151–160 of 164 posts
I have long debated getting a Yubikey but have held off because I don't want to have to carry around several dongles at all times to be able to send an email. Surely other people are in the situation of: - iPhone, iPad - Macbook with only USB-C ports - Windows/Linux workstation with only USB-A ports Is there currently a non-cumbersome solution that will work on all of these?
The new Yubikey's with NFC support work on my 2 year old iPhone already.
Earlier quoted context omitted.
Well, yes, that is exactly what I'm talking about. The biggest advantage of a physical second factor is that I can see if it has been stolen: I either have it with me, or I don't. By using multiple keys, you are effectively removing that advantage: someone could have one of your devices (e.g. your laptop while you're out for lunch) and would be able to make use of your second factor without you knowing.
Well if your primary concern is a local threat - which it absolutely is not for the vast majority of people - then you just have to be more careful with your keys. If you suspect someone might be actively trying to break in to your home, you wouldn’t leave your keys on your desk while you went to lunch.
"So while it works great as your second factor in those browsers, for now you’ll still need an authenticator app set up to use with the 1Password desktop and mobile apps (and any unsupported browsers)"
Earlier quoted context omitted.
AWS at least lets you sign in using alternative methods if you get locked out: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credenti...
Which in itself is a problem: it means the MFA device is not required, if only they have access to my email + phone.
I've had an OnlyKey for a couple of years now. It offer 12 slots per profile and 2 profiles, and the slots supporting TOTP, U2F, Yubikey, plaintext and a whole lot of other tools. With the configuration app and firmware open source, I'm really surprised I've never seen anyone else with one.
Earlier quoted context omitted.
This also breaks security keys.
What do you mean by this? Are you saying that a phishing attack can be executed against U2F/WebAuthen if the attacker controls DNS?
Earlier quoted context omitted.
Not unless your attacker has physical access to the machine. You still have to touch the device to activate it each time. This still mitigates the most common MITM-type attacks: 1. Attacker instigates login via fake portal. 2. Attacker fools you in to entering your 6-digit OTP. 3. Attacker intercepts your valid OTP, combines with your stolen password, logs in to real site. This doesn’t work with a YubiKey or the equi…
Well, yes, that is exactly what I'm talking about. The biggest advantage of a physical second factor is that I can see if it has been stolen: I either have it with me, or I don't. By using multiple keys, you are effectively removing that advantage: someone could have one of your devices (e.g. your laptop while you're out for lunch) and would be able to make use of your second factor without you knowing.