31–40 of 150 posts
This seems to me to be a bit of a narrow market. At the upper end of secure machines, USB ports will be physically disabled. And if you're not hyper security conscious, you're not going to bother with a physical key. So with this, you need to be somewhat paranoid, but not totally paranoid.
I don't get this, what about malware pretending to be a browser? Is there a protection against this in protocol
My ideal would be to use Security Key to bypass 2-step on devices that supported it and then use 2-step elsewhere.
For example, some public computers have the USB port literally glued shut, therefore Security Key won't work. In those cases I'll still have my phone with me and could bypass it via 2-step.
Essentially I want to use the Security Key as a way to save me typing in my 2-step code because I'm lazy, rather than to "add" security.
Google's current 2-step "remember-device" doesn't really work for me as it utilises cookies which get cleared. I could add it to a white-list of preserved cookies but they use obscure often changing sub-domains.
Could we instead use smartwatch Bluetooth or NFC (probably better, I don't like the long range of Bluetooth for something like this) to unlock sites instead of these USB keys? Does the FIDO Alliance support such a protocol? I know Android 5.0 supports that but it's only for unlocking the phones (and Chromebooks I believe). But what about sites? Or is that too risky compared to an USB key?
This doesn't look like they're planning to start supporting existing smartcards, but hopefully it's a first step?
My idea was to create a login page that requires the user to sign a secret with their private key which can be completed manually, but also automatically with the click of a button if the extension is installed. The key could live securely on a smartcard or in the user's gpg keyring, it doesn't matter as that part is deferred to gpg.
In case anyone happens to be interested, my un-documented prototype sits at https://github.com/r04r/GPGThing. It consists of a chrome extension, a golang application do some juggling between json input/output (which is a limitation by chrome native message passing) and gpg, and apache configs to set it up as an authentication method.
There's some more hacks necessary to get it working on chromebook, including a crouton installation with gpg.
Earlier quoted context omitted.
The device probably registers as a USB keyboard, and it "types out" the 2-factor code when you tap it.
[deleted]
Not much of an improvement over 2FA using my phone because the times when I really need it to be easy is when I'm browsing on my phone. Since this is USB I can't use it on my phone. When I'm on my laptop I just pull out my phone and type in a short code and be done with it.