Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Strengthening 2-Step Verification with Security Key

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

81–90 of 150 posts

Re: Strengthening 2-Step Verification with Security Key

#81

Post by semenko »

tantalor wrote: post #78

Some comments are pointing out how awkward this might be, > I don't see a point in plugging my entire keychain (the physical keychain, with my car keys) into my laptop every time I want to log in > I'm not sure about having to plug it in every time I'll share my experience. I use two of these on a laptop and desktop and I have never unplugged them; there's no reason to. They sit very flush in the USB slot. I suppose…

Yeah, it looks like more reasonably priced U2F/FIDO tokens are coming soon, probably to the Play Store.

Behind the scenes, the auth layer in Chrome is handled by a sneaky extension. There's a huge listing of product IDs in the manifest, all likely to launch very soon: https://chromium.googlesource.com/chromium/src.git/+/master/...

(And some explicit Play Store references: https://chromium.googlesource.com/chromium/src.git/+/c6b104c... )

Re: Strengthening 2-Step Verification with Security Key

#82

Post by aroman »

jlgaddis wrote: post #73
barrkel wrote: post #15

This seems to me to be a bit of a narrow market. At the upper end of secure machines, USB ports will be physically disabled. And if you're not hyper security conscious, you're not going to bother with a physical key. So with this, you need to be somewhat paranoid, but not totally paranoid.

> At the upper end of secure machines, USB ports will be physically disabled. Those same organizations would likely be looking at PKI-based smart cards that they issue themselves over something like this, though.

Yes, and that's exactly OP's point — it's a narrow market.

Re: Strengthening 2-Step Verification with Security Key

#83

Post by yanonymator »

Good luck plugging a USB key into your iPad, or letting your security-sensitive workplace let you plug arbitrary USB keys into your workstation, or convincing your bank that you really did not send your entire balance to Nigeria, even though you signed that transaction with a tap, etc etc...

Remember Mt.Gox? That's Yubico's most public failure so far :-)

Strong authentication needs to be out-of-band, and support transaction signing, and work everywhere, or there's no point using it. You can't get "out of band" with anything that you "plug in" - that's simply connecting it directly to the same threats.

You also can't get "secure" when less than 100% of users can enjoy it's protection - it only needs to "not work" on one model of iPad, and it opens up the door to support bugs like "I can't log in to XYZ from my iPad 2" - so they need to give customers alternate access methods, like printable codes or recovery/bypass emails etc, at which point the entire protection goes out the window because that's just what the phishing gangs need to bypass it all.

Solving half the problem, even if you paint it blue and write lots of nice publicity about it, does not a secure solution make!

Re: Strengthening 2-Step Verification with Security Key

#84

Post by IgorPartola »

andreyf wrote: post #75
IgorPartola wrote: post #69

Cool, but I will continue using the Google Authenticator app. Google is not the only thing that requires 2FA, so do numerous other sites, and GA app is the most widely supported and the least pain in the behind. I don't see a point in plugging my entire keychain (the physical keychain, with my car keys) into my laptop every time I want to log into GMail, much less carrying around 10+ different USB tokens. Now, a NFC-…

rtfa: "As more sites and browsers come onboard, security-sensitive users can carry a single Security Key that works everywhere FIDO U2F is supported."

First, where would I carry this key? My phone is always with me, while my keys are not. (Yes, I know I could use the exercise to go get them when I am home, etc.). I also am not fond of attaching my entire keychain to the USB port of my laptop: I have broken several USB ports on older laptops this way. Taking the USB key off the keychain will inevitably result in me losing this small item (that's knowing me, not the same for everyone obviously).

Second, the GA-style 2FA works great because it's so easy to support and so many things support it. TFA mentions more browser support. Well, I use 2FA for more than just the web. For example, ssh supports it. I am all for this becoming a standard and being more widely adopted, but the security vs usability tradeoff for me here is just not worth it. With these physical tokens I get marginally better security than with the GA app, while giving me a much worse experience.

Re: Strengthening 2-Step Verification with Security Key

#85

Post by yanonymator »

higherpurpose wrote: post #11
wnevets wrote: post #2

is this the result of the partnership with yubikey?

Google is supporting the FIDO U2F standard just like Yubikey now.

They pay upwards of $100k+ per year to have a seat on the board and direct the "standard" to suit their products.

Re: Strengthening 2-Step Verification with Security Key

#86

Post by yanonymator »

wmf wrote: post #55
bluesign wrote: post #7

I don't get this, what about malware pretending to be a browser? Is there a protection against this in protocol

Yes, I think the protocol protects against MITM and replay attacks. http://fidoalliance.org/specs/fido-security-ref-v1.0-rd-2014...

No, not really - if you're a MITM, you control what the user sees, as well as what gets sent to the device, and nothing prevents those 2 things being different. You might SEE that you're sending $100 to Grandma, but when you tap the key, you're authenticating your entire bank balance to some place in the Bahamas.

Re: Strengthening 2-Step Verification with Security Key

#87

Post by amluto »

yanonymator wrote: post #83

Good luck plugging a USB key into your iPad, or letting your security-sensitive workplace let you plug arbitrary USB keys into your workstation, or convincing your bank that you really did not send your entire balance to Nigeria, even though you signed that transaction with a tap, etc etc... Remember Mt.Gox? That's Yubico's most public failure so far :-) Strong authentication needs to be out-of-band, and support tran…

The prototype I've seen requires that you tap it, which is a major step forward. And I believe that the spec allows it to show something like "google.com" if it had a screen.

Re: Strengthening 2-Step Verification with Security Key

#88

Post by nyolfen »

yanonymator wrote: post #83

Good luck plugging a USB key into your iPad, or letting your security-sensitive workplace let you plug arbitrary USB keys into your workstation, or convincing your bank that you really did not send your entire balance to Nigeria, even though you signed that transaction with a tap, etc etc... Remember Mt.Gox? That's Yubico's most public failure so far :-) Strong authentication needs to be out-of-band, and support tran…

were mtgox accounts using yubikeys compromised or something? all i know of was the transaction malleability thing

Re: Strengthening 2-Step Verification with Security Key

#89

Post by amluto »

AdmiralAsshat wrote: post #71

I like the idea of a physical key distinct from the phone, but I'm not sure about having to plug it in every time and/or restricting it to Chrome devices. Is there some way that it could instead be made compatible with a device like the RSA SecurID tokens? That way it remains separate from the devices I'm trying to get into and doesn't require a USB slot.

Unfortunately, the FIDO Alliance seems to have forgotten to specify CCID bindings for U2F (i.e. they left out the trivial part of the protocol that would describe how to talk to one of these tokens in a smart card slot or over NFC). The specs describe USB HID bindings.

https://fidoalliance.org/specifications/download

Re: Strengthening 2-Step Verification with Security Key

#90

Post by rictic »

IgorPartola wrote: post #84
andreyf wrote: post #75

Earlier quoted context omitted.

rtfa: "As more sites and browsers come onboard, security-sensitive users can carry a single Security Key that works everywhere FIDO U2F is supported."

First, where would I carry this key? My phone is always with me, while my keys are not. (Yes, I know I could use the exercise to go get them when I am home, etc.). I also am not fond of attaching my entire keychain to the USB port of my laptop: I have broken several USB ports on older laptops this way. Taking the USB key off the keychain will inevitably result in me losing this small item (that's knowing me, not the…

Unlike usb drives though you don't need to leave this plugged in for more than a couple seconds, which greatly limits the danger of damaging your usb port.
Post reply on HN