41–50 of 80 posts
Earlier quoted context omitted.
Much safer than a TOTP authentication app, which is susceptible to phishing attacks, unlike U2F.
I had to switch back from Yubikey to TOTP because AWS' CLI tools doesn't work with U2F. This really annoys me.
Earlier quoted context omitted.
Much safer than a TOTP authentication app, which is susceptible to phishing attacks, unlike U2F.
I had to switch back from Yubikey to TOTP because AWS' CLI tools doesn't work with U2F. This really annoys me.
Earlier quoted context omitted.
I still don't understand which titan keys I have and whether this affects them.
Titan on Pixel -> OK Titan BT or NFC -> Physically not OK, but remote attacks still impossible so unless you're targeted and somehow got access to your fob, it doesn't matter.
Earlier quoted context omitted.
The main idea with a security token is that you can not get the keys out of them.[ß] So for a truly secure and reliable setup, get three. Enroll them all as parallel 2FA tokens. Keep one with you, one in a relatively easily accessible but non-obvious place, and one in a safe or bank deposit box. That way when the one you have with you breaks or you lose it, promote the secondary to your primary and order a new one to…
I keep one always plugged into my computer (like a Nano model), and one on my keychain. You don't usually need more than that as there are ideally other ways to recover your account (printed recovery keys etc). If your laptop gets stolen with key inserted, and you didn't have time to invalidate the key, one still has to access your local account, and find out saved login information in order to leverage that key, and…
I use them for services like Google, but also for SSH keys. (Since 8.2, OpenSSH has built-in U2F support.)
Even with this problem, using the keys for U2F is safer than SMS two factor auth. Possibly also safer than authentication app on phone, which could be compromised in various ways.
Much safer than a TOTP authentication app, which is susceptible to phishing attacks, unlike U2F.
Compared to TOTP, U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens authentication against server-side attacks. Hardware U2F also sequesters the client secret in a dedicated single-purpose device, which even given the vulnerability described here still has a tiny fraction of the attack surface of a TOTP app and its general purpose host device.
Earlier quoted context omitted.
I've been meaning to buy a Yubikey. What is the best practice for using a security key? Is there a mechanism for backing my keys up somewhere safe so that a loss of key doesn't mean a loss of my accounts?
The main idea with a security token is that you can not get the keys out of them.[ß] So for a truly secure and reliable setup, get three. Enroll them all as parallel 2FA tokens. Keep one with you, one in a relatively easily accessible but non-obvious place, and one in a safe or bank deposit box. That way when the one you have with you breaks or you lose it, promote the secondary to your primary and order a new one to…
This is a wildly impressive vuln to discover. Cheers to these guys. Holy hell.
Earlier quoted context omitted.
I've been meaning to buy a Yubikey. What is the best practice for using a security key? Is there a mechanism for backing my keys up somewhere safe so that a loss of key doesn't mean a loss of my accounts?
The main idea with a security token is that you can not get the keys out of them.[ß] So for a truly secure and reliable setup, get three. Enroll them all as parallel 2FA tokens. Keep one with you, one in a relatively easily accessible but non-obvious place, and one in a safe or bank deposit box. That way when the one you have with you breaks or you lose it, promote the secondary to your primary and order a new one to…
Meaning, I would only really have to remember two strong passwords. The rest would be strong passwords, but without 2FA, and easily changeable without forcing myself to remember yet-another password and which account it belongs to.