71–80 of 150 posts
Is there some way that it could instead be made compatible with a device like the RSA SecurID tokens? That way it remains separate from the devices I'm trying to get into and doesn't require a USB slot.
EDIT: Looks like this is now working! Looks like there is a tiny UI bug -- make sure your account is correctly selected on the Security Token page if you have multiple accounts signed in. #userError Ouch, looks like a serious downside is that a given key can only be used with one Google account. Trying to add a U2F-compatible token to more than one Google account results in errors: "This Security Key is already regis…
I just looked at the specification for this, it looks like a Google-specific limitation. There's no reason why a single site couldn't support the same U2F for multiple accounts. In fact in Google's presentation they advertise a husband and wife using the same exact token for both of their accounts [0]. [0] https://sites.google.com/site/oauthgoog/gnubby
Can I use the same Security Key with multiple Google Accounts?
Yes. You can register the same Security Key with multiple Google Accounts.
This seems to me to be a bit of a narrow market. At the upper end of secure machines, USB ports will be physically disabled. And if you're not hyper security conscious, you're not going to bother with a physical key. So with this, you need to be somewhat paranoid, but not totally paranoid.
Those same organizations would likely be looking at PKI-based smart cards that they issue themselves over something like this, though.
This seems to me to be a bit of a narrow market. At the upper end of secure machines, USB ports will be physically disabled. And if you're not hyper security conscious, you're not going to bother with a physical key. So with this, you need to be somewhat paranoid, but not totally paranoid.
You could disable USB but maybe still have NFC readers on your machines at higher levels of security?
Cool, but I will continue using the Google Authenticator app. Google is not the only thing that requires 2FA, so do numerous other sites, and GA app is the most widely supported and the least pain in the behind. I don't see a point in plugging my entire keychain (the physical keychain, with my car keys) into my laptop every time I want to log into GMail, much less carrying around 10+ different USB tokens. Now, a NFC-…
Earlier quoted context omitted.
The Yubikey website specifies that the device registers as a Keyboard, flash card, and flash reader when you plug it in. Looking at [1] it seems they make a range of products; some of their products implement multiple standards, as well as multiple USB devices. The "Premium NEO" emulates a keyboard to provide OATH HOTP, emulates a smart card reader to support PIV, and emulates a "FIDO U2F HID device" to support FIDO.…
Thanks, this is useful. As a custom USB HID device then, I wonder if the OS has to get involved? Or is custom support in the application sufficient?
Cool, but I will continue using the Google Authenticator app. Google is not the only thing that requires 2FA, so do numerous other sites, and GA app is the most widely supported and the least pain in the behind. I don't see a point in plugging my entire keychain (the physical keychain, with my car keys) into my laptop every time I want to log into GMail, much less carrying around 10+ different USB tokens. Now, a NFC-…
https://play.google.com/store/apps/details?id=com.authy.auth...
> I don't see a point in plugging my entire keychain (the physical keychain, with my car keys) into my laptop every time I want to log in
> I'm not sure about having to plug it in every time
I'll share my experience. I use two of these on a laptop and desktop and I have never unplugged them; there's no reason to. They sit very flush in the USB slot. I suppose if I ever needed the extra USB slot for something else I might unplug it.
Earlier quoted context omitted.
The Yubikey website specifies that the device registers as a Keyboard, flash card, and flash reader when you plug it in. Looking at [1] it seems they make a range of products; some of their products implement multiple standards, as well as multiple USB devices. The "Premium NEO" emulates a keyboard to provide OATH HOTP, emulates a smart card reader to support PIV, and emulates a "FIDO U2F HID device" to support FIDO.…
Thanks, this is useful. As a custom USB HID device then, I wonder if the OS has to get involved? Or is custom support in the application sufficient?
So when did a browser stop being "client software" ?
Never let the truth get in the way of a good advertising claim eh?
Earlier quoted context omitted.
So the mobile version of this would be /less/ secure than standard 2FA?
Why? Even if you can eavesdrop on the NFC communication, how does intercepting the challenge/response help you?