What I Wish I Knew About U2F and Other Hardware MFA Protocols • Hacker News Board

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#91

Post by Arainach » Sat, Apr 17, 2021, 8:16 PM UTC

pvg wrote: post #30

thatnerdyguy wrote: post #27

Earlier quoted context omitted.

That's all well and good, but a few weeks later I have another service I'm going to sign up for... I have to... first go to my safe deposit box to grab my third key? If I don't, then seems like it's a lot of bookkeeping.

You don't need to make it as elaborate as 'safe deposit box' or 'implanted into spouse' and most accounts that matter have other ways of recovery, e.g. an app-based authenticator, one-time recovery codes (a recovery code is something you might want to stick in a safe deposit box). You can just get, say, three hw keys, put one on a keychain another somewhere on your desk and a third in a drawer somewhere.

This is vulnerable to a house fire/other natural disaster. In general, I recommend having at least one thing offsite - whether that’s in a security deposit box, with a trusted friend or family member, in your desk at the office, or whatever.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#92

Post by mlac » Sat, Apr 17, 2021, 10:25 PM UTC

ecesena wrote: post #23

christiansakai wrote: post #8

For a noob like me, I am thinking to get a Yubikey. What will happen if I lose my Yubikey? Am I essentially out of luck assuming the admins can’t reset my password or associated yubikey device? How do I prevent such scenario from happening? Is there truly a fool proof way of hardware authentication?

When you enable 2FA with security keys you have 2 options, let's call them the easy and the strong. The easy. Add both a security key and OTP (e.g. Google Authenticator). You have 1 rule to strictly adhere: if you click on a link, you MUST use the security key, because that's the one that protects you against phishing. When you don't have your security key, you can just use OTP provided that you typed the url and not…

For anyone reading this and considering Advance protection, know that it causes a ton of problems with google home and other applications. I made the mistake of setting up google home with my primary google account. Which is necessary to get YouTube premium / YouTube music / YouTube TV (all associated with that account), plus all of my smart home devices that have been set up with that account over time. So when you flip on google advance protection, all of that breaks.

It’ll be a weekend project to convert over all of my smart home devices and automation away from my primary email account and transition it to a home media account. Then I will turn on google advance protection. Advance protection also puts a delay on logging into the system if you are locked out / some extra restrictions.

Until then I’m just using the key but not advanced protection. If I were starting fresh (a new smart home / google services), I’d make an email just for that and use my original address (a clean name with no numbers from 2004) strictly for mail / financial passwords / high priority accounts. The divide that I would do is smart home / subscription services used by the family gets the lower security one, everything else is high security.

I’d be interested to hear how others deal with this problem.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#93

Post by PeterisP » Sun, Apr 18, 2021, 11:04 PM UTC

ranma42 wrote: post #74

TacticalCoder wrote: post #4

From TFA: > Since the U2F device creates and stores asymmetric key pairs, and is able to sign arbitrary “challenges”, can I use it as a general-purpose hardware key store? You can however do it "the other way round" and use a private key to derive a U2F path. And that same private key can be used for many other applications (or none). For example you can use the Ledger Nano S (originally a cryptocurrencies hardware w…

> you can reinitialize your Nano S as a new U2F device According to the yubico explanation linked from article, U2F includes cloning protection (an authentication counter, which the site should check has increased vs. its last known value), so that might not actually work if the site you are authenticating against is well-implemented (Unless the Nano S also lets you back up the counter value).

Cloned (i.e. initially set up with identical seeds) yubikeys definitely work without any communication about a counter value between them; my personal setup involves two keys so that I wouldn't lose access if I lose a key. There are some obvious drawbacks of that, of course, but it is an option that works, so either that description does not apply to such devices or it is misunderstood.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#94

Post by PeterisP » Sun, Apr 18, 2021, 11:06 PM UTC

bsder wrote: post #59

TacticalCoder wrote: post #4

From TFA: > Since the U2F device creates and stores asymmetric key pairs, and is able to sign arbitrary “challenges”, can I use it as a general-purpose hardware key store? You can however do it "the other way round" and use a private key to derive a U2F path. And that same private key can be used for many other applications (or none). For example you can use the Ledger Nano S (originally a cryptocurrencies hardware w…

> Additionally as long as you've got your secret, you can reinitialize your Nano S (or another one) as a new U2F device and there's no need to reset your U2F credentials on the site as the newly initialized device shall work exactly as if it was the old one. But isn't it the whole point that these devices never let you have the secret?

The devices don't let you extract the secret, however, they generally can be set up with a secret that you know.

Re: What I Wish I Knew About U2F and Other Hardware MFA Protocols

#95

Post by PeterisP » Sun, Apr 18, 2021, 11:13 PM UTC

tialaramex wrote: post #53

droopyEyelids wrote: post #47

Earlier quoted context omitted.

https://www.yubico.com/support/download/yubikey-personalizat... you can do a lot with a yubikey but idk if you can actually change the U2F secret

You can tell the device you want a new random secret (so now your existing credentials don't work), but you can't get the secret out (obviously bad guys would use that, so it would be a terrible idea) neither can you set the current one to an explicit value.

You definitely can initialize Yubikey OATH-TOTP with a known value in order to have multiple devices with identical secrets. I have done that, also see https://support.yubico.com/hc/en-us/articles/360016614880-Ca...