Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Soft U2F: A software-based U2F authenticator for macOS

githubengineering.com

Post reply on HN
Print view View original

11–20 of 114 posts

Re: Soft U2F: A software-based U2F authenticator for macOS

#11

Post by mastahyeti »

mtgx wrote: post #8

This isn't also backed-up by SMS, is it? Because the majority of U2F-supporting services seem to be doing that - even Google (and for its own Google Prompt, too).

You still have to configure TOTP (SMS or App) 2FA before you can add a U2F device. That might change in the future.

Re: Soft U2F: A software-based U2F authenticator for macOS

#12

Post by sowbug »

atonse wrote: post #9

To Github people: I ordered your yubikey token but stayed away from U2F out of fear that I'd be locked out if I lost the hardware token. But I didn't realize you could setup U2F and TOTP as a backup.

You can also order as many of the U2F devices as you wish and associate them all with any number of accounts. Yes, they do cost money, but the cheapest today is $10 shipped on Amazon. Even if you prefer the ergonomics of the more expensive ones, it's fine as a backup you keep locked in a safe at home.

Re: Soft U2F: A software-based U2F authenticator for macOS

#14

Post by madamelic »

bugmen0t wrote: post #5
madamelic wrote: post #2

Can someone explain how this is an improvement on phone-based, non-SMS 2FA? This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.

This is mostly against phishing. A phisher can get users to insert a token from a USB device or a text into evil.com. But U2F uses public key crypto, so your token derived for evil.com is not the same as for github.com

Ahhhh. That makes a lot more sense. Thank you.

Re: Soft U2F: A software-based U2F authenticator for macOS

#16

Post by jdc0589 »

madamelic wrote: post #2

Can someone explain how this is an improvement on phone-based, non-SMS 2FA? This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.

on an unrelated note: can someone explain why SMS based 2FA was every considered to be a good idea? That crap drives me NUTS.

Re: Soft U2F: A software-based U2F authenticator for macOS

#18

Post by ilikepi »

mastahyeti wrote: post #10
bugmen0t wrote: post #4

You don't really[1] need to install this, if you're using Firefox. Just set the prefs 'security.webauth.u2f' and 'security.webauth.u2f_enable_softtoken' to true. [1] (Unless you need the token to live in your Mac OS keychain, instead of the Firefox profile directory.)

My understanding is that the FF softtoken was intended to be temporary while they worked on their HID support. That might not be the case any longer though.

Yeah, the software token was only intended for testing purposes.[1] HID support is supposedly a goal for later this year.[2] There is also a third-party(?) add-on for hardware token support[3], but apparently it will stop working with FF 57 as it not was not written for WebExtensions.

(Disclaimer: not affiliated with Mozilla; I just check in on bug 1065729 every so often.)

[1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1065729#c262

[2]: https://wiki.mozilla.org/Security/CryptoEngineering#Web_Auth...

[3]: https://addons.mozilla.org/en-US/firefox/addon/u2f-support-a...

Re: Soft U2F: A software-based U2F authenticator for macOS

#19

Post by ptoomey3 »

jdc0589 wrote: post #16
madamelic wrote: post #2

Can someone explain how this is an improvement on phone-based, non-SMS 2FA? This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.

on an unrelated note: can someone explain why SMS based 2FA was every considered to be a good idea? That crap drives me NUTS.

Mostly because, thus far, it has the best user setup experience (doesn't require user to download a new app and hence can often get enabled in seconds) and has the best "lost device"/"broken device" story (people tend to not have their backup codes). I think things like Soft U2F can change that equation a bit. An iCloud keychain synced 2FA credential would go a long way toward addressing some of the usability issues with traditional TOTP based 2FA.

Re: Soft U2F: A software-based U2F authenticator for macOS

#20

Post by stephengillie »

jdc0589 wrote: post #16
madamelic wrote: post #2

Can someone explain how this is an improvement on phone-based, non-SMS 2FA? This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.

on an unrelated note: can someone explain why SMS based 2FA was every considered to be a good idea? That crap drives me NUTS.

It feels inherently insecure to blast a 2FA code across every device where you've got Hangouts installed. (And if you've got Hangouts installed on the PC where you're logging into, then it's not 2FA anymore.)
Post reply on HN