Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico launches its dual USB-C and Lightning two-factor security key

techcrunch.com

Post reply on HN
Print view View original

91–100 of 178 posts

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#91

Post by akerl_ »

archi42 wrote: post #79
akerl_ wrote: post #74

Earlier quoted context omitted.

It would rock to be able to avoid having the Authenticator app, but I think “U2F plus a TOTP device” is pretty solidly better than “U2F plus SMS”, and this comment tree is suggesting that GitHub doesn’t allow for disabling SMS. If you do U2F with 2 keys, TOTP, and throw away the TOTP secret after you activate it, you’re exposed to a slight additional risk because the TOTP secret is still stored by Github, but that’s…

True, I just amended my initial comment to reflect the fact that GitHub is not as bad as I made it look like, but the second class citizen point still stands, even if some workaround like "throw away the TOTP" is applied.

I agree with your overall point. I’m hopeful that bringing U2F/FIDO2 to iPhone will help continue to push these standards into being first-class citizens. Right now, I use TOTP for a ton of sites because I’m using an iPad Pro as my primary workstation, despite the fact that it has a USB-C port and I’ve got a pile of USB-C Yubikeys.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#92

Post by tialaramex »

penagwin wrote: post #84
tialaramex wrote: post #56

Earlier quoted context omitted.

There's a small downside to TOTP even if you never use it in anger. For U2F/ WebAuthn the relying party doesn't end up knowing any secrets. So if for example I get a month old database backup of Facebook, I don't learn how to log in with U2F as any of the users whose credentials I have, because Facebook can't do that either, only the legitimate users can. For TOTP that stolen data gets me in, because I can synthesize…

Interesting point - it's essentially a long lived secret. Actually what would happen if [large_comapny] had their TOTP secret revealed? Would they be forced to invalidate everyones TOTP? They can't just disable it they would have to somehow authenticate you a third way....

It's not one secret, it's a secret per pair. Imagine Anne and Barry both use TOTP with Google and Facebook, there would be one secret for (Anne,Google), one for (Anne,Facebok), one for (Barry,Google) and one for (Barry,Facebook).

A good implementation chooses the secret randomly. But both sides need to know what it is. In the example above Anne needs to know both her secrets (they'd be inside her Google Authenticator) and Facebook needs to know both their secrets (probably in a SQL database).

Stealing Facebook backups would get me the (Anne,Facebook) and (Barry,Facebook) secrets, but not the Google ones.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#94

Post by timothy-quinn »

knolax wrote: post #68
dzhiurgis wrote: post #61

Is there any security cards that just use NFC (with physical button, obviously)? I think government issued cards are good contender for this. Perhaps it could even replicate certificate authority chain principles - certain cards could sign other cards and then can be invalidated if compromised. My local id card is absolutely pathetic. I have no idea where to get a reader (although they are generic) and worst part is…

What would the benefits of NFC cards be? To me it seems more insecure given that anybody walking closely by could theoretically communicate with the card.

Typically for most keys used over NFC there's still a PIN challenge or some physical interaction with the device. There are some exemptions to this for usability (e.g. building access keys stored in PIV cards or the PIV applet in yubikeys), but in those cases too the keys are segregated by type to prevent misuse.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#95

Post by throw0101a »

penagwin wrote: post #84
tialaramex wrote: post #56

Earlier quoted context omitted.

There's a small downside to TOTP even if you never use it in anger. For U2F/ WebAuthn the relying party doesn't end up knowing any secrets. So if for example I get a month old database backup of Facebook, I don't learn how to log in with U2F as any of the users whose credentials I have, because Facebook can't do that either, only the legitimate users can. For TOTP that stolen data gets me in, because I can synthesize…

Interesting point - it's essentially a long lived secret. Actually what would happen if [large_comapny] had their TOTP secret revealed? Would they be forced to invalidate everyones TOTP? They can't just disable it they would have to somehow authenticate you a third way....

> Actually what would happen if [large_comapny] had their TOTP secret revealed? Would they be forced to invalidate everyones TOTP?

Yes.

RSA got hacked for their SecurID information, so that the attackers could then turn around and get into Lockheed Martin:

* https://gcn.com/articles/2011/06/07/rsa-confirms-tokens-used...

