Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico launches its dual USB-C and Lightning two-factor security key

techcrunch.com

Post reply on HN
Print view View original

101–110 of 178 posts

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#101

Post by throw0101a »

akerl_ wrote: post #82
morpheuskafka wrote: post #76

Earlier quoted context omitted.

TOTP, unlike a password, can't be brute-forced. If the secret is lost, its game over, but if the secret stays protected, you can't guess it because you can only test the codes, not the secret itself. Brute-force for TOTP would only be possible if you could test 2^6 OTPs in the 60-second window, which would be mitigated by rate-limiting. So it really doesn't do any hard to have TOTP enabled as a fallback if you never…

It’s worth noting that TOTP secrets are more vulnerable than passwords on the service-provider side. They have relatively tiny key space (generally 6 digits), so if the provider doesn’t protect against brute-force, it’s quick and easy to slam the whole key space until you win. They also need the secret in a reversible format, since the service provider has to use the secret to calculate valid codes. So the most commo…

While the resulting codes you get at the end of the process are only six digits, the TOTP secret can really be any length.

Everything is fed into an HMAC after all. It's only the last step where truncation occurs.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#102

Post by tialaramex »

giancarlostoro wrote: post #43
devonkim wrote: post #31

Earlier quoted context omitted.

Lockheed has a great deal of their MFA keys compromised because the factory that manufactured them had been breached for a while and nobody had noticed. Supply chain attacks are performed constantly against large, known entities and this case shows why they are so pedantic about security and justified in their paranoia. The problems have been execution of the policy and the costs of compliance.

Ah this sounds familiar... Probably saw the article here on HN ages back and forgot. I mostly ask cause I don't have one of these keys but if I were to consider getting one I'd want to know what a good option would be.

You should look for a vendor which understands that knowing the secret key inside the Security Key (that's how all the vaguely cheap ones work, they have a random secret AES key inside them, that's enough to do everything else securely) is a terrible idea and so they should arrange for the key to be chosen randomly and never recorded at all.

With SecurID and similar technologies vendors technically didn't need to retain the secrets inside those devices after they'd been manufactured and shipped, but you can see the practical temptation.

On a smaller scale, since the system doesn't use a shared secret you should just swap a brand new Security Key with somebody else or if deploying to an organisation just muddle them and let people pick whichever one they want. You don't care which key you have, the more random the better.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#103

Post by akerl_ »

throw0101a wrote: post #101
akerl_ wrote: post #82

Earlier quoted context omitted.

It’s worth noting that TOTP secrets are more vulnerable than passwords on the service-provider side. They have relatively tiny key space (generally 6 digits), so if the provider doesn’t protect against brute-force, it’s quick and easy to slam the whole key space until you win. They also need the secret in a reversible format, since the service provider has to use the secret to calculate valid codes. So the most commo…

While the resulting codes you get at the end of the process are only six digits, the TOTP secret can really be any length. Everything is fed into an HMAC after all. It's only the last step where truncation occurs.

Yes, but the key space to brute force is the key space after truncation. You don’t need to brute force the original seed.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#104

Post by haunter »

munchbunny wrote: post #58
haunter wrote: post #37

I tried the quiz to get a recommendation but it finishes in an endless loop > learn more > quiz starts again https://www.yubico.com/quiz/ Also can anyone explain the multiple models too me? https://www.yubico.com/products/yubikey-hardware/ Say I want an USB-A key, I can choose from three and they all have different prices. The Security Keys are less secure than a FIPS or a 5? Maybe I'm just too end user but the multi…

Short version: the FIPS is for enterprise. The Security Key is for consumers. The 5 series is for enterprise or power users. This might be more useful for you: https://www.yubico.com/products/yubikey-hardware/compare-pro... You want the Yubikey FIPS if you're using it in a context where FIPS compliance matters, such as US government. If not (such as for personal use), then don't bother. The Security Key series is the…

Thank you so much that was really useful!

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#105

Post by yborg »

antsar wrote: post #55
Macha wrote: post #50

Earlier quoted context omitted.

