Support for U2F security keys • Hacker News Board

Re: Support for U2F security keys

#161

Post by rstuart4133 » Fri, Jun 14, 2019, 1:45 AM UTC

AdmiralAsshat wrote: post #39

currymj wrote: post #25

I have long debated getting a Yubikey but have held off because I don't want to have to carry around several dongles at all times to be able to send an email. Surely other people are in the situation of: - iPhone, iPad - Macbook with only USB-C ports - Windows/Linux workstation with only USB-A ports Is there currently a non-cumbersome solution that will work on all of these?

I tried to get mine as future-proof as possible, but I was left with a choice of either getting the Yubikey Neo with NFC or a Yubikey with USB-C. I went with the Neo, because it supports all of my current devices, and for USB-C future testing, I tested it on my phone with an USB A-C adapter and it worked there as well. I'm a Linux/Android user without any Apple devices, though, so YMMV. EDIT: Should also mention that…

> I tried to get mine as future-proof as possible

I don't think that's possible right now. Until they come up with a solution to "I've lost my 2fa token" that isn't as painful as losing you wallet there will be new designs coming out. (Actually, it's more painful. You only have a few cards in your wallet, while your 2fa token may be recognised by 100's of sites.)

This isn't a criticism of FIDO2/WebAuthn. I am impressed by how each iteration solves a new part of the problem, and FIDO2 was definitely a step forward, fixing rough edges in FIDO. But we aren't there yet. We need a FIDO3 and possibly 4, 5 and 6.

Re: Support for U2F security keys

#162

Post by AdmiralAsshat » Fri, Jun 14, 2019, 4:50 PM UTC

rstuart4133 wrote: post #161

AdmiralAsshat wrote: post #39

Earlier quoted context omitted.

I tried to get mine as future-proof as possible, but I was left with a choice of either getting the Yubikey Neo with NFC or a Yubikey with USB-C. I went with the Neo, because it supports all of my current devices, and for USB-C future testing, I tested it on my phone with an USB A-C adapter and it worked there as well. I'm a Linux/Android user without any Apple devices, though, so YMMV. EDIT: Should also mention that…

> I tried to get mine as future-proof as possible I don't think that's possible right now. Until they come up with a solution to "I've lost my 2fa token" that isn't as painful as losing you wallet there will be new designs coming out. (Actually, it's more painful. You only have a few cards in your wallet, while your 2fa token may be recognised by 100's of sites.) This isn't a criticism of FIDO2/WebAuthn. I am impress…

Having a backup 2FA token seems like a solution, no? As I already said, I've got a lower-end Yubikey that is basically only there to be a backup in case of emergencies.

Re: Support for U2F security keys

#163

Post by javagram » Sun, Jun 16, 2019, 3:49 AM UTC

AGKyle wrote: post #101

javagram wrote: post #60

Earlier quoted context omitted.

Yep! 1password is great. I do use their cloud sync service with all the apps, I just don’t ever use the website or the browser extensions to limit my exposure.

Note that the browser extension actually does limit your exposure quite a bit. You make trade offs here. For instance, if you aren't using the browser extensions, how are you getting your password to the browser to sign in? Copying and pasting? It's possible for any app on your system to read the clipboard. Drag and drop should be a better alternative there, as we now support that in 1Password 7. The extension though…

Thanks Kyle. I do appreciate your response! And the tip about drag-and-drop, I may make use of that :)

Re: Support for U2F security keys

#164

Post by rstuart4133 » Thu, Jun 20, 2019, 6:52 AM UTC

AdmiralAsshat wrote: post #162

rstuart4133 wrote: post #161

Earlier quoted context omitted.

> I tried to get mine as future-proof as possible I don't think that's possible right now. Until they come up with a solution to "I've lost my 2fa token" that isn't as painful as losing you wallet there will be new designs coming out. (Actually, it's more painful. You only have a few cards in your wallet, while your 2fa token may be recognised by 100's of sites.) This isn't a criticism of FIDO2/WebAuthn. I am impress…

Having a backup 2FA token seems like a solution, no? As I already said, I've got a lower-end Yubikey that is basically only there to be a backup in case of emergencies.

To be honest I didn't understand your backup strategy. As far as I'm aware it isn't possible to clone a key - and I sincerely hope that's true. If you can't clone it the only other way I can think of using a backup is having every site you log into accept two so you can authenticate with either - but I've never noticed a site that can do that.

Assuming it's the "authenticate with either" solution, it ain't a great solution. If you have to replace a key you still have to visit every site you authenticate with and provide you new key. Looking at my password manager that seems to mean 100's of sites in my case.

There are lots of potential solutions to the "dog eat my token" that don't require me to visit every site I authenticate with - or even notify them. Online servers can even handle the "someone stole my token" case. Right now the only deployed online solution we have is OAuth, which really an authorisation mechanism. It sucks at for authentication.