81–90 of 178 posts
I think I'd preferred if they offered a USB-C and USB-A combo.
Something like this would suffice, if it was simple to keep along side the key: https://tripplite.com/usb-c-female-to-usb-a-male-adapter~U32...
You might know what you are doing, but are you sure that's true for everybody who might find and use it in the future?
Please don't buy/produce these things.
Earlier quoted context omitted.
My understanding is the issues that lead to U2F being considered to be better than TOTP were mainly about it being phished easily compared something which will only dispense the right code with the right challenge. But if you never actually login with TOTP, and always use your U2F key, then does it actually decrease security to have it as a backup/removal option and you know that's the only reason you'd enter it. It…
TOTP, unlike a password, can't be brute-forced. If the secret is lost, its game over, but if the secret stays protected, you can't guess it because you can only test the codes, not the secret itself. Brute-force for TOTP would only be possible if you could test 2^6 OTPs in the 60-second window, which would be mitigated by rate-limiting. So it really doesn't do any hard to have TOTP enabled as a fallback if you never…
They have relatively tiny key space (generally 6 digits), so if the provider doesn’t protect against brute-force, it’s quick and easy to slam the whole key space until you win.
They also need the secret in a reversible format, since the service provider has to use the secret to calculate valid codes. So the most common password brute-forcing pathway (theft of a database full of password hashes) is rendered moot: you don’t have to brute-force the hashes because they aren’t hashes, they’re just secrets. At best, the TOTP seeds are encrypted at rest, but since whatever server validates tokens has to decrypt them to do so, most implementations in the wild either don’t encrypt or keep the decryption key right next to the data.
Is there any security cards that just use NFC (with physical button, obviously)? I think government issued cards are good contender for this. Perhaps it could even replicate certificate authority chain principles - certain cards could sign other cards and then can be invalidated if compromised. My local id card is absolutely pathetic. I have no idea where to get a reader (although they are generic) and worst part is…
> I think government issued cards are good contender for this. For this, devices would have to support real NFC in the first place. iPhones/iPads don't allow app usage of NFC, and the flagship Samsung tablets don't ship with it at all.
I know they already let certain apps to read pom’s passports. Just a matter setting a standard?
Earlier quoted context omitted.
My understanding is the issues that lead to U2F being considered to be better than TOTP were mainly about it being phished easily compared something which will only dispense the right code with the right challenge. But if you never actually login with TOTP, and always use your U2F key, then does it actually decrease security to have it as a backup/removal option and you know that's the only reason you'd enter it. It…
There's a small downside to TOTP even if you never use it in anger. For U2F/ WebAuthn the relying party doesn't end up knowing any secrets. So if for example I get a month old database backup of Facebook, I don't learn how to log in with U2F as any of the users whose credentials I have, because Facebook can't do that either, only the legitimate users can. For TOTP that stolen data gets me in, because I can synthesize…
Actually what would happen if [large_comapny] had their TOTP secret revealed? Would they be forced to invalidate everyones TOTP? They can't just disable it they would have to somehow authenticate you a third way....
Earlier quoted context omitted.
FYI, a YubiKey (but not a lower-end Security Key by Yubico) supports OTP in addition to U2F. I have my GitHub account set up with U2F and OTP as the two 2FA options, both from my YubiKey. No SMS. This also works for pretty much any site that supports app-based 2FA; e.g., AWS doesn't support U2F at all, but I use it with my YubiKey via OTP.
Yubico's OTP requires you to register your secret on their server and adds a mandatory third party to the authentication process, so it's literally the second worst authentication method a Yubikey supports right after a static password.
Also, to say that using Yubico OTP is “the second worst method” is potentially true, but in a relatively uninteresting way: adding Yubico-OTP-based MFA is so much better than just using a static password that the gap between 1st and 2nd place is huge. The comparative benefit between Yubico OTP and TOTP is tiny by comparison.
It’s also worth noting that Yubico has released the spec for validating their OTPs, so it’s possible to do so without a 3rd party: https://www.yubico.com/products/services-software/open-sourc...
There's still one huge disadvantage with hardware-based FIDO U2F tokens: There's no good way to migrate from one to another. I've got three(!) Yubikeys of different generations on my keyring because I'm not sure whether I have enrolled the two newer ones to all the services I'm using.
Earlier quoted context omitted.
> I think government issued cards are good contender for this. For this, devices would have to support real NFC in the first place. iPhones/iPads don't allow app usage of NFC, and the flagship Samsung tablets don't ship with it at all.
What’s a “real NFC”? I know they already let certain apps to read pom’s passports. Just a matter setting a standard?
Sounds like from the others ios 13 will resolve this.
Earlier quoted context omitted.
I'm surprised that you can't remove/disable the fallback SMS number. One thing you can do to mitigate that problem is to create a Google Voice number. Those are harder to port as long as you created it on Google Voice.
What about a Twilio virtual number? Isn't porting disabled for them?
The main issue with Twilio numbers is that they can't receive from short codes. If the service you're using sends 2FA codes from a short code, they'll just disappear into the ether.
Of course, if you're just using this as a placeholder because the site requires SMS backup, then maybe it's ok that you can't receive on them.
I thought Yubikey NEO supported NFC on iPhones. I remember reading there was some flaky support for a while, then a new SDK was released for iOS 11. Is there any advantage to using the pluggable Lightning Yubikey over the NEO? Perhaps better app support?
I happen to have one of the InCharge chargers as keychain [1] and what is interesting is that it is 3 chargers in one: one's always USB-A, other one is either USB-C or microUSB/lightning. So they combine microUSB with lightning on the same connector. I wonder why YubiCo did not go with a similar design.
[1] https://www.indiegogo.com/projects/incharge-universal-one-ca...