Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Strengthening 2-Step Verification with Security Key

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

121–130 of 150 posts

Re: Strengthening 2-Step Verification with Security Key

#121

Post by jrockway »

PeterisP wrote: post #114
wffurr wrote: post #109

Earlier quoted context omitted.

Don't keep it on the same keychain as your car keys. I don't–that would be terribly impractical. Instead, it lives in my laptop slipcase. Even better, get the nano version and leave it in your USB slot permanently: http://www.amazon.com/dp/B00O8ST7MM

Isn't this kind of counterproductive? A key use case of 2FA is to keep your accounts secure if your computer is simply stolen.

Unless you don't click "Remember this computer for 30 days" and log in every time, 2FA isn't protecting you from stolen computers.

Security key protects you from phishing and someone on the Internet guessing your password.

(Many security keys are designed to be permanently installed in your computer, like this one: http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7...)

Re: Strengthening 2-Step Verification with Security Key

#122

Post by exhilaration »

semenko wrote: post #81
tantalor wrote: post #78

Some comments are pointing out how awkward this might be, > I don't see a point in plugging my entire keychain (the physical keychain, with my car keys) into my laptop every time I want to log in > I'm not sure about having to plug it in every time I'll share my experience. I use two of these on a laptop and desktop and I have never unplugged them; there's no reason to. They sit very flush in the USB slot. I suppose…

Yeah, it looks like more reasonably priced U2F/FIDO tokens are coming soon, probably to the Play Store. Behind the scenes, the auth layer in Chrome is handled by a sneaky extension. There's a huge listing of product IDs in the manifest, all likely to launch very soon: https://chromium.googlesource.com/chromium/src.git/+/master/... (And some explicit Play Store references: https://chromium.googlesource.com/chromium/sr…

$6 is pretty reasonable, on Amazon: http://www.amazon.com/Plug-up-International-U2F-SK-01-FIDO-S...

Re: Strengthening 2-Step Verification with Security Key

#123

Post by richbradshaw »

aroman wrote: post #82
jlgaddis wrote: post #73

Earlier quoted context omitted.

> At the upper end of secure machines, USB ports will be physically disabled. Those same organizations would likely be looking at PKI-based smart cards that they issue themselves over something like this, though.

Yes, and that's exactly OP's point — it's a narrow market.

A narrow market that includes all domestic Chrome users who use Google services.

Re: Strengthening 2-Step Verification with Security Key

#124

Post by mastre_ »

IgorPartola wrote: post #69

Cool, but I will continue using the Google Authenticator app. Google is not the only thing that requires 2FA, so do numerous other sites, and GA app is the most widely supported and the least pain in the behind. I don't see a point in plugging my entire keychain (the physical keychain, with my car keys) into my laptop every time I want to log into GMail, much less carrying around 10+ different USB tokens. Now, a NFC-…

> Now, a NFC-based token where I don't have to type anything in, or an iWatch/FitBit/whatever type wearable as a token would be pretty cool.

The YubiKey NEO http://www.amazon.com/dp/B00LX8KZZ8 supports NFC, there's a picture of it sitting on top of what appears to be a Nexus 5 on the linked Amazon page. There's nothing stopping Google from making mobile Chrome work with it over NFC.

Re: Strengthening 2-Step Verification with Security Key

#125

Post by cdr »

jrockway wrote: post #121
PeterisP wrote: post #114

Earlier quoted context omitted.

Isn't this kind of counterproductive? A key use case of 2FA is to keep your accounts secure if your computer is simply stolen.

Unless you don't click "Remember this computer for 30 days" and log in every time, 2FA isn't protecting you from stolen computers. Security key protects you from phishing and someone on the Internet guessing your password. (Many security keys are designed to be permanently installed in your computer, like this one: http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7... )

It's not even 30 days necessarily. I use 2FA on gmail with "remember this device" checked, and I haven't had to sign in for a year or more.

Re: Strengthening 2-Step Verification with Security Key

#126

Post by feld »

higherpurpose wrote: post #21
tpurves wrote: post #19

Earlier quoted context omitted.

Wearables with BTLE.

Bluetooth has too long range. That's why it was never a good idea for Apple to adopt it for payments either, despite all the cheering for it when BLE came to the iPhone. I'd rather these only work with NFC (you know, like Apple Pay). Although I wouldn't mind the BLE option too for things like opening the garage door. But for anything else where you're at close range anyway, it should be NFC by default.

Who cares what the range is? You can detect distance of the device before communicating. And do you think the data is not encrypted?

"Wifi has too long of range; don't ever purchase something if you're on wifi!"

Re: Strengthening 2-Step Verification with Security Key

#127

Post by asuffield »

fidotron wrote: post #48

Would be good if next gen chromebooks have a bay on the bottom with a USB socket so you can leave one of these attached without it dangling off the side (and maybe permanently glued in by paranoid IT). Another trick might be NFC in the palmrests that can detect your watch . . . Looks like a solid step in the right direction though.

https://www.yubico.com/products/yubikey-hardware/

It's a little pricier, but the Neo-N here will sit in a USB port and be more or less flush with the side.

Re: Strengthening 2-Step Verification with Security Key

#128

Post by danielsju6 »

Super cool; this a great win on the path to U2F acceptance. I ordered a key to try it out; I've been meaning to anyway. I want to try out the using U2F via NFC on Android and see if I can hack something together using Apple's private NFC framework. Wish the tokens had BTLE compatibility though.

Re: Strengthening 2-Step Verification with Security Key

#129

Post by tiziano88 »

IgorPartola wrote: post #69

Cool, but I will continue using the Google Authenticator app. Google is not the only thing that requires 2FA, so do numerous other sites, and GA app is the most widely supported and the least pain in the behind. I don't see a point in plugging my entire keychain (the physical keychain, with my car keys) into my laptop every time I want to log into GMail, much less carrying around 10+ different USB tokens. Now, a NFC-…

Note that this solution will exactly replace OTP in some cases (e.g. when the browser supports it), but you always have the option to revert to "normal" OTP at any time for authentication (which you will still have to do when authenticating from mobile, for instance).

Re: Strengthening 2-Step Verification with Security Key

#130

Post by tiziano88 »

bluesign wrote: post #7

I don't get this, what about malware pretending to be a browser? Is there a protection against this in protocol

At the very minimum, this requires physically interacting with the security key (by touching it), which prevents software from silently using the key to authenticate in the background. Then again, if your entire machine is compromised you basically have a MITM attack so close to your side of the channel that it is virtually impossible to do anything about it.
Post reply on HN