Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

cyberscoop.com

Post reply on HN
Print view View original

21–30 of 147 posts

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#21

Post by tln »

ridgewell wrote: post #3

I don't think I'm all that opposed to competition in this space. Yubico has a virtual monopoly on high-quality Fido U2F keys at the moment. Google is a giant admittedly, and could crush Yubico overtime though. Not sure if this is just a cheaply made Feitian Key though rebranded for Google Cloud, or if it is a new product in itself. However, I've heard that Google is kind of going on a tangent with its own U2F impleme…

Especially for USB-C, Yubico is the only game in town. Based on the pic it's a USB A plug. Seems like a missed opportunity.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#22

Post by thezilch »

bogomipz wrote: post #17

I have a tangential question about 2FA since there's been a couple of articles recently on HN about U2F/FIDO/2FA. Is there a reason almost no banks offer 2FA? I really seems absurd that in 2018 a person's gmail/dropbox/github etc has better security practices than an online bank account. EDIT. Some people assumed this was a US-centric question/perspective. If you look at this list. The number of checks for banks offe…

Why do many US banks and CUs have bad password hygiene? Length limits (and really short ones)? Character restrictions? Makes you really think how bad the tech behind it all is protecting your security.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#23

Post by icebraining »

bogomipz wrote: post #17

I have a tangential question about 2FA since there's been a couple of articles recently on HN about U2F/FIDO/2FA. Is there a reason almost no banks offer 2FA? I really seems absurd that in 2018 a person's gmail/dropbox/github etc has better security practices than an online bank account. EDIT. Some people assumed this was a US-centric question/perspective. If you look at this list. The number of checks for banks offe…

No, there's no reason. CAP has been around for over a decade, and my bank has supported that and/or SMS as 2nd factor since at least 2008.

https://en.wikipedia.org/wiki/Chip_Authentication_Program

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#24

Post by ianburrell »

ben1040 wrote: post #2

This looks similar to the Feitan Bluetooth LE-compatible key they also recommend that you purchase if you enable their Advanced Protection feature on your Google account: https://www.amazon.com/Feitian-MultiPass-FIDO-Security-Key/d...

The other looks like the Feitan ePass NFC U2F Security Key.

https://www.amazon.com/Feitian-ePass-NFC-FIDO-Security/dp/B0...

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#25

Post by pc86 »

tln wrote: post #6
masonhensley wrote: post #4

Can someone explain this? > “Yubikey cost Google less than their own authenticator app,” Ehrensvärd said, and there have been no account takeovers since the program was implemented, Google says.

Perhaps he is factoring is the human cost. Yubikeys save a couple of minutes multiple times per day.

I took it as the cost of just purchasing Yubikeys for everyone was less than the payroll and associated costs of developing the Authenticator app.

But I could either interpretation (or both) being correct.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#26

Post by danjoc »

tln wrote: post #21
ridgewell wrote: post #3

I don't think I'm all that opposed to competition in this space. Yubico has a virtual monopoly on high-quality Fido U2F keys at the moment. Google is a giant admittedly, and could crush Yubico overtime though. Not sure if this is just a cheaply made Feitian Key though rebranded for Google Cloud, or if it is a new product in itself. However, I've heard that Google is kind of going on a tangent with its own U2F impleme…

Especially for USB-C, Yubico is the only game in town. Based on the pic it's a USB A plug. Seems like a missed opportunity.

USB-C is not backward compatible to USB-A. There's no way to plug a USB-C key into a computer with only USB-A ports. If you need to work with both ports, USB-A is the only game in town. The C to A adapters are not compliant with USB-C spec (see Benson Leung) and are dangerous to use with your USB-C devices.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#27

Post by dmoy »

ridgewell wrote: post #3

I don't think I'm all that opposed to competition in this space. Yubico has a virtual monopoly on high-quality Fido U2F keys at the moment. Google is a giant admittedly, and could crush Yubico overtime though. Not sure if this is just a cheaply made Feitian Key though rebranded for Google Cloud, or if it is a new product in itself. However, I've heard that Google is kind of going on a tangent with its own U2F impleme…

> Not sure if this is just a cheaply made Feitian Key though rebranded for Google Cloud, or if it is a new product in itself.

The article implies otherwise:

""" “It’s built with a secure element including firmware we built ourselves,” Google’s Rob Sadowski said. “It provides a ton of security with very little interaction and effort on the part of the user.” """

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#28

Post by azinman2 »

danjoc wrote: post #26
tln wrote: post #21

Earlier quoted context omitted.

Especially for USB-C, Yubico is the only game in town. Based on the pic it's a USB A plug. Seems like a missed opportunity.

USB-C is not backward compatible to USB-A. There's no way to plug a USB-C key into a computer with only USB-A ports. If you need to work with both ports, USB-A is the only game in town. The C to A adapters are not compliant with USB-C spec (see Benson Leung) and are dangerous to use with your USB-C devices.

Except if you have a usb-c laptop and that’s the only place you’re going to plug it in, then you probably want to be dongle-less.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#29

Post by agl »

kxyvr wrote: post #18

Could someone explain the difference between FIDO and FIDO2 compliant keys? For example, is new hardware required or will existing FIDO/U2F keys work with FIDO2? It looks like Yubico is advertising a new FIDO2 key under the brand name "Security Key by Yubico". Personally, I've been meaning to pick up a U2F key, but if sites are going to start rolling out WebAuthn support, I'd rather have a key that supports both FIDO…

Webauthn works with both FIDO1 and FIDO2 keys. (Unless you have the new, FIDO2 key from Yubico then you have a FIDO1 key). You might also see them called CTAP1 and CTAP2 keys because CTAP is the bit of FIDO that defines the interface to the hardware tokens. (CTAP: "Client to Authenticator Protocol". See https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-cl...)

FIDO2 keys talk a different protocol and do everything that FIDO1 keys do, and (potentially) more. For example, they may operate in "resident key" mode where the key remembers both your username and private key. They can also support things like PIN activation.

I've only briefly poked the Yubico FIDO2 key. I think it supports a limited form of resident keys and it advertises PIN support, although I didn't exercise that.

Post reply on HN