My understanding is the issues that lead to U2F being considered to be better than TOTP were mainly about it being phished easily compared something which will only dispense the right code with the right challenge. But if you never actually login with TOTP, and always use your U2F key, then does it actually decrease security to have it as a backup/removal option and you know that's the only reason you'd enter it. It…

TOTP is one thing. Having your backup TOTP key locked in a safe effectively stops it from being abused. SMS 2FA, on the other hand, has real security issues[0][1]. In my experience, SMS 2FA is most commonly the required type of 2FA, before you can add TOTP/U2F as a secondary. SMS 2FA is the hardest to lose or break, so forcing everyone to keep it enabled minimizes support costs for the provider. [0] https://www.there…

The other thing driving SMS 2FA is that this is a clean way for the site/org to get their hands on a real phone number for you with no extra effort.

SMS 2FA has been repeatedly proven to be trivial to break with a simple phone call to a mobile provider, since there so far is no downside at all that I am aware of to the providers. If someone jacks your SMS and drains your bank account, at least in the US your mobile provider just goes "oops". Until there is some penalty for them allowing your number to be ported without your consent, SMS is essentially useless for real 2FA security. Even if the account security was foolproof, though, it still is vulnerable to SS7 routing attacks.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#106

Post by mschuster91 »

vinay427 wrote: post #64
mschuster91 wrote: post #63

Earlier quoted context omitted.

> I think government issued cards are good contender for this. For this, devices would have to support real NFC in the first place. iPhones/iPads don't allow app usage of NFC, and the flagship Samsung tablets don't ship with it at all.

Most modern Android phones, or at least the Samsung ones and probably Google ones I have used, allow for virtually full read/write NFC access as far as I can tell.

That would require NFC support in the first place. Just imagine: all flagship tablet models of Samsung do not ship with NFC. What kind of nonsense is that?!

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#107

Post by mpettitt »

MAGZine wrote: post #97
mightybyte wrote: post #12

Earlier quoted context omitted.

> whose to stop someone from cloning a Yubico key? That is precisely what these devices are designed to stop. The device has a private key stored in hardware in a way that it cannot be retrieved by software. When you use one of these devices you dramatically decrease your number of attack vectors because now the attack has to happen physically. Someone has to actually steal your physical key. And because this is your…

Do not store your 2FA codes in 1Password. It turns your second factor into the same one as your password. I was storing backup codes in 1P before I realized that I was putting all my eggs in one proverbial basket.

Not quite - if someone steals your 1Password (or equivalent) database with TOTP seeds in, they need to crack the password on that, then have full access to everything. If they get the password from the other end (e.g. the site you log into), they can probably log into that specific site (they will have the TOTP seed), but not anything else. In general, there are more attackers looking at the site end than at the client password DB end.

Probably wouldn't be a bad idea to have a distinct password vault for TOTP seeds, although they'll be stored on whatever device you generate codes from anyway (hopefully in a secure way). At the very least, it might be helpful for moving between TOTP devices without needing to do the random steps required by different services!

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#108

Post by sly010 »

archi42 wrote: post #15

That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe), I found the most common problem was that websites/services don't tread these keys as first class citizens. For example GitHub: I have my two keys setup there, but I can't opt-out of SMS authentication. If I knew I could use my keys at more services, I would a…

Also, I have yet to find an Electron based app that supports it. On the other hand I was positively surprised when it just worked on Android (for Google login).

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#109

Post by coughlanio »

akerl_ wrote: post #65
po wrote: post #53

Earlier quoted context omitted.

In addition to what you're saying, I also would like to register multiple keys to services such that any one would work, not that both are required. I don't need them to be nuclear keys... I want a backup key stored in a safe and one on my keychain. This seems to be very uncommon amongst service providers.

I’d say this is actually the most common. I’m not aware of any websites that allow >1 U2F/FIDO key in the configuration where you need to use all-of-them to log in. Sites either only support 1 key, or support multiple keys and you need 1 of them to log in.

Yep, I recently got Google's Titan pair of keys, and anywhere that supports hardware keys, I was able to register both, and I'm only required to use one to login.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#110

Post by [deleted] »

haunter wrote: post #37

I tried the quiz to get a recommendation but it finishes in an endless loop > learn more > quiz starts again https://www.yubico.com/quiz/ Also can anyone explain the multiple models too me? https://www.yubico.com/products/yubikey-hardware/ Say I want an USB-A key, I can choose from three and they all have different prices. The Security Keys are less secure than a FIPS or a 5? Maybe I'm just too end user but the multi…

[deleted]
Post reply on HN