Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico launches its dual USB-C and Lightning two-factor security key

techcrunch.com

Post reply on HN
Print view View original

141–150 of 178 posts

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#141

Post by gcbw2 »

archi42 wrote: post #15

That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe), I found the most common problem was that websites/services don't tread these keys as first class citizens. For example GitHub: I have my two keys setup there, but I can't opt-out of SMS authentication. If I knew I could use my keys at more services, I would a…

github (and everything microsoft) have two incentives for forcing SMS always: Advertising* and US law.

* github has no ads, yet. But microsoft is the 3rd largest.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#144

Post by GoMonad »

Freak_NL wrote: post #42
aequitas wrote: post #20

Earlier quoted context omitted.

It might not be impossible, but surely non-trivial. Add to that that it has to be done in a undetectable way and the key owner needs to be parted for the key in the time it takes to make the clone.

You'd probably destroy the key's shell in the process of getting to the microchip (you can't get to the private key via the USB connector by design, so decapping is probably the only way to do it), so you would have to have a clone ready that looks exactly like the key you've just disfigured to get to the secret key.

Moreover, if a physically undetected clone is managed, it will be detected soon through the spec. The WebAuthn spec includes monitoring an always increasing counter for each key/site pair. One of the clones will start to fail.

So really there's no point in cloning. Straight up theft is the bigger concern.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#145

Post by jxcl »

alasarmas wrote: post #140
jxcl wrote: post #69

Earlier quoted context omitted.

Fastmail allows you to do this too. They have a long section in the documentation that strongly discourages it, and it seems like they will refuse to restore your account if you lose your 2FA, which is exactly what I want: https://www.fastmail.com/help/account/2fa.html >> Why do I have to add a recovery phone number to set up two-step verification? > Keeping your account safe from attackers is very important. But so…

Fastmail used to have a mechanism where you could hold down (I believe) on that screen and phone number would no longer be a required field to continue creating your account. Maybe that's still possible.

I don't remember phone number being required while creating an account, they only wanted to collect it when enabling 2FA. If I recall correctly they had a little info button that said something like "we need this to start but you can remove it later if you _really_ want to."

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#146

Post by philsnow »

akerl_ wrote: post #103
throw0101a wrote: post #101

Earlier quoted context omitted.

While the resulting codes you get at the end of the process are only six digits, the TOTP secret can really be any length. Everything is fed into an HMAC after all. It's only the last step where truncation occurs.

Yes, but the key space to brute force is the key space after truncation. You don’t need to brute force the original seed.

If an attacker can (for whatever reason, be it rate limiting or cost) only brute force 100 guesses per time period (say, 30s), they'll expect to be able to 'win' the challenge in about 58 hours.

The probability of guessing the challenge _wrong_ once is (1 - (100 / 1000000)). Every 30 seconds you get another chance. The probability of guessing the challenge wrong N times in a row is (1 - (100/1000000)) ^ N. Around chance number 7000, the probability that you've guessed it wrong all N times goes lower than 50/50. ~7000 * 30s in hours is around 58 hours.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#147

Post by ahelwer »

anilakar wrote: post #85

There's still one huge disadvantage with hardware-based FIDO U2F tokens: There's no good way to migrate from one to another. I've got three(!) Yubikeys of different generations on my keyring because I'm not sure whether I have enrolled the two newer ones to all the services I'm using.

The absolute dream is to have a single nonprofit OAuth identity provider against which people can prove their identities with FIDO U2F, then use the issued tokens to auth with services of their choosing. Building this network is incredibly hard, though (what website would accept an identity provider without any users, and what users would use an identity provider not accepted by any websites?) so the most popular implementations are hosted by Google or Facebook - but there you have all the obvious privacy issues.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#148

Post by OJFord »

Does the 5C/Nano work with Android phones with USB-C?

I thought I was waiting for a 5C NFC, but maybe I've been overlooking the obvious. For some reason it never occured to me that it might work plugged directly into my phone if only it had the right shape.

(I have a 5 Nano, which was great until I got a USB-C Macbook and broke several keychain adapters before giving in and buying one of those hubs that stick on one side converting the 2x USB-C to the same + USB-A, HDMI, and SD.)

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#149

Post by rullgrus »

deanclatworthy wrote: post #114

Strong advise anyone considering putting one of these on their keychains to consider otherwise. The actual connector of my usb-c version has warped in my pocket over time and it’s now not recognised.

I wonder how hard it is to create a really sturdy USB-C plug. The connector on all of the USB-C cables I have does seem a little flimsy.

I have an YubiKey 5 NFC on the keychan and it has handled the abuse over the years just fine.

Re: Yubico launches its dual USB-C and Lightning two-factor security key

#150

Post by jwr »

archi42 wrote: post #73
akerl_ wrote: post #62

Earlier quoted context omitted.

I’m not sure what you mean. I have SMS and Fallback SMS both disabled: https://imgur.com/a/bLnRuOq

Hm, but you have an Authenticator App enabled. If I "Edit" my SMS Number, I get to choose whether I want to proceed with "Set up using app" or "Set up using SMS", but not "Set up using security key". The point of having two keys is that there is no need for neither an authenticator app nor SMS.

> The point of having two keys is that there is no need for neither an authenticator app nor SMS

I think they are striking a reasonable compromise. I am OK with using U2F and having TOTP authenticator as a backup plan.

I am definitely NOT OK with requiring SMS for authentication, though, which is unfortunately the direction all the corporate sheep seem to be taking (namely, banks).

Post reply on HN