Support for U2F security keys • Hacker News Board

Re: Support for U2F security keys

#21

Post by jmull » Tue, Jun 11, 2019, 4:00 PM UTC

javagram wrote: post #11

I have never used 1password.com. Adding 2FA to it is great but I think the best security is likely still just to sync and use local apps for this data, to avoid being exposed to any JavaScript vulnerabilities or if 1password.com were ever hacked.

I've been using 1password for some years, but I'm not even sure what the use case for the web site is.

I have a "vault" (1password's term for an encrypted file containing passwords and related info) that's sync'd across devices through dropbox (and accessed through a locally installed app), which I think is what you're suggesting.

Anyway, I think there's no particular need to access passwords through the site.

I'd definitely feel uncomfortable typing my 1password vault password into a web page or anything else besides the apps.

Re: Support for U2F security keys

#22

Post by jasongill » Tue, Jun 11, 2019, 4:00 PM UTC

dexterdog wrote: post #5

Hasn't this been in Bitwarden and Lastpass for a while now?

Bitwarden might (not sure), but Lastpass only supports Yubikey's TOTP implementation, not U2F, and they seem to have no real motivation to support U2F based on their support ticket responses

Re: Support for U2F security keys

#23

Post by chimeracoder » Tue, Jun 11, 2019, 4:02 PM UTC

dickeytk wrote: post #17

josefresco wrote: post #10

Got a free YubiKey from Wired. Then I read that mobile is a pain, and that I really need two ... it's sat in my bag now for months, unused. I already use 2FA, and it works good enough - I'm not sold on how this will make my life better, especially on mobile.

I’m going to use both. TOTP most of the time, U2F in a safe at home in case I break/lose my phone

> I’m going to use both. TOTP most of the time, U2F in a safe at home in case I break/lose my phone

That's backwards. TOTP is vulnerable to phishing attacks, which are the primary threat model. Far better to use U2F for daily use, and then keep a printout of the TOTP QR code in a safe at home as a backup.

Re: Support for U2F security keys

#24

Post by signal11 » Tue, Jun 11, 2019, 4:04 PM UTC

hamburglar wrote: post #18

AGKyle wrote: post #12

Earlier quoted context omitted.

You mean the licensed version? It never went away. When you launch you'll be prompted to purchase. On the screens near the bottom there is a line of text about purchasing a license, go that route instead of signing up for the 1Password.com service. Kyle 1Password

Interesting. If this is the case, I think you have a communications problem. I was under the impression that after 6.0, the only way to get a license was to have your older one grandfathered. I can't find any information about this on your website. All of the options on your product info pages other than "enterprise (email us for a quote)" show monthly subscriptions only. Where can I see product info about the licens…

I agree their website is somewhat confusing, it nudges quite strongly towards purchasing a 1Password subscription. However these pages[1,2] makes quite clear that you can purchase a standalone license even if you're not upgrading:

> Or, to purchase a standalone license, click “Need a license? We have those too.” After purchasing your license, add it to 1Password.

> Or, to purchase a standalone license, click “Need a license? We have those too.”

[1] https://support.1password.com/upgrade-windows/ [2] https://support.1password.com/upgrade-mac/

Re: Support for U2F security keys

#25

Post by currymj » Tue, Jun 11, 2019, 4:07 PM UTC

I have long debated getting a Yubikey but have held off because I don't want to have to carry around several dongles at all times to be able to send an email.

Surely other people are in the situation of:

- iPhone, iPad

- Macbook with only USB-C ports

- Windows/Linux workstation with only USB-A ports

Is there currently a non-cumbersome solution that will work on all of these?

Re: Support for U2F security keys

#26

Post by kitten_smuggler » Tue, Jun 11, 2019, 4:08 PM UTC

currymj wrote: post #25

I have long debated getting a Yubikey but have held off because I don't want to have to carry around several dongles at all times to be able to send an email. Surely other people are in the situation of: - iPhone, iPad - Macbook with only USB-C ports - Windows/Linux workstation with only USB-A ports Is there currently a non-cumbersome solution that will work on all of these?

A bluetooth capable U2F device like the Titan.

Re: Support for U2F security keys

#27

Post by zymhan » Tue, Jun 11, 2019, 4:08 PM UTC

dickeytk wrote: post #8

zymhan wrote: post #3

It appears via the screenshot that you can have multiple 2FA devices, which is great. I love my Yubikey in theory, but in practice I'm only using it for services where I can have a TOTP or SMS 2FA backup method, because I'm not convinced it will always work or be available. Even if having SMS 2FA enabled negates any security benefits of the Yubikey. Thus far it's just Dropbox and Gitlab that I use it for, since they'…

I have 3 yubikeys to avoid this problem

Yeah that's exactly the situation I don't want to be in.

Re: Support for U2F security keys

#28

Post by swhitt » Tue, Jun 11, 2019, 4:09 PM UTC

graton wrote: post #15

zymhan wrote: post #3

It appears via the screenshot that you can have multiple 2FA devices, which is great. I love my Yubikey in theory, but in practice I'm only using it for services where I can have a TOTP or SMS 2FA backup method, because I'm not convinced it will always work or be available. Even if having SMS 2FA enabled negates any security benefits of the Yubikey. Thus far it's just Dropbox and Gitlab that I use it for, since they'…

All the services that I have used with U2F support have supported multiple keys. Google, Gitlab, Github, and some others which I forget. They have all worked with Yubico U2F keys and with the Google Titan keys. Pretty convenient way to have two factor authentication. I like the Yubikey 5 Nano as you can leave it plugged into a port in your laptop all the time.

All services except for AWS.

Re: Support for U2F security keys

#29

Post by zymhan » Tue, Jun 11, 2019, 4:10 PM UTC

nevir wrote: post #7

zymhan wrote: post #3

It appears via the screenshot that you can have multiple 2FA devices, which is great. I love my Yubikey in theory, but in practice I'm only using it for services where I can have a TOTP or SMS 2FA backup method, because I'm not convinced it will always work or be available. Even if having SMS 2FA enabled negates any security benefits of the Yubikey. Thus far it's just Dropbox and Gitlab that I use it for, since they'…

Which services that support U2F do not support multiple devices (that you care about)?

I haven't kept a running list, but just checking a few services I use at work, and Terraform Enterprise doesn't appear to support more than one 2FA method being enabled at a time.

Re: Support for U2F security keys

#30

Post by lostmymind66 » Tue, Jun 11, 2019, 4:10 PM UTC

hamburglar wrote: post #18

AGKyle wrote: post #12

Earlier quoted context omitted.

You mean the licensed version? It never went away. When you launch you'll be prompted to purchase. On the screens near the bottom there is a line of text about purchasing a license, go that route instead of signing up for the 1Password.com service. Kyle 1Password

Interesting. If this is the case, I think you have a communications problem. I was under the impression that after 6.0, the only way to get a license was to have your older one grandfathered. I can't find any information about this on your website. All of the options on your product info pages other than "enterprise (email us for a quote)" show monthly subscriptions only. Where can I see product info about the licens…

I second this. I actually switched my entire household over to keypass because I was under the impression that I was forced to use the 1password cloud service.