Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

That's not how 2FA works

shkspr.mobi

Post reply on HN
Print view View original

51–60 of 269 posts

Re: That's not how 2FA works

#51

Post by nwotnagrom »

edent wrote: post #20
hehehaha wrote: post #12

Not sure why the author is so negative on Yubikey. His only reason is that an attacker can steal his laptop with the key plugged in. That’s a user error. I much rather have Yubikey over all other forms of security because it simply forces the attacker to be physically present. Why is that important? Because even if your laptop is stolen with your Yubikey at a local Starbucks, you’re more likely to catch that person v…

Author here. I did provide a few other reasons - mostly around usability of YubiKeys. Try observing a non-techie set one up and tell me if you think it is as easy as it could be. Realistically, you're probably not going to catch a mugger. Otherwise robberies like that wouldn't occur. Snatching a laptop with a key physically plugged in it is probably easier than snatching a laptop and a separate phone. Regardless of m…

I agree on the idea around usability of YubiKeys. I have them also and believe they are great, but I never seem to have them when I need them. Of course, maybe its on another floor or another room and I am being lazy not walking over there, but it is an added inconvenience on a process that needs to be balanced between security and convenience.

Re: That's not how 2FA works

#52

Post by drivebycomment »

edent wrote: post #20
hehehaha wrote: post #12

Not sure why the author is so negative on Yubikey. His only reason is that an attacker can steal his laptop with the key plugged in. That’s a user error. I much rather have Yubikey over all other forms of security because it simply forces the attacker to be physically present. Why is that important? Because even if your laptop is stolen with your Yubikey at a local Starbucks, you’re more likely to catch that person v…

Author here. I did provide a few other reasons - mostly around usability of YubiKeys. Try observing a non-techie set one up and tell me if you think it is as easy as it could be. Realistically, you're probably not going to catch a mugger. Otherwise robberies like that wouldn't occur. Snatching a laptop with a key physically plugged in it is probably easier than snatching a laptop and a separate phone. Regardless of m…

Your opinion is in this case based on your ignorance and misunderstandings. The main threat model U2F key protects against is phishing, and phishing is the largest threat currently. The password is sufficient to protect you for opportunistic offline attacks like theft or loss.

Re: That's not how 2FA works

#53

Post by hehehaha »

DecoPerson wrote: post #37
lrvick wrote: post #19

The Yubikey/WebAuthn comments are really ignorant and discouraging people from the best defense against this sort of attack that exists. First of all you can get WebAuthn devices for as little as $10 now. Second, there is no app to configure. You plug it in when it says register and tap it. Done. Third, if the WebAuthn device gets stolen the attacker presumably lacks a password. You can't use the device by itself. Al…

For the reasons listed in the article and more, Yubikeys and similar devices aren’t likely to ever be popular. To give future security devices along the same vain a better chance at gaining popularity and being widely adopted (which will hopefully bringing us a more stable, less stressful society), the designs of these new devices must solve or workaround the issues the author describes. It’s really annoying when ind…

I think Yubikey (and similar physical solutions) will eventually gain popularity. Carrying a key is pretty much a standard practice across the globe and benefit is more than negligible because it forces physical attack versus remote/virtual.

Re: That's not how 2FA works

#55

Post by tytso »

edent wrote: post #21
sigmar wrote: post #17

> Buy a device, register it, install the app, What u2f app is this referring to? I've never needed anything more than chrome to use u2f on windows or ubuntu. Also seems weird to complain about setting up an app, when a few sentences before that they recommend installing a password manager...

YubiKey recommended that I install Yubi Auth https://play.google.com/store/apps/details?id=com.yubico.yub... and YubiClip https://play.google.com/store/apps/details?id=com.yubico.yub... Should I not have?

If you had used one of the $10 USD Webauthn (aka U2F) tokens, it wouldn't have asked you to install any applications.

The "problem" is the expensive Yubikeys that you were whining about has lots of extra functionality that has nothing to do with U2F, and that's what the extra applications are all about.

