41–50 of 114 posts
This seems a little restrictive if it doesn't have some sort of 2FA alternative, like a mobile TOTP app or something. I'd hate to be locked out of any accounts for losing my MacBook, or to be unable to use the accounts from mobile or a different platform. As a secondary/simpler 2FA alternative I like it, but the description here doesn't do much to explain how to get around the problem of only having this available on…
I tried it but it didn't work for me. I'm running Mavericks. Do I need to reboot or something?
Until Yubikey releases a USB-c version of their nano, I think I'll use this. Since I've had to transition to a keychain U2F device instead of one I can leave in my laptop, I find myself using it far less.
USB-C ports are too precious to keep them filled all the time with an authentication device, and there doesn't seem to be enough room in the male side of the Type-C coupling to allow the necessary circuitry to exist in a slim form factor. Both these problems are solvable, but meanwhile secure elements are already shipped with many laptops.
(An assumption of this comment is that the Nano is kept semi-permanently in the laptop port. That's what the Nano is indeed designed for.)
I tried it but it didn't work for me. I'm running Mavericks. Do I need to reboot or something?
Are you triggering U2F challenges by visiting sites that support u2f? Opening the app doesn't do anything.
Just for context, I'm pretty well versed in U2F. I actually sell a U2F token of my own (https://sc4.us/hsm) and I've published a serverless U2F test harness (https://github.com/rongarret/u2f-test).
U2F adoption seems quite slow. Google were in early, and later github and Dropbox. But since then? Feels like nothing happened.
Though U2F's javascript API situation makes a lack of adoption a bit of a mixed blessing. Because sites need to include browser-specific code to access a browser's U2F support, that means any site adding support for Chrome right now will have to go back and modify their code to add support for Firefox when it comes, etc. (From the spec: "RPs [Relying Parties, i.e. web pages using U2F] interact with the FIDO client through a MessagePort [WEBMESSAGING] object. [...] This specification does not describe how such a port is made available to RP web pages, as this is (for now) implementation and browser dependent.")
Google and Yubico provide an example wrapper around the Chrome-specific method for getting access to Chrome's U2F messageport (at https://github.com/google/u2f-ref-code/blob/master/u2f-gae-d... in the function u2f.getMessagePort), but the wrapper gives up if it's not running in Chrome (the else branch just tries hitting the old Chrome extension by hardcoded chrome-extension:// URL).
Even if Google's wrapper someday adds support for other browsers, every site will need to update its copy of the wrapper before that site will support the other browsers.
If very many sites were adding U2F support right now, I suspect a lot of them would remain Chrome-only even as more browsers added U2F support. Maybe if adoption only happens after more browsers already have their U2F support available, more sites will end up supporting those browsers than if it was getting adoption right now.
Can someone explain how this is an improvement on phone-based, non-SMS 2FA? This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.
on an unrelated note: can someone explain why SMS based 2FA was every considered to be a good idea? That crap drives me NUTS.
Not saying it was a good idea for security, but that probably made it easier to justify internally.
U2F adoption seems quite slow. Google were in early, and later github and Dropbox. But since then? Feels like nothing happened.
Here's the problem. These are the 2nd factor solutions off the top of my head.
1. Yubikey
2. Duo
3. TOTP/Google Auth
4. SMS
5. Fido U2F
6. JavaCard
7. RSA SecurID
8. Perfect Paper Passwords.
Can someone explain how this is an improvement on phone-based, non-SMS 2FA? This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.
on an unrelated note: can someone explain why SMS based 2FA was every considered to be a good idea? That crap drives me NUTS.
And the real danger of cell phones and SMS is account recovery processes that SMS a recovery code to your cell. That's way more concerning than 2fa via SMS IMO.
Earlier quoted context omitted.
The improvement is accessibility. It's less secure than physical 2FA but more so than just 1FA. As the article says, "for many, the security of software-based U2F is sufficient and helps to mitigate against many common attacks such as password dumps, brute force attacks, and phishing related exploits."
It's really not that much less secure than physical 2FA: I'm willing to bet that most people just leave their hardware key in their laptop at all times. (where "most people" ends up being corporate U2F users, who are probably given YubiKey Nanos and the like) At that point, your laptop is basically your 2nd factor - which this software is pretty similar to.