Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Support for U2F security keys

blog.1password.com

Post reply on HN
Print view View original

41–50 of 164 posts

Re: Support for U2F security keys

#41

Post by xur17 »

ralphm wrote: post #35
GoMonad wrote: post #19

Earlier quoted context omitted.

How do you manage keeping all the keys "synced" in terms of which services they are registered with. I keep keys in separate locations for safety, but that makes adding all keys to a new account a big pain. This hasn't been a big problem yet because there are so few services that support the keys, but I wonder how people would manage it if it became widespread.

For U2F there's nothing to be in sync: each key is added individually, and you don't have to add all of them at once. I.e. if you register the key on your keychain at work, you could later add the backup key in your home vault. For storing TOTP keys on your YubiKeys, those must be the same, so you probably have to add them at the same time, or take a picture of the QR-code before you complete the registration.

> For U2F there's nothing to be in sync: each key is added individually, and you don't have to add all of them at once. I.e. if you register the key on your keychain at work, you could later add the backup key in your home vault.

The challenge is remembering to enroll using your backup device. Also, ideally your 2 devices would never be in the same room as each other, otherwise you are at risk of something like a fire destroying both.

Re: Support for U2F security keys

#43

Post by chimeracoder »

graton wrote: post #15
zymhan wrote: post #3

It appears via the screenshot that you can have multiple 2FA devices, which is great. I love my Yubikey in theory, but in practice I'm only using it for services where I can have a TOTP or SMS 2FA backup method, because I'm not convinced it will always work or be available. Even if having SMS 2FA enabled negates any security benefits of the Yubikey. Thus far it's just Dropbox and Gitlab that I use it for, since they'…

All the services that I have used with U2F support have supported multiple keys. Google, Gitlab, Github, and some others which I forget. They have all worked with Yubico U2F keys and with the Google Titan keys. Pretty convenient way to have two factor authentication. I like the Yubikey 5 Nano as you can leave it plugged into a port in your laptop all the time.

> All the services that I have used with U2F support have supported multiple keys. Google, Gitlab, Github, and some others which I forget.

AWS and Twitter are two services which only allow a single U2F device.

Re: Support for U2F security keys

#44

Post by dddddaviddddd »

hamburglar wrote: post #18
AGKyle wrote: post #12

Earlier quoted context omitted.

You mean the licensed version? It never went away. When you launch you'll be prompted to purchase. On the screens near the bottom there is a line of text about purchasing a license, go that route instead of signing up for the 1Password.com service. Kyle 1Password

Interesting. If this is the case, I think you have a communications problem. I was under the impression that after 6.0, the only way to get a license was to have your older one grandfathered. I can't find any information about this on your website. All of the options on your product info pages other than "enterprise (email us for a quote)" show monthly subscriptions only. Where can I see product info about the licens…

This was so difficult to figure out, and responses from AgileBits support so disingenuous, that I wrote up how to do this on iOS: https://www.davidschlachter.com/misc/1password-ios-standalon...

Re: Support for U2F security keys

#45

Post by kevin_nisbet »

kitten_smuggler wrote: post #26
currymj wrote: post #25

I have long debated getting a Yubikey but have held off because I don't want to have to carry around several dongles at all times to be able to send an email. Surely other people are in the situation of: - iPhone, iPad - Macbook with only USB-C ports - Windows/Linux workstation with only USB-A ports Is there currently a non-cumbersome solution that will work on all of these?

A bluetooth capable U2F device like the Titan.

https://solokeys.com are an option as well if you like open hardware. https://github.com/solokeys/solo

I think the NFC ones are shipping after they worked out some kinks.

Re: Support for U2F security keys

#46

Post by DINKDINK »

tptacek wrote: post #16
josefresco wrote: post #10

Got a free YubiKey from Wired. Then I read that mobile is a pain, and that I really need two ... it's sat in my bag now for months, unused. I already use 2FA, and it works good enough - I'm not sold on how this will make my life better, especially on mobile.

The primary purpose of U2F/WebAuthn is to break phishing attacks. Code-based TOTP 2FA, the kind you're probably using now, is already adequate to the task of making sure you're not credential-stuffed.

>TOTP 2FA is already adequate to make sure you're not credential-stuffed.

PAKEs provide defense against both credential stuffing, (some types of) phishing/MITM, CA trust etc without UX cost (a security solution that "Just works" for users with security apathy. U2F defends against compromised user space (PAKEs would fail to protect against a key logger) and require more onerous exfiltration (either physical theft of the device or biasing the U2F keys/functions)

Wiki's:

https://en.wikipedia.org/wiki/Password-authenticated_key_agr...

https://cryptowiki.net/index.php?title=Password-authenticate...

Blogs:

https://blog.cryptographyengineering.com/2018/10/19/lets-tal...

Re: Support for U2F security keys

#47

Post by baseballdork »

rtehfm wrote: post #36
josefresco wrote: post #10

Got a free YubiKey from Wired. Then I read that mobile is a pain, and that I really need two ... it's sat in my bag now for months, unused. I already use 2FA, and it works good enough - I'm not sold on how this will make my life better, especially on mobile.

Yubico makes a Yubikey with NFC, if you're interested. https://www.yubico.com/products/yubikey-for-mobile/

Solokey is also available, I just got mine in the mail.

https://solokeys.com/collections/preorder/products/copy-of-s...

Re: Support for U2F security keys

#48

Post by izacus »

currymj wrote: post #25

I have long debated getting a Yubikey but have held off because I don't want to have to carry around several dongles at all times to be able to send an email. Surely other people are in the situation of: - iPhone, iPad - Macbook with only USB-C ports - Windows/Linux workstation with only USB-A ports Is there currently a non-cumbersome solution that will work on all of these?

Usually you just use multiple keys - one USB-C in the MacBook, one tiny USB-A in the laptop and the built-in Titan key in the Pixel phone. You don't remove them.

Re: Support for U2F security keys

#49

Post by kevin_nisbet »

tpetry wrote: post #37
tptacek wrote: post #16

Earlier quoted context omitted.

The primary purpose of U2F/WebAuthn is to break phishing attacks. Code-based TOTP 2FA, the kind you're probably using now, is already adequate to the task of making sure you're not credential-stuffed.

Autofill of a password manager is a working countermeasure against phishing too: If autofill does not work there is something wrong and you should look closer...

I tend to be a little hesitant to use the browser plugins that do autofill, I think most major vendors have had a vulnerability of some sort at some point. Doesn't mean it's unsafe, it's just the tradeoff I prefer is that I'm more likely to be phished on a single account, but less likely to have my entire DB compromised through a plugin compromise.

Re: Support for U2F security keys

#50

Post by pfg »

tpetry wrote: post #37
tptacek wrote: post #16

Earlier quoted context omitted.

The primary purpose of U2F/WebAuthn is to break phishing attacks. Code-based TOTP 2FA, the kind you're probably using now, is already adequate to the task of making sure you're not credential-stuffed.

Autofill of a password manager is a working countermeasure against phishing too: If autofill does not work there is something wrong and you should look closer...

I can't find a source, but my recollection is that Google developed U2F because autofill didn't work reliably enough, so many users would just paste the password manually anyway.
Post reply on HN