Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

cyberscoop.com

Post reply on HN
Print view View original

41–50 of 147 posts

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#41

Post by bertil »

ridgewell wrote: post #3

I don't think I'm all that opposed to competition in this space. Yubico has a virtual monopoly on high-quality Fido U2F keys at the moment. Google is a giant admittedly, and could crush Yubico overtime though. Not sure if this is just a cheaply made Feitian Key though rebranded for Google Cloud, or if it is a new product in itself. However, I've heard that Google is kind of going on a tangent with its own U2F impleme…

I think you should, in this forum and in contacts with Google, absolutely push for a stronger protocol. However, in this case, we really want to have Google’s weight to push for having everyone with access to anything remotely sensitive use 2FA and U2F: doctors, repairmen, accountants, etc.

Could Google take 99% of the market against Yubico? Probably, but I doubt the remaining 18 of the 20 companies quoted would want to depend even more on Google. More to the point, I expect that the remaining 1% will be bigger than Yubico current quasi-monopoly.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#42

Post by sonaltr »

I am a bit disappointed they didn't add some of the features of the OnlyKey - such as passcodes (and having the ability to self destruct the contents).

Those would be awesome to have if someone decides to steal your keys (yes I am aware you need your key + password -> but if someone goes through the effort to steal your keys - I'm sure a hammer can get the password out of you).

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#43

Post by agl »

danjoc wrote: post #38
agl wrote: post #7

Earlier quoted context omitted.

> However, I've heard that Google is kind of going on a tangent with its own U2F implementations, emphasizing an old-school implementation instead of the Web Authentication Standard that's pushed by the W3C. Chrome has supported "U2F" (the first FIDO spec) for a while and all support for Security Keys in the last few years has been via this protocol. But we're implementing the W3C Web Authentication (webauthn) spec a…

>But we're implementing the W3C Web Authentication (webauthn) spec and you can already use it in Chrome in place of U2F. How are users going to differentiate between a webauthn permission request and a webusb permission request? The later can be used for phishing attacks, which appears to defeat the entire purpose of having a U2F key. https://www.wired.com/story/chrome-yubikey-phishing-webusb/

Webauthn and WebUSB UIs are very different. Additionally, Chrome has banned WebUSB from claiming Security Keys.

However, it remains the case that if the user downloads and runs exes, or otherwise grants the attacker direct access to the Security Key, then they can ask it to sign an authentication request for a given website. Such an attacker could also compromise the browser and wait for the user to login themselves etc.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#44

Post by bogomipz »

icebraining wrote: post #23
bogomipz wrote: post #17

I have a tangential question about 2FA since there's been a couple of articles recently on HN about U2F/FIDO/2FA. Is there a reason almost no banks offer 2FA? I really seems absurd that in 2018 a person's gmail/dropbox/github etc has better security practices than an online bank account. EDIT. Some people assumed this was a US-centric question/perspective. If you look at this list. The number of checks for banks offe…

No, there's no reason. CAP has been around for over a decade, and my bank has supported that and/or SMS as 2nd factor since at least 2008. https://en.wikipedia.org/wiki/Chip_Authentication_Program

How does CAP provide protection when logging into your bank account online?

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#45

Post by bogomipz »

thezilch wrote: post #22
bogomipz wrote: post #17

I have a tangential question about 2FA since there's been a couple of articles recently on HN about U2F/FIDO/2FA. Is there a reason almost no banks offer 2FA? I really seems absurd that in 2018 a person's gmail/dropbox/github etc has better security practices than an online bank account. EDIT. Some people assumed this was a US-centric question/perspective. If you look at this list. The number of checks for banks offe…

Why do many US banks and CUs have bad password hygiene? Length limits (and really short ones)? Character restrictions? Makes you really think how bad the tech behind it all is protecting your security.

And of course many(most?) still use security questions - "whats your favorite food?", "what was the name of your first employer" etc.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#47

Post by opencl »

danjoc wrote: post #39
NedIsakoff wrote: post #32

Earlier quoted context omitted.

Wrong! I use the following: Yubikey 4C https://www.yubico.com/product/yubikey-4-series/#yubikey-4c USB C-A Adapter https://www.amazon.ca/gp/product/B01C43FUIW/ref=oh_aui_searc...

>Wrong! No, sorry, you are wrong. https://plus.google.com/+BensonLeung/posts/UFCHbSDRa2o

99% of people do not care what the USB spec says is allowed, if the thing works they will buy and use it.

See: every phone charger that outputs more than 500mA over a USB-A port. Doesn't comply with the spec, nobody cares, everyone does it.

Even the post says the only reason C-A adapters aren't allowed in the spec is that they can be chained with a C-C cable to make an A-A cable. They work fine if you don't do stupid things with them.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#48

Post by zkms »

probably_wrong wrote: post #37
bogomipz wrote: post #17

I have a tangential question about 2FA since there's been a couple of articles recently on HN about U2F/FIDO/2FA. Is there a reason almost no banks offer 2FA? I really seems absurd that in 2018 a person's gmail/dropbox/github etc has better security practices than an online bank account. EDIT. Some people assumed this was a US-centric question/perspective. If you look at this list. The number of checks for banks offe…

I can't speak for the US, but most European banks I've seen require 2FA for almost any non-read-only action. You need either an app, or a tiny machine that authenticates against your (chip) debit card. Login is still just password, though, but there's only so much damage you can do.

> I can't speak for the US, but most European banks I've seen require 2FA for almost any non-read-only action. You need either an app, or a tiny machine that authenticates against your (chip) debit card.

I have multiple US bank accounts and none of them have anything approaching that, it's kind of pathetic.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#49

Post by danjoc »

agl wrote: post #43
danjoc wrote: post #38

Earlier quoted context omitted.

>But we're implementing the W3C Web Authentication (webauthn) spec and you can already use it in Chrome in place of U2F. How are users going to differentiate between a webauthn permission request and a webusb permission request? The later can be used for phishing attacks, which appears to defeat the entire purpose of having a U2F key. https://www.wired.com/story/chrome-yubikey-phishing-webusb/

Webauthn and WebUSB UIs are very different. Additionally, Chrome has banned WebUSB from claiming Security Keys. However, it remains the case that if the user downloads and runs exes, or otherwise grants the attacker direct access to the Security Key, then they can ask it to sign an authentication request for a given website. Such an attacker could also compromise the browser and wait for the user to login themselves…

>Chrome has banned WebUSB from claiming Security Keys

Since when? Is this extension now broken?

https://chrome.google.com/webstore/detail/smart-card-connect...

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#50

Post by NedIsakoff »

danjoc wrote: post #39
NedIsakoff wrote: post #32

Earlier quoted context omitted.

Wrong! I use the following: Yubikey 4C https://www.yubico.com/product/yubikey-4-series/#yubikey-4c USB C-A Adapter https://www.amazon.ca/gp/product/B01C43FUIW/ref=oh_aui_searc...

>Wrong! No, sorry, you are wrong. https://plus.google.com/+BensonLeung/posts/UFCHbSDRa2o

Doesn't that mean that 99.99% of all USB chargers for phones violate the spec? Since the spec says USB A only outputs 500mA ? Holy shit!
Post reply on HN