* https://www.scmagazine.com/home/security-news/rsa-confirms-l...

Among other things, LM makes the F-35 fighter:

* https://en.wikipedia.org/wiki/Lockheed_Martin

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#96

Post by timothy-quinn »

Fnoord wrote: post #90
kossae wrote: post #18

I thought Yubikey NEO supported NFC on iPhones. I remember reading there was some flaky support for a while, then a new SDK was released for iOS 11. Is there any advantage to using the pluggable Lightning Yubikey over the NEO? Perhaps better app support?

The NEO is a Yubikey v3. It supports NFC. v3 is the last FOSS one, but it does not support FIDO2. If you want a YubiKey with NFC which supports FIDO2, you need a YubiKey 5 (NFC version). Or a Solo with NFC (the Solo support FIDO2 and is FOSS). I happen to have one of the InCharge chargers as keychain [1] and what is interesting is that it is 3 chargers in one: one's always USB-A, other one is either USB-C or microUSB…

In my experience too with testing the NEO, they're just not as reliable to work with compared to the later models (both over NFC and USB). I believe the NEO was the first to bring in new features for the Yubikey, and the kinks weren't all ironed out yet.

If you have a NEO still, I'd recommend at least upgrading to a 4 if you can.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#97

Post by MAGZine »

mightybyte wrote: post #12
giancarlostoro wrote: post #2

> Security keys offer almost unbeatable security and can protect against a variety of threats, including nation-state attackers. Alright, I'm not a security expert, but I'm not completely illiterate to basic computer security. Anyone care to chime in how this is much more secure than a two-factor app? Sure there's the obvious, nobody can just copy the two-factor app off my phone with all the codes and have the same c…

> whose to stop someone from cloning a Yubico key? That is precisely what these devices are designed to stop. The device has a private key stored in hardware in a way that it cannot be retrieved by software. When you use one of these devices you dramatically decrease your number of attack vectors because now the attack has to happen physically. Someone has to actually steal your physical key. And because this is your…

Do not store your 2FA codes in 1Password. It turns your second factor into the same one as your password.

I was storing backup codes in 1P before I realized that I was putting all my eggs in one proverbial basket.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#98

Post by timothy-quinn »

anilakar wrote: post #85

There's still one huge disadvantage with hardware-based FIDO U2F tokens: There's no good way to migrate from one to another. I've got three(!) Yubikeys of different generations on my keyring because I'm not sure whether I have enrolled the two newer ones to all the services I'm using.

This is something I'm trying to simplify with my product. The foundational security features of U2F (you can't interrogate the device to find out what other services are set up) make it basically impossible to migrate them to new devices, but all the other capabilities of the Yubikeys can be moved across.

This is really why U2F falls over in the Enterprise, at least from what I've seen. Customers want centralised management, but the U2F protocol just can't support that.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#99

Post by timothy-quinn »

bfirsh wrote: post #93

The Yubikey website is vague, but it seems like the lightning end only works with a few apps (1Password, Brave, etc). What do I do if I want to sign in to anything else that needs 2FA? Do I still need a TOTP app?

From what I've heard from Yubico the next version of iOS is going to make it far easier to communicate with the device. Integrations will probably still need to be added by the app developers though to take full advantage.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#100

Post by djsumdog »

archi42 wrote: post #15

That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe), I found the most common problem was that websites/services don't tread these keys as first class citizens. For example GitHub: I have my two keys setup there, but I can't opt-out of SMS authentication. If I knew I could use my keys at more services, I would a…

I think the trouble is key loss. Even more than falling back to SMS is the fact that if you lose a key and don't have a recovery key file, you can basically beat the whole thing with social engineering.

In a corporate environment, it can be a bit different since if someone breaks their phone or Yubikey and needs me to disable MFA, you can make them call you, tell you the last board game you played together or the last project you helped them with, and verify their identity. But that only works in companies of ~100 developers. You get larger than that, and you can't even do that anymore, and need to fall back to pre-set security questions.

Services like Google, Github, etc. don't have huge support staffs for their free projects, so it makes sense (for them) to have these fallbacks.

Honestly, having security and unique passwords for everything (especially e-mail accounts that get password resets) is probably more important than MFA for these big services.

Post reply on HN