141–150 of 150 posts
This is very interesting. Is this Yubikey-compatible? http://www.amazon.com/Plug-up-International-U2F-SK-01-FIDO-S... Can I buy one of these to use with SSH auth/password programs/Chrome?
AIUI, for security reasons YubiKeys are not firmware upgradeable.
No one has mentioned the coolest feature of U2F/Fido auth: TLS Channel IDs. Via an internal Chrome extension ("cryptotoken"), authentication state & the handshake can be bound to a specific TLS session -- preventing cookie theft. Incredibly cool: http://www.browserauth.net/channel-bound-cookies
This is indeed a cool feature. I hadn't been aware of it until now. I see that Dirk Balfanz from Google published a IETF draft a couple years ago. I need to digest the security implications, but it seems like a nice mitigation to session theft.
there were some talks in 2013 about this in various sec conferences
Interesting. I've hacked something together for my personal usage with my OpenGPG smartcard for use on my Windows desktop and developer-mode chromebook. In the end I had to work with "chrome native messaging" which basically calls native binaries on the host OS and is a nightmare to set up. This doesn't look like they're planning to start supporting existing smartcards, but hopefully it's a first step? My idea was to…
Is there more info on GPG smart cards? I use a SafeNet eToken and highly reccomend it but it does X.509 certificates instead of GPG.
It actually seems like the Yubikey Neo also supports GPG, so that is quite nice. I own http://shop.kernelconcepts.de/product_info.php?products_id=4... & http://shop.kernelconcepts.de/product_info.php?products_id=1...
Cool, but I will continue using the Google Authenticator app. Google is not the only thing that requires 2FA, so do numerous other sites, and GA app is the most widely supported and the least pain in the behind. I don't see a point in plugging my entire keychain (the physical keychain, with my car keys) into my laptop every time I want to log into GMail, much less carrying around 10+ different USB tokens. Now, a NFC-…
IMHO the Authy app is nicer than Google Authenticator. https://play.google.com/store/apps/details?id=com.authy.auth... http://itunes.apple.com/us/app/authy/id494168017?mt=8
It does one thing, and does it well. It doesn't keep trying to get me to use a service where I hand over all my 2FA secrets to some company, and whats more the developer responds pretty quickly when there are support issues (e.g. some QR codes are weird sizes and there was a trick pre-iOS8 to make them scan) or even bugs.
Earlier quoted context omitted.
Unless you don't click "Remember this computer for 30 days" and log in every time, 2FA isn't protecting you from stolen computers. Security key protects you from phishing and someone on the Internet guessing your password. (Many security keys are designed to be permanently installed in your computer, like this one: http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7... )
It's not even 30 days necessarily. I use 2FA on gmail with "remember this device" checked, and I haven't had to sign in for a year or more.
Earlier quoted context omitted.
You can get NFC enabled keys to use with any device without USB that supports NFC
well in that case my desktop/laptops don't support NFC. So its still working on one platform and not another.
Earlier quoted context omitted.
Thanks, this is useful. As a custom USB HID device then, I wonder if the OS has to get involved? Or is custom support in the application sufficient?
LOL "No need for ... client software..." ... Uses ... built-in support directly into the browser". So when did a browser stop being "client software" ? Never let the truth get in the way of a good advertising claim eh?
This stuff built into the browser makes it easier.
Earlier quoted context omitted.
It's not even 30 days necessarily. I use 2FA on gmail with "remember this device" checked, and I haven't had to sign in for a year or more.
Is this on Android? That works a little differently than desktop logins.
Earlier quoted context omitted.
If laptop is stolen you can revoke it, and your password shouldn't be compromised at this point. And hacking through phishing is way more likely in any case (security keys protect against it while regular 2fa doesn't).
Additionally, if somebody removes the token, dumps a bunch of OTPs and then puts it back, as soon as you use the token once, it will invalidate all previous ones so their dump will be reasonably useless. I leave my key in my computer when I'm at my desk but have it attached to my keychain so that I take it with me if I leave my desk.
EDIT: Looks like this is now working! Looks like there is a tiny UI bug -- make sure your account is correctly selected on the Security Token page if you have multiple accounts signed in. #userError Ouch, looks like a serious downside is that a given key can only be used with one Google account. Trying to add a U2F-compatible token to more than one Google account results in errors: "This Security Key is already regis…