Is there any security cards that just use NFC (with physical button, obviously)? I think government issued cards are good contender for this. Perhaps it could even replicate certificate authority chain principles - certain cards could sign other cards and then can be invalidated if compromised. My local id card is absolutely pathetic. I have no idea where to get a reader (although they are generic) and worst part is…
Yubico launches its dual USB-C and Lightning two-factor security key
71–80 of 178 posts
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#72Earlier quoted context omitted.
I wonder if they'll release an NFC/USB-C unit as well. Or just go 'full compat' and do NFC/USB-A/C. I could see something like that being handy for IT folks.
Yeah, I'm annoyed by having to chose between NFC and USB-C. Apparently they're working on it, though: https://twitter.com/Yubico/status/1161003411501748224
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#73That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe), I found the most common problem was that websites/services don't tread these keys as first class citizens. For example GitHub: I have my two keys setup there, but I can't opt-out of SMS authentication. If I knew I could use my keys at more services, I would a…
I’m not sure what you mean. I have SMS and Fallback SMS both disabled: https://imgur.com/a/bLnRuOq
Hm, but you have an Authenticator App enabled. If I "Edit" my SMS Number, I get to choose whether I want to proceed with "Set up using app" or "Set up using SMS", but not "Set up using security key".
The point of having two keys is that there is no need for neither an authenticator app nor SMS.
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#74Earlier quoted context omitted.
I’m not sure what you mean. I have SMS and Fallback SMS both disabled: https://imgur.com/a/bLnRuOq
Hm, but you have an Authenticator App enabled. If I "Edit" my SMS Number, I get to choose whether I want to proceed with "Set up using app" or "Set up using SMS", but not "Set up using security key". The point of having two keys is that there is no need for neither an authenticator app nor SMS.
It would rock to be able to avoid having the Authenticator app, but I think “U2F plus a TOTP device” is pretty solidly better than “U2F plus SMS”, and this comment tree is suggesting that GitHub doesn’t allow for disabling SMS.
If you do U2F with 2 keys, TOTP, and throw away the TOTP secret after you activate it, you’re exposed to a slight additional risk because the TOTP secret is still stored by Github, but that’s radically better than a world where they mandate SMS.
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#75I actually had the chance to try out a prototype at Blackhat. I was actually able to have the USB-C portion recognized on my Android Phone (via the USB port), and it was recognized in Firefox and lsusb (though for some reason I was unable to register it, and I has the u2f enabled in about:config).
I am tempted to buy it to see if I could get it to work on my phone, I would much rather have the USB-C work on my phone than an NFC.
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#76Earlier quoted context omitted.
Last year I got the Google Titan security keys and connected it with all of my work + personal accounts that support it. The #1 weakness is the simple fact that many services don't allow you to disable alternate forms of 2fa. Github is an example, you can always trigger the fallback SMS 2fa code. Dashlane is another example (and arguably the most important). It's impossible to make your security key the only form of…
My understanding is the issues that lead to U2F being considered to be better than TOTP were mainly about it being phished easily compared something which will only dispense the right code with the right challenge. But if you never actually login with TOTP, and always use your U2F key, then does it actually decrease security to have it as a backup/removal option and you know that's the only reason you'd enter it. It…
TOTP, unlike a password, can't be brute-forced. If the secret is lost, its game over, but if the secret stays protected, you can't guess it because you can only test the codes, not the secret itself. Brute-force for TOTP would only be possible if you could test 2^6 OTPs in the 60-second window, which would be mitigated by rate-limiting.
So it really doesn't do any hard to have TOTP enabled as a fallback if you never store the key anywhere.
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#77That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe), I found the most common problem was that websites/services don't tread these keys as first class citizens. For example GitHub: I have my two keys setup there, but I can't opt-out of SMS authentication. If I knew I could use my keys at more services, I would a…
I'm surprised that you can't remove/disable the fallback SMS number. One thing you can do to mitigate that problem is to create a Google Voice number. Those are harder to port as long as you created it on Google Voice.
What about a Twilio virtual number? Isn't porting disabled for them?
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#78Is there any security cards that just use NFC (with physical button, obviously)? I think government issued cards are good contender for this. Perhaps it could even replicate certificate authority chain principles - certain cards could sign other cards and then can be invalidated if compromised. My local id card is absolutely pathetic. I have no idea where to get a reader (although they are generic) and worst part is…
What would the benefits of NFC cards be? To me it seems more insecure given that anybody walking closely by could theoretically communicate with the card.
Thats what physical buttons are for
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#79Earlier quoted context omitted.
Hm, but you have an Authenticator App enabled. If I "Edit" my SMS Number, I get to choose whether I want to proceed with "Set up using app" or "Set up using SMS", but not "Set up using security key". The point of having two keys is that there is no need for neither an authenticator app nor SMS.
It would rock to be able to avoid having the Authenticator app, but I think “U2F plus a TOTP device” is pretty solidly better than “U2F plus SMS”, and this comment tree is suggesting that GitHub doesn’t allow for disabling SMS. If you do U2F with 2 keys, TOTP, and throw away the TOTP secret after you activate it, you’re exposed to a slight additional risk because the TOTP secret is still stored by Github, but that’s…
True, I just amended my initial comment to reflect the fact that GitHub is not as bad as I made it look like, but the second class citizen point still stands, even if some workaround like "throw away the TOTP" is applied.
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#80That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe), I found the most common problem was that websites/services don't tread these keys as first class citizens. For example GitHub: I have my two keys setup there, but I can't opt-out of SMS authentication. If I knew I could use my keys at more services, I would a…
FYI, a YubiKey (but not a lower-end Security Key by Yubico) supports OTP in addition to U2F. I have my GitHub account set up with U2F and OTP as the two 2FA options, both from my YubiKey. No SMS. This also works for pretty much any site that supports app-based 2FA; e.g., AWS doesn't support U2F at all, but I use it with my YubiKey via OTP.
Yubico's OTP requires you to register your secret on their server and adds a mandatory third party to the authentication process, so it's literally the second worst authentication method a Yubikey supports right after a static password.