I happen to use a Yubikey because I want that extra functionality, including using it to secure the keys I use for ssh and for digitally signing git tags so I can securely push git pull requests. But that's because I'm a developer, and it's why I'm happy to purchase multiple Yubikeys (one for my desktop, one for laptop, backups including one that is on a keychain, etc.) Perhaps you were reading web sites that was giving advice for developers as opposed to for consumers?

Re: That's not how 2FA works

#56

Post by fjiizrsdfjjj »

lrvick wrote: post #30
edent wrote: post #20

Earlier quoted context omitted.

Author here. I did provide a few other reasons - mostly around usability of YubiKeys. Try observing a non-techie set one up and tell me if you think it is as easy as it could be. Realistically, you're probably not going to catch a mugger. Otherwise robberies like that wouldn't occur. Snatching a laptop with a key physically plugged in it is probably easier than snatching a laptop and a separate phone. Regardless of m…

I have helped literally hundreds of people setup Yubikeys across several companies. Your take is just not my experience at all. Tapping a blinking light it is much easier than fussing with a 2FA app and works when someone's phone is dead. Yubikeys in particular are near indestructible. They even work after you soak them in acetone overnight and melt the plastic off. I tried. When it says "plug in your device" you plu…

If my Yubikey gets stolen, how do I log in into my accounts?

Serious question; never understood how that works.

Re: That's not how 2FA works

#57

Post by nijave »

_wldu wrote: post #27

Nice blog post with interesting views. I leave my YubiKey plugged in all the time. It's basically a permanent part of the computer.

Same, and many websites have support for multiple keys so enroll a couple of the cheap $10 ones (per device) and then you can use TOTP or just printed codes as a backup.

Even if your device is stolen 1) it's unlikely by a technically savvy bad actor (and if you're at risk, you probably have had special data security training anyway) 2) you're still only stealing one factor. Your device should also be encrypted with a password which would protect any passwords [managers] on the device

Re: That's not how 2FA works

#58

Post by louis-lau »

Tomte wrote: post #8
lkbm wrote: post #3

Earlier quoted context omitted.

With an email link or a Yubikey it might, but with SMS or an Authenticator app it doesn't add any extra way for me to identify the site.

That's true, I was talking about a Yubikey.

But the tweets this article was written in response to, weren't.

Re: That's not how 2FA works

#59

Post by thatnerdyguy »

hehehaha wrote: post #41
zimbatm wrote: post #38

Earlier quoted context omitted.

Another issue not mentioned by the author is what happens if the Yubikey is lost or breaks. The story around this type of event is sort of ignored and not understood properly. AFAIK it's not possible to duplicate a key (by design), meaning that the user will have to update all their websites' 2FA (hopefully there is a recovery method available).

Yes. You must have at least two keys registered. However it’s worth noting that most services do not offer priority. Meaning you can use either one. I think it makes sense to designate back up keys and only to be used when user reports lost/stolen primary key.

But what is the story there? You have a backup key, hopefully stored "off site", now you want to enroll in another website. You have to get that backup key before you do that? Or bookkeep which sites you have on the backup key and which you don't?

Re: That's not how 2FA works

#60

Post by yangwuzrite »

The author of this article has no idea how 2FA works or why it's used.

2FA is used to prevent or mitigate the impact of phishing or other attacks where a password is compromised (password reuse, random guessing, keylogger, etc.). The author does bring up one hypothetical attack -- a man-in-the-middle attack -- where someone can trick a user into providing their 2FA or triggering an authorization (like with a Duo push). This requires the ability to execute a real-time attack.

FIDO/U2F/Webauthn (I still haven't figured out exactly what you're supposed to call them) security tokens solve that use case by allowing the website to authenticate directly to the token. That can't be phished -- even if you're tricked into a fake website and given a fake webauthn prompt, AFAIK there's no known way to proxy or otherwise intercept that second factor authentication to allow a phishing attack to succeed.

His complaint that the token doesn't have a password is largely pointless -- the token is the second factor, the password on the site is the first. If you're using passwordless FIDO2 logins, then it does have a PIN.

Long story short, this guy is full of crap.

Post reply on HN