Strengthening 2-Step Verification with Security Key

Post by Buge » Tue, Oct 21, 2014, 4:24 PM UTC

mankyd wrote: post #61

eykanal wrote: post #43

So, we recently had a bunch of articles coming out on "the fundamental insecurity of USB" [1]. How does that jive with a USB-based security key? Can't this be "flashed" like any other USB device? [1]: https://www.schneier.com/blog/archives/2014/07/the_fundament...

The insecurity relates the problem with allowing random usb devices to be plugged into a computer. Specifically, it points out that, even if you wipe an usb stick, you still can't trust that it's safe. The devices that Google is referring to should be inherently safe. If you don't trust the supplier of these devices then yes, that's an issue. But, in theory, you receive these from a trusted source. As long as the dev…

Post by scott_karana » Tue, Oct 21, 2014, 4:29 PM UTC

sciurus wrote: post #77

IgorPartola wrote: post #69

Cool, but I will continue using the Google Authenticator app. Google is not the only thing that requires 2FA, so do numerous other sites, and GA app is the most widely supported and the least pain in the behind. I don't see a point in plugging my entire keychain (the physical keychain, with my car keys) into my laptop every time I want to log into GMail, much less carrying around 10+ different USB tokens. Now, a NFC-…

IMHO the Authy app is nicer than Google Authenticator. https://play.google.com/store/apps/details?id=com.authy.auth... http://itunes.apple.com/us/app/authy/id494168017?mt=8

  Device & app history
      read sensitive log data
  
  Identity
      find accounts on the device
  
  Camera/Microphone
      take pictures and videos
  
  Wi-Fi connection information
      view Wi-Fi connections
  
  Other
      receive data from Internet
      access Bluetooth settings
      pair with Bluetooth devices
      full network access
      view network connections
      control vibration
      prevent device from sleeping
      send sticky broadcast

  Identity
      find accounts on the device
  
  Other
      control vibration
      full network access
      use accounts on the device
      create accounts and set passwords
      close other apps

Post by semenko » Tue, Oct 21, 2014, 4:36 PM UTC

Post by [deleted] » Tue, Oct 21, 2014, 4:37 PM UTC

rictic wrote: post #92

semenko wrote: post #58

EDIT: Looks like this is now working! Looks like there is a tiny UI bug -- make sure your account is correctly selected on the Security Token page if you have multiple accounts signed in. #userError Ouch, looks like a serious downside is that a given key can only be used with one Google account. Trying to add a U2F-compatible token to more than one Google account results in errors: "This Security Key is already regis…

Huh, that's odd. I just registered a second google account with the same security key and everything seems to have gone fine. I'd recommend filing a bug and/or posting more details here.

Post by angryasian » Tue, Oct 21, 2014, 4:39 PM UTC

yanonymator wrote: post #83

Good luck plugging a USB key into your iPad, or letting your security-sensitive workplace let you plug arbitrary USB keys into your workstation, or convincing your bank that you really did not send your entire balance to Nigeria, even though you signed that transaction with a tap, etc etc... Remember Mt.Gox? That's Yubico's most public failure so far :-) Strong authentication needs to be out-of-band, and support tran…