Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Support for U2F security keys

blog.1password.com

Post reply on HN
Print view View original

111–120 of 164 posts

Re: Support for U2F security keys

#111

Post by jwr »

jen729w wrote: post #107
jwr wrote: post #104

Earlier quoted context omitted.

Aren't you effectively removing the second factor by keeping it permanently attached to each of your devices?

Not unless your attacker has physical access to the machine. You still have to touch the device to activate it each time. This still mitigates the most common MITM-type attacks: 1. Attacker instigates login via fake portal. 2. Attacker fools you in to entering your 6-digit OTP. 3. Attacker intercepts your valid OTP, combines with your stolen password, logs in to real site. This doesn’t work with a YubiKey or the equi…

Well, yes, that is exactly what I'm talking about. The biggest advantage of a physical second factor is that I can see if it has been stolen: I either have it with me, or I don't.

By using multiple keys, you are effectively removing that advantage: someone could have one of your devices (e.g. your laptop while you're out for lunch) and would be able to make use of your second factor without you knowing.

Re: Support for U2F security keys

#112

Post by jehteh »

Switched from lastpass to gnu pass and storing my private subkeys on a couple of yubikeys has actually worked really well for me (took a few days to get my head around gpg and smartcard setup, but that was worth doing even if I didn't setup pass). That said, I am running android, windows/WSL and ubuntu; other platforms may not be so painless.

Re: Support for U2F security keys

#113

Post by jwr »

brightball wrote: post #109
currymj wrote: post #25

I have long debated getting a Yubikey but have held off because I don't want to have to carry around several dongles at all times to be able to send an email. Surely other people are in the situation of: - iPhone, iPad - Macbook with only USB-C ports - Windows/Linux workstation with only USB-A ports Is there currently a non-cumbersome solution that will work on all of these?

The new Yubikey's with NFC support work on my 2 year old iPhone already.

Which apps support it? Can you use it for any of the online services?

Re: Support for U2F security keys

#114

Post by kop316 »

currymj wrote: post #25

I have long debated getting a Yubikey but have held off because I don't want to have to carry around several dongles at all times to be able to send an email. Surely other people are in the situation of: - iPhone, iPad - Macbook with only USB-C ports - Windows/Linux workstation with only USB-A ports Is there currently a non-cumbersome solution that will work on all of these?

Fastmail uses app passwords, and I used that for my phone/tablet.

Re: Support for U2F security keys

#115

Post by stingraycharles »

burntsushi wrote: post #93
stingraycharles wrote: post #88

Earlier quoted context omitted.

AWS also only allows you to add a single device, much to my annoyance. I still haven’t found a solution for that, that doesn’t involve risking getting locked out.

AWS at least lets you sign in using alternative methods if you get locked out: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credenti...

Which in itself is a problem: it means the MFA device is not required, if only they have access to my email + phone.

Re: Support for U2F security keys

#116

Post by abstractbarista »

currymj wrote: post #25

I have long debated getting a Yubikey but have held off because I don't want to have to carry around several dongles at all times to be able to send an email. Surely other people are in the situation of: - iPhone, iPad - Macbook with only USB-C ports - Windows/Linux workstation with only USB-A ports Is there currently a non-cumbersome solution that will work on all of these?

I guess one solution is to use hardware that takes connector compatibility more seriously. I only use stuff with USB-A, and the Yubikey works with my phone via NFC (Yubico's Neo model).

Similarly, my laptop has an SD card reader and Ethernet port. My laptop and phone have 3.5mm jacks. All my small devices use micro-USB.

No dongles or adapters makes for seamless usage. I guess the only 'adapter' is keeping a micro-USB -> USB-A cable around.

Re: Support for U2F security keys

#117

Post by abstractbarista »

jiveturkey wrote: post #54
izacus wrote: post #48

Earlier quoted context omitted.

Usually you just use multiple keys - one USB-C in the MacBook, one tiny USB-A in the laptop and the built-in Titan key in the Pixel phone. You don't remove them.

few providers support enrolling multiple yubikeys into your account.

Usually you can use a TOTP backup method (Google Authenticator or similar). But don't actually use it. Just save the key to initialize it to a secure backup which can be accessed of your Yubikey is lost.

Re: Support for U2F security keys

#118

Post by baq »

kevin_nisbet wrote: post #45
kitten_smuggler wrote: post #26

Earlier quoted context omitted.

A bluetooth capable U2F device like the Titan.

https://solokeys.com are an option as well if you like open hardware. https://github.com/solokeys/solo I think the NFC ones are shipping after they worked out some kinks.

I have three ordinary solos. Work great.

Re: Support for U2F security keys

#119

Post by ithkuil »

stingraycharles wrote: post #88
saltminer wrote: post #82

Earlier quoted context omitted.

I keep an extra Yubikey in my bank box, next to my other backup keys. The only account I'd be locked out of is Twitter since they only let you add 1 token (my primary).

AWS also only allows you to add a single device, much to my annoyance. I still haven’t found a solution for that, that doesn’t involve risking getting locked out.

At $dayjob I "solved" that problem by setting up SAML auth so we would all login via gsuite (thus using 2FA via yubikey there). After a few months I set that up we got acquired by a big company that uses RSA secureId software security tokens. The security policy mandates that you have only one active security token instance (which BTW acts as a password replacement instead of 2FA, I assume for better interop with legacy tools that only talk ldap...)
Post reply on HN