Getting Started with Security Keys • Hacker News Board

Re: Getting Started with Security Keys

#41

Post by regecks » Thu, Oct 31, 2019, 6:06 AM UTC

alpb wrote: post #38

I can't help but think the author has recommended (1) storing backup keys (presumably in 1Password?) (2) storing OTP key generation QR codes in 1Password, so it can generate OTP codes for you. Doesn't this defeat the whole purpose of "two"-factor authentication? If your 1Password gets hacked the attacker has both your passcode and one-time password? You should consider keeping these two separate: If your 1Password un…

Further down in the same article:

>but you don't really want to have your password manager also store OTPs

Re: Getting Started with Security Keys

#42

Post by peterwwillis » Thu, Oct 31, 2019, 6:11 AM UTC

I think calling this 'paranoid' is a bit misleading. Paranoia suggests you are deluded or irrational, and that nobody's out to get you. In reality, people might be out to get you, just like walking a city street, someone might be looking to mug you. The difference is, they aren't looking for you specifically, the chances are pretty low of you running into them, and you shouldn't be overly worried or take too many precautions just because of that possibility. But you should be informed, and let your awareness of the possibility inform your actions.

Re: Getting Started with Security Keys

#43

Post by hsivonen » Thu, Oct 31, 2019, 6:24 AM UTC

vel0city wrote: post #30

skybrian wrote: post #26

I would put greater emphasis on not locking yourself out, since that's the most likely threat for many people. Losing your phone (or having it die on you) is common and you should assume you'll do it sooner or later. Print out backup codes and store them somewhere safe that you won't forget before enabling two-factor authentication that depends on you having your phone or other device that can break.

Including printable backup codes, most services supporting FIDO U2F or WebAuthn support tying multiple security keys to your account. Many of these authenticator devices are pretty cheap these days, its not insane to have a few of them. Have one on your keychain, another in a desk drawer, etc.

It's bad that many sites require you to set up TOTP (single seed) before they allow you to set up U2F (multiple keys), so you have the problem of having to take care of the TOTP seed anyway even if you have multiple U2F keys. (It's even worse when sites forget the U2F keys when you regenerate the TOTP seed.)

Re: Getting Started with Security Keys

#44

Post by sebazzz » Thu, Oct 31, 2019, 6:35 AM UTC

I have a Yubikey but I can't use it fully yet:

- There is no Yubikey OTP app for the iPhone

- Safari iOS does not respond to WebAuthn APIs (the apis are available but don't have any effect). I rather use plain Safari or Firefox, so Brave browser is not an option for me.

Re: Getting Started with Security Keys

#45

Post by blintz » Thu, Oct 31, 2019, 7:00 AM UTC

chowell wrote: post #34

vel0city wrote: post #30

Earlier quoted context omitted.

Including printable backup codes, most services supporting FIDO U2F or WebAuthn support tying multiple security keys to your account. Many of these authenticator devices are pretty cheap these days, its not insane to have a few of them. Have one on your keychain, another in a desk drawer, etc.

I was super surprised to learn AWS will only allow you to register a single FIDO token - the inherent lockout risk pushed me back to using OTP with the seed stored in multiple Yubikeys.

This is actually against the WebAuthn spec (https://www.w3.org/TR/webauthn-1/#credential-loss-key-mobili...). Hope they fix it soon.

Re: Getting Started with Security Keys

#46

Post by 0b0001 » Thu, Oct 31, 2019, 7:30 AM UTC

Now we have APIs for 2FA tokens in place.

When will we get an API for password managers? That'd enable effective domain name checks and such.

Re: Getting Started with Security Keys

#47

Post by lixtra » Thu, Oct 31, 2019, 7:33 AM UTC

jen729w wrote: post #31

skybrian wrote: post #26

I would put greater emphasis on not locking yourself out, since that's the most likely threat for many people. Losing your phone (or having it die on you) is common and you should assume you'll do it sooner or later. Print out backup codes and store them somewhere safe that you won't forget before enabling two-factor authentication that depends on you having your phone or other device that can break.

Or you upgrade your phone, or wipe your phone for some reason, and forget that your OTP codes don't transfer over. This is one reason I love OTP codes stored in 1Password. That was until I read a post here which convinced me that this approach is a total waste of time as I no longer truly have '2FA'. I have 1FA, and that is 1Password.

Having 2FA in 1Password is still strictly stronger than 1FA. The a leaked OTP token stays valid for about 60 seconds. Your leaked password may never change.

Re: Getting Started with Security Keys

#48

Post by londons_explore » Thu, Oct 31, 2019, 7:36 AM UTC

undefined3840 wrote: post #28

For some reason I‘m basically locked out of any paid Google product because my Google Pay account is disabled for whatever reason. I think it might have been flagged for fraud years ago and now cannot use it at all, including for Fi. It’s crazy.

Set up a new account, and remember not to link the new or old accounts by way of a recovery email address or using the same phone number.

It's a bit of a hassle, but most things you can transfer over between the accounts, and then just dump the old one. Lots of effort, but the only way unless you know an employee to get the block removed.

Re: Getting Started with Security Keys

#49

Post by wonnage » Thu, Oct 31, 2019, 8:04 AM UTC

alpb wrote: post #38

I can't help but think the author has recommended (1) storing backup keys (presumably in 1Password?) (2) storing OTP key generation QR codes in 1Password, so it can generate OTP codes for you. Doesn't this defeat the whole purpose of "two"-factor authentication? If your 1Password gets hacked the attacker has both your passcode and one-time password? You should consider keeping these two separate: If your 1Password un…

It's slightly less secure but much more convenient, which I think is worth the trade-off. Just having 2fa on means you don’t have to worry if a website has its passwords compromised, which is probably the biggest threat for most people.

Re: Getting Started with Security Keys

#50

Post by Boulth » Thu, Oct 31, 2019, 8:09 AM UTC

skybrian wrote: post #26

I would put greater emphasis on not locking yourself out, since that's the most likely threat for many people. Losing your phone (or having it die on you) is common and you should assume you'll do it sooner or later. Print out backup codes and store them somewhere safe that you won't forget before enabling two-factor authentication that depends on you having your phone or other device that can break.

Exactly this. And that's why AWS's U2F feature is basically useless. They should've allowed to add multiple keys simultaneously.