Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

cyberscoop.com

Post reply on HN
Print view View original

31–40 of 147 posts

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#31

Post by [deleted] »

falcolas wrote: post #20
ridgewell wrote: post #3

I don't think I'm all that opposed to competition in this space. Yubico has a virtual monopoly on high-quality Fido U2F keys at the moment. Google is a giant admittedly, and could crush Yubico overtime though. Not sure if this is just a cheaply made Feitian Key though rebranded for Google Cloud, or if it is a new product in itself. However, I've heard that Google is kind of going on a tangent with its own U2F impleme…

To be fair, there is competition in the java card space, YubiCo is simply the least expensive option. And the only practical option for any non “enterprise” entity. I can hope Googles entry into this space is a good thing, but it would suck to see them edge YubiCo out.

[deleted]

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#32

Post by NedIsakoff »

danjoc wrote: post #26
tln wrote: post #21

Earlier quoted context omitted.

Especially for USB-C, Yubico is the only game in town. Based on the pic it's a USB A plug. Seems like a missed opportunity.

USB-C is not backward compatible to USB-A. There's no way to plug a USB-C key into a computer with only USB-A ports. If you need to work with both ports, USB-A is the only game in town. The C to A adapters are not compliant with USB-C spec (see Benson Leung) and are dangerous to use with your USB-C devices.

Wrong! I use the following:

Yubikey 4C https://www.yubico.com/product/yubikey-4-series/#yubikey-4c

USB C-A Adapter https://www.amazon.ca/gp/product/B01C43FUIW/ref=oh_aui_searc...

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#33

Post by jld »

kop316 wrote: post #13
ridgewell wrote: post #3

I don't think I'm all that opposed to competition in this space. Yubico has a virtual monopoly on high-quality Fido U2F keys at the moment. Google is a giant admittedly, and could crush Yubico overtime though. Not sure if this is just a cheaply made Feitian Key though rebranded for Google Cloud, or if it is a new product in itself. However, I've heard that Google is kind of going on a tangent with its own U2F impleme…

I own a Yubikey, and I can see why it has a virtual monopoly. It may look flimsy, but it is on my keychain and I do not bother to baby it. It has lasted for well over two years with little signs of wear. It is also very thin and adds little more footprint to my keychain then another house key. While I do not have it, they also have another one that almost fits completely within a USB slot. The size of that security k…

Totally agree on the USB-A models.

On the other hand, my USB-C Yubikey only lasted a month in my pocket before the case fractured and flaked apart. Whatever plastic they encased it in was not up the job of being on keyring. Additionally the plastic sleeve inside the USB-C plug broke and the thing became trash. Yubikey shipped me a new one, but looks to be of the same design. That was last summer. The photos on the website appear to be the same, hopefully they've improved the quality.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#34

Post by zxcvgm »

kxyvr wrote: post #18

Could someone explain the difference between FIDO and FIDO2 compliant keys? For example, is new hardware required or will existing FIDO/U2F keys work with FIDO2? It looks like Yubico is advertising a new FIDO2 key under the brand name "Security Key by Yubico". Personally, I've been meaning to pick up a U2F key, but if sites are going to start rolling out WebAuthn support, I'd rather have a key that supports both FIDO…

FIDO2 is an improvement over the U2F standard, mainly with the ability to now perform password-less logins [1][2]. This had to do with a shortcoming in the U2F protocol and/or devices such that they didn't need to have much storage on these devices [3]. To address this, the new FIDO2 devices are now required to persist your username(s) for a particular site. The new CTAP2 protocol has also been extended to accommodate more sophisticated authenticators, like those crypto-currency wallets with a display.

If you are looking for devices, check out reviews of various devices by agl [4] and Brad Hill [5].

[1] https://www.yubico.com/2018/04/yubico-and-microsoft-introduc...

[2] https://fidoalliance.org/fido2/

[3] https://www.yubico.com/2014/11/yubicos-u2f-key-wrapping/

[4] https://www.imperialviolet.org/2017/10/08/securitykeytest.ht...

[5] https://github.com/hillbrad/U2FReviews

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#37

Post by probably_wrong »

bogomipz wrote: post #17

I have a tangential question about 2FA since there's been a couple of articles recently on HN about U2F/FIDO/2FA. Is there a reason almost no banks offer 2FA? I really seems absurd that in 2018 a person's gmail/dropbox/github etc has better security practices than an online bank account. EDIT. Some people assumed this was a US-centric question/perspective. If you look at this list. The number of checks for banks offe…

I can't speak for the US, but most European banks I've seen require 2FA for almost any non-read-only action. You need either an app, or a tiny machine that authenticates against your (chip) debit card.

Login is still just password, though, but there's only so much damage you can do.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#38

Post by danjoc »

agl wrote: post #7
ridgewell wrote: post #3

I don't think I'm all that opposed to competition in this space. Yubico has a virtual monopoly on high-quality Fido U2F keys at the moment. Google is a giant admittedly, and could crush Yubico overtime though. Not sure if this is just a cheaply made Feitian Key though rebranded for Google Cloud, or if it is a new product in itself. However, I've heard that Google is kind of going on a tangent with its own U2F impleme…

> However, I've heard that Google is kind of going on a tangent with its own U2F implementations, emphasizing an old-school implementation instead of the Web Authentication Standard that's pushed by the W3C. Chrome has supported "U2F" (the first FIDO spec) for a while and all support for Security Keys in the last few years has been via this protocol. But we're implementing the W3C Web Authentication (webauthn) spec a…

>But we're implementing the W3C Web Authentication (webauthn) spec and you can already use it in Chrome in place of U2F.

How are users going to differentiate between a webauthn permission request and a webusb permission request? The later can be used for phishing attacks, which appears to defeat the entire purpose of having a U2F key.

https://www.wired.com/story/chrome-yubikey-phishing-webusb/

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#39

Post by danjoc »

NedIsakoff wrote: post #32
danjoc wrote: post #26

Earlier quoted context omitted.

USB-C is not backward compatible to USB-A. There's no way to plug a USB-C key into a computer with only USB-A ports. If you need to work with both ports, USB-A is the only game in town. The C to A adapters are not compliant with USB-C spec (see Benson Leung) and are dangerous to use with your USB-C devices.

Wrong! I use the following: Yubikey 4C https://www.yubico.com/product/yubikey-4-series/#yubikey-4c USB C-A Adapter https://www.amazon.ca/gp/product/B01C43FUIW/ref=oh_aui_searc...

>Wrong!

No, sorry, you are wrong.

https://plus.google.com/+BensonLeung/posts/UFCHbSDRa2o

Post reply on HN