Extension version with similar functionality: https://chrome.google.com/webstore/detail/keyless-u2f/bhgbpf....
Works with Mac + Windows. Amazing to see more soft solutions for U2F.
Soft U2F: A software-based U2F authenticator for macOS
51–60 of 114 posts
Re: Soft U2F: A software-based U2F authenticator for macOS
#52I tried it but it didn't work for me. I'm running Mavericks. Do I need to reboot or something?
I've only tested on Sierra, so I'm not terribly surprised that this doesn't work. Would you mind opening an issue so I can help debug? https://github.com/github/SoftU2F/issues/new
Re: Soft U2F: A software-based U2F authenticator for macOS
#53Can someone explain how this is an improvement on phone-based, non-SMS 2FA? This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.
This is mostly against phishing. A phisher can get users to insert a token from a USB device or a text into evil.com. But U2F uses public key crypto, so your token derived for evil.com is not the same as for github.com
This is a brilliant idea to use as a third factor. Instead of TOTP or the hardware U2F key, just create keys for all your browsers. That way, you're more protected against phishing, but still have a way to log in if you lose your keyfile.
Re: Soft U2F: A software-based U2F authenticator for macOS
#54This seems misguided - it is watering down a decent system simply to appease and attract people too cheap to buy tokens; if 2fa is something that is so important to you, and you need it, just buy the damn tokens!
A vague comparison, would be me selling pre-printed 'random' passwords on paper because a user generating their own was 'too difficult'
IMHO, soft token u2f is only useful for testing, development, and personal entertainment
Re: Soft U2F: A software-based U2F authenticator for macOS
#55Re: Soft U2F: A software-based U2F authenticator for macOS
#56U2F adoption seems quite slow. Google were in early, and later github and Dropbox. But since then? Feels like nothing happened.
> Google were in early
That's an understatement, they've co-invented it, it was called Project Gnubby at the time. As part of their BeyondCorp project they needed better 2FA and Gnubby was standardized under the FIDO Alliance. Their U2F user study[1] is interesting.
> But since then?
http://www.dongleauth.info/ has a list but yes, adoption has been slow. The W3C Web Authentication spec[2] (which is the successor to the FIDO work) will hopefully see better adoption, and it'll work with existing U2F tokens. Microsoft for example has skipped FIDO 1.0 and committed to the W3C spec instead[3].
1: http://fc16.ifca.ai/preproceedings/25_Lang.pdf 2: https://www.w3.org/TR/webauthn/ 3: https://developer.microsoft.com/en-us/microsoft-edge/platfor...
Re: Soft U2F: A software-based U2F authenticator for macOS
#57To Github people: I ordered your yubikey token but stayed away from U2F out of fear that I'd be locked out if I lost the hardware token. But I didn't realize you could setup U2F and TOTP as a backup.
Not only can you do this, but the major services won't even let you set up U2F without a backup factor.
The best current Google auth stack, by the way, is:
1. U2F
2. Phone-based authenticator app (TOTP)
3. Password-manager password
4. Printed codes
5. DISABLE SMS. (Google forces you to enroll in SMS to turn on 2FA; you can simply delete your phone number after enrolling everything else).
Re: Soft U2F: A software-based U2F authenticator for macOS
#58This seems misguided - it is watering down a decent system simply to appease and attract people too cheap to buy tokens; if 2fa is something that is so important to you, and you need it, just buy the damn tokens! A vague comparison, would be me selling pre-printed 'random' passwords on paper because a user generating their own was 'too difficult' IMHO, soft token u2f is only useful for testing, development, and perso…
But notice the software is only for Mac. So it's for people who are too cheap to spring for a $10 key but drop $1k on a laptop. Go figure.
Re: Soft U2F: A software-based U2F authenticator for macOS
#59I'm surprised they're willing to trust a mouse click on a notification. (Can't that be simulated by malware by using the Accessibility APIs?) I was expecting a U2F authenticator that wanted a Touch ID touch first.
Re: Soft U2F: A software-based U2F authenticator for macOS
#60This seems misguided - it is watering down a decent system simply to appease and attract people too cheap to buy tokens; if 2fa is something that is so important to you, and you need it, just buy the damn tokens! A vague comparison, would be me selling pre-printed 'random' passwords on paper because a user generating their own was 'too difficult' IMHO, soft token u2f is only useful for testing, development, and perso…
Malware running on your computer is a game-over scenario even with hardware tokens. The main difference here is that you'll need to revoke the device key after a compromise.
Password reuse and phishing are probably the most common threats users face. This addresses both with a (for most users) negligible security trade-off. If it increases U2F adoption, I'm all for it. I'd like to see U2F (or webauthn) become a browser/OS feature, backed by TPMs or things like TouchID, but this is a good first step.