just go 'full compat' and do NFC/USB-A/C. I could see something like that being handy for IT folks.
That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe), I found the most common problem was that websites/services don't tread these keys as first class citizens. For example GitHub: I have my two keys setup there, but I can't opt-out of SMS authentication. If I knew I could use my keys at more services, I would a…
This seems to be very uncommon amongst service providers.
Handy table comparing their 5-series options: * https://www.yubico.com/products/yubikey-hardware/compare-yub... Seems the main questions to ask yourself are: * is NFC desired? * do you need/want USB-A or USB-C? This product adds a Lightning option.
Earlier quoted context omitted.
Last year I got the Google Titan security keys and connected it with all of my work + personal accounts that support it. The #1 weakness is the simple fact that many services don't allow you to disable alternate forms of 2fa. Github is an example, you can always trigger the fallback SMS 2fa code. Dashlane is another example (and arguably the most important). It's impossible to make your security key the only form of…
My understanding is the issues that lead to U2F being considered to be better than TOTP were mainly about it being phished easily compared something which will only dispense the right code with the right challenge. But if you never actually login with TOTP, and always use your U2F key, then does it actually decrease security to have it as a backup/removal option and you know that's the only reason you'd enter it. It…
SMS 2FA, on the other hand, has real security issues[0][1]. In my experience, SMS 2FA is most commonly the required type of 2FA, before you can add TOTP/U2F as a secondary.
SMS 2FA is the hardest to lose or break, so forcing everyone to keep it enabled minimizes support costs for the provider.
[0] https://www.theregister.co.uk/2016/07/24/nist_says_sms_no_go...
[1] https://duo.com/decipher/reddit-breach-illustrates-dangers-o...
Earlier quoted context omitted.
Last year I got the Google Titan security keys and connected it with all of my work + personal accounts that support it. The #1 weakness is the simple fact that many services don't allow you to disable alternate forms of 2fa. Github is an example, you can always trigger the fallback SMS 2fa code. Dashlane is another example (and arguably the most important). It's impossible to make your security key the only form of…
My understanding is the issues that lead to U2F being considered to be better than TOTP were mainly about it being phished easily compared something which will only dispense the right code with the right challenge. But if you never actually login with TOTP, and always use your U2F key, then does it actually decrease security to have it as a backup/removal option and you know that's the only reason you'd enter it. It…
For U2F/ WebAuthn the relying party doesn't end up knowing any secrets. So if for example I get a month old database backup of Facebook, I don't learn how to log in with U2F as any of the users whose credentials I have, because Facebook can't do that either, only the legitimate users can.
For TOTP that stolen data gets me in, because I can synthesize correct TOTP codes for any user whose secret key I have stolen.
But you are correct that social engineering attacks will be far more common. The particular concern with SMS is that the attack can target your mobile phone company, so that all the security at say Facebook or Twitter doesn't help you because your security was blown up at T-mobile or AT&T.
I think I'd preferred if they offered a USB-C and USB-A combo.
I wonder if they'll release an NFC/USB-C unit as well. Or just go 'full compat' and do NFC/USB-A/C. I could see something like that being handy for IT folks.
I tried the quiz to get a recommendation but it finishes in an endless loop > learn more > quiz starts again https://www.yubico.com/quiz/ Also can anyone explain the multiple models too me? https://www.yubico.com/products/yubikey-hardware/ Say I want an USB-A key, I can choose from three and they all have different prices. The Security Keys are less secure than a FIPS or a 5? Maybe I'm just too end user but the multi…
This might be more useful for you: https://www.yubico.com/products/yubikey-hardware/compare-pro...
You want the Yubikey FIPS if you're using it in a context where FIPS compliance matters, such as US government. If not (such as for personal use), then don't bother.
The Security Key series is the budget minimal "works as a FIDO authenticator". It lacks the bells and whistles that come with the 5 series. AFAIK it is not "less secure," it just lacks bells and whistles.
The 5 series works as a FIDO authenticator, but it also includes PIV capabilities (smartcards, PGP, etc.), which allow you to do stuff like this: https://developers.yubico.com/PGP/SSH_authentication/.* The PIV capabilities matter more in the context of enterprise/government applications where smartcards have been in common use as a 2nd factor for many years, which makes having an all-in-one smartcard+FIDO device very convenient.
* Caveat: I recommend against using your Yubikey for SSH private/public key authentication unless your SSH setup also requires a password. Single physical factor is worse than having a password protected key pair in your ~/.ssh folder.
But you can compile libp11 against LibreSSL for extra. . . better-than-tinfoil.
Earlier quoted context omitted.
I'm surprised that you can't remove/disable the fallback SMS number. One thing you can do to mitigate that problem is to create a Google Voice number. Those are harder to port as long as you created it on Google Voice.
A solution often mentioned but not available to anyone outside the US.