Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub supports Universal 2nd Factor authentication

github.com

Post reply on HN
Print view View original

61–70 of 85 posts

Re: GitHub supports Universal 2nd Factor authentication

#61

Post by numbsafari »

tokenizerrr wrote: post #50
dankohn1 wrote: post #35

Earlier quoted context omitted.

I think the issue is that I have a laptop at home and iMac at work so I don't bring my computer on my commute. Also, I like the extra security of the fingerprint scanner on my iPhone.

Your iPhone is completely covered with your fingerprints. Also, if your phone gets hacked/compromised the attacker could steal the secret used to generate your TOTPs. This is not possible with the Yubikey, it is absolutely impossible to extract the private key. I have a Yubikey on my keychain (it can easily withstand this), and it takes very little effort to plug it into the USB port when I require it. Less than it w…

It's probably a lot easier to steal your keys than it is to dust his phone for fingerprints and go through all the trouble of then faking the print on the sensor.

Heck, all someone needs to do is grab the one permanently plugged into your USB hub on your work desktop after you've left for the day.

Just sayin'...

Re: GitHub supports Universal 2nd Factor authentication

#62

Post by tokenizerrr »

numbsafari wrote: post #61
tokenizerrr wrote: post #50

Earlier quoted context omitted.

Your iPhone is completely covered with your fingerprints. Also, if your phone gets hacked/compromised the attacker could steal the secret used to generate your TOTPs. This is not possible with the Yubikey, it is absolutely impossible to extract the private key. I have a Yubikey on my keychain (it can easily withstand this), and it takes very little effort to plug it into the USB port when I require it. Less than it w…

It's probably a lot easier to steal your keys than it is to dust his phone for fingerprints and go through all the trouble of then faking the print on the sensor. Heck, all someone needs to do is grab the one permanently plugged into your USB hub on your work desktop after you've left for the day. Just sayin'...

It's my desktop in my home. If someone breaks in (or steals the other yubikey from my keychain, and thus has the keys to my home) I have bigger issues. And they still won't know my password.

Re: GitHub supports Universal 2nd Factor authentication

#63

Post by mikecb »

dankohn1 wrote: post #2

This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?

A pin can be phished, a U2F handshake cannot.

Re: GitHub supports Universal 2nd Factor authentication

#64

Post by treve »

dudus wrote: post #5
dankohn1 wrote: post #2

This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?

This is actually more convenient sometimes. I already have one of these FOBs permanently attached to my computer. It's a tiny pieces that fit into usb and only protrudes a couple of milimiters. Since I have this always connected all I have to do is touch it and I'm in. Takes me less than once second while taking my phone, opening the app and typing the code by hand takes 10-20 seconds. The downside is that it takes a…

Dumb question... what does the yubikey then do that a normal computer can't do? If you keep it plugged in, what security benefit does it have over storing (strong) passwords?

Re: GitHub supports Universal 2nd Factor authentication

#65

Post by superuser2 »

drdaeman wrote: post #57

Uh. U2F feels incredibly limited compared to PKCS#11 I really wonder why it was chosen (and somewhat disappointed by the choice.) With a smartcard that can hold an key pair, one can both authenticate (sign) and encrypt messages, using a same single key (or multiple keys if wish for multiple identities). With U2F all one can is authenticate, using a distinct securely-stored PSK for each remote party.

The infrastructure around smartcards is designed for one enterprise to pay another enterprise millions of dollars to roll out Active Directory-based authentication for a Windows domain with hundreds of thousands of users, for a multinational corporation to roll out a payment card, etc.

A single hobbyist maintains an open-source tool that allows applets to be loaded on to GlobalPlatform-compliant cards. It's pretty fragile and requires some trickery and tribal knowledge. You have to hope some forum somwhere has the unlock key to allow applet loading on whatever card you bought. Another single hobbyist maintains a PKCS#11-compatible card applet, PKIApplet. It requires a relatively modern JavaCard version and compatible JavaCards are not always available for individual purchase in the U.S. If you're prepared to really get down and dirty with DIY trickery, you might manage to load PKIApplet onto a JavaCard with GlobalPlatformPro.

Actually using it requires OpenSC, not a shining example of usability or code quality. It requires specific drivers for different cards, each having slightly different personalization procedures. Many of the drivers in it are for cards that can no longer be purchased. PKIApplet appears to have a driver in OpenSC but I haven't gotten an opportunity to test it yet. Much of the tooling you'll find references to in documentation turns out to have expired domains and abandoned SourceForge projects last updated 2002.

The OpenPGP route appears to be a little less sad than the PKCS#11 route, since at least Yubikey maintains a modern OpenPGPApplet.

If your Fortune 100 company's CTO wants to play golf with Gemalto, smart cards are for you. Otherwise, probably not. It makes sense that a modern personal 2FA solution would want to be free of all that legacy.

Re: GitHub supports Universal 2nd Factor authentication

#66

Post by moreati »

A few U2F details worth mentioning

Browser support is currently limited to Chrome, and possible Windows Edge*

For now it only works with USB. Bluetooth and NFC specs are out, browser support is the bottleneck

The protocol is public/private key based, with the private key strongly encouraged to be in tamper resistant/evident storage.

The protocol is authentication method agnostic. It doesn't care if you use a USB key, a retinal scan, a pin or divination.

You could write a software only authenticator if you wanted, but servers could detect that (and reject it if they chose to) through the attestation certificate you provided. You can't pretend to be a brand X authenticator, because only company X will have the private key(s) matching the attestation certs to sign (batches) of model X authenticator.

Yubikeys are just one implementation of a U2F authenticator. In theory GitHub now works with any present/future authenticators that talks U2F (modulo browser support) e.g. an iPhone+TouchID+NokNok SDK, a Pebble watch+app, an Android Phone+$your_app, an NFC implant, m-of-n wearables

* Microsoft announced something U2F related for Windows 10, I never got to the bottom of what exactly

For more detail I did a talk at EuroPython this year https://moreati.github.io/passwordspain/#/ https://www.youtube.com/watch?v=YSTsgldazSU

Re: GitHub supports Universal 2nd Factor authentication

#67

Post by nikolay »

You can still order:

1. Go to https://www.yubico.com/github-special-offer/

2. Add the special edition security key to cart

3. Apply the "GITHUB" coupon

4. Check out

Once you get it, don't forget to also use it with Dropbox and Google, which both predate GitHub in the U2F support. If you know any other provider, comment below, please!

Re: GitHub supports Universal 2nd Factor authentication

#68

Post by superchink »

nikolay wrote: post #67

You can still order: 1. Go to https://www.yubico.com/github-special-offer/ 2. Add the special edition security key to cart 3. Apply the "GITHUB" coupon 4. Check out Once you get it, don't forget to also use it with Dropbox and Google, which both predate GitHub in the U2F support. If you know any other provider, comment below, please!

Can confirm that this worked! This should be the top post.

Thanks for the tip.

Re: GitHub supports Universal 2nd Factor authentication

#69

Post by nikolay »