Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico launches its dual USB-C and Lightning two-factor security key

techcrunch.com

Post reply on HN
Print view View original

131–140 of 178 posts

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#131

Post by srathi »

antsar wrote: post #55
Macha wrote: post #50

Earlier quoted context omitted.

My understanding is the issues that lead to U2F being considered to be better than TOTP were mainly about it being phished easily compared something which will only dispense the right code with the right challenge. But if you never actually login with TOTP, and always use your U2F key, then does it actually decrease security to have it as a backup/removal option and you know that's the only reason you'd enter it. It…

TOTP is one thing. Having your backup TOTP key locked in a safe effectively stops it from being abused. SMS 2FA, on the other hand, has real security issues[0][1]. In my experience, SMS 2FA is most commonly the required type of 2FA, before you can add TOTP/U2F as a secondary. SMS 2FA is the hardest to lose or break, so forcing everyone to keep it enabled minimizes support costs for the provider. [0] https://www.there…

Using Authy may be a good idea. There is a slight risk of exposing the TOTP key to the cloud, but having it available on all devices (current and future) is very convenient. Authy has an option to encrypt the key using a user specified passphrase, so it is at least better than storing the raw TOTP key in the cloud.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#132

Post by techsupporter »

munchbunny wrote: post #35
archi42 wrote: post #15

That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe), I found the most common problem was that websites/services don't tread these keys as first class citizens. For example GitHub: I have my two keys setup there, but I can't opt-out of SMS authentication. If I knew I could use my keys at more services, I would a…

I'm surprised that you can't remove/disable the fallback SMS number. One thing you can do to mitigate that problem is to create a Google Voice number. Those are harder to port as long as you created it on Google Voice.

> Those are harder to port as long as you created it on Google Voice.

I hope this myth goes away soon. It is trivial for any bad actor to force-port a number, even if it is reclaimed a day or two later. If I wanted to get fired, I could yank your GV number (which is, most of the time, really at Bandwidth.com) in a few minutes; the medium-sized voice provider I am at does several of these types of ports a week to help customers trying to leave recalcitrant providers.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#133

Post by munchbunny »

polack wrote: post #126
munchbunny wrote: post #58

Earlier quoted context omitted.

Short version: the FIPS is for enterprise. The Security Key is for consumers. The 5 series is for enterprise or power users. This might be more useful for you: https://www.yubico.com/products/yubikey-hardware/compare-pro... You want the Yubikey FIPS if you're using it in a context where FIPS compliance matters, such as US government. If not (such as for personal use), then don't bother. The Security Key series is the…

The Yubikey requires a password by default to use the ssh key stored on it and it will lock itself after 3 failed attempts. So I don’t think your caveat is valid. I rather have my encryption key on hardware design to keep anyone who finds it from brute forcing it than just password protected on a hard drive.

Yup you're right, I mixed up the PIV behavior with specifics around FIDO2 vs. U2F PIN policies.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#134

Post by davchana »

munchbunny wrote: post #44
jeromegv wrote: post #39

Earlier quoted context omitted.

A solution often mentioned but not available to anyone outside the US.

Can you create one that doesn't forward to your phone? Could a US friend create one for you in a new account and hand that account over to you? It's more about sinking that second factor somewhere that can't be redirected and only you can theoretically access by logging into Google Voice. You don't have to forward the messages to your actual phone.

I think each Google Voice number needs a real US phone number, where calls/texts sent to GV Number will be forwarded to.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#135

Post by mfontani »

bfirsh wrote: post #93

The Yubikey website is vague, but it seems like the lightning end only works with a few apps (1Password, Brave, etc). What do I do if I want to sign in to anything else that needs 2FA? Do I still need a TOTP app?

You can use Yubico Authenticator for TOTP, "but" that only supports up to 32 slots.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#136

Post by mfontani »

somepig wrote: post #45
cj wrote: post #24

Earlier quoted context omitted.

Last year I got the Google Titan security keys and connected it with all of my work + personal accounts that support it. The #1 weakness is the simple fact that many services don't allow you to disable alternate forms of 2fa. Github is an example, you can always trigger the fallback SMS 2fa code. Dashlane is another example (and arguably the most important). It's impossible to make your security key the only form of…

regular "app based" is just OATH-TOTP in most cases. This uses a shared secret and the time to generate one time codes. The Yubikey explicitly supports TOTP, and will happily store your secret on the key. You can then use Yubioath to pull codes from the Yubikey as needed. I'm a huge fan of the ability to use either U2F or TOTP with the same hardware token.

Note that the Yubikey only supports up to 32 TOTP.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#137

Post by apple4ever »

bfirsh wrote: post #119
timothy-quinn wrote: post #99

Earlier quoted context omitted.

From what I've heard from Yubico the next version of iOS is going to make it far easier to communicate with the device. Integrations will probably still need to be added by the app developers though to take full advantage.

Do you know whether that includes websites in Safari? If I can’t use 2FA for that, I don’t see how I can use a Yubikey.

That's my biggest problem. Until I can use a key in Safari and on iOS, they are useless for me.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#138

Post by apex3stoker »

cj wrote: post #24
archi42 wrote: post #15

That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe), I found the most common problem was that websites/services don't tread these keys as first class citizens. For example GitHub: I have my two keys setup there, but I can't opt-out of SMS authentication. If I knew I could use my keys at more services, I would a…

Last year I got the Google Titan security keys and connected it with all of my work + personal accounts that support it. The #1 weakness is the simple fact that many services don't allow you to disable alternate forms of 2fa. Github is an example, you can always trigger the fallback SMS 2fa code. Dashlane is another example (and arguably the most important). It's impossible to make your security key the only form of…

> What's the point of using security keys with services that require regular SMS or app-based 2-FA as a fallback?

It addresses the problem with phishing. The main problem with Authenticator is not that an attacker knows the one-time password, but that an attacker tricks user into entering the one-time password to their UI and uses that right away to take control of the user's account.

https://krebsonsecurity.com/2018/07/google-security-keys-neu...

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#140

Post by alasarmas »

jxcl wrote: post #69
cj wrote: post #24

Earlier quoted context omitted.

Last year I got the Google Titan security keys and connected it with all of my work + personal accounts that support it. The #1 weakness is the simple fact that many services don't allow you to disable alternate forms of 2fa. Github is an example, you can always trigger the fallback SMS 2fa code. Dashlane is another example (and arguably the most important). It's impossible to make your security key the only form of…

Fastmail allows you to do this too. They have a long section in the documentation that strongly discourages it, and it seems like they will refuse to restore your account if you lose your 2FA, which is exactly what I want: https://www.fastmail.com/help/account/2fa.html >> Why do I have to add a recovery phone number to set up two-step verification? > Keeping your account safe from attackers is very important. But so…

Fastmail used to have a mechanism where you could hold down (I believe) on that screen and phone number would no longer be a required field to continue creating your account. Maybe that's still possible.
Post reply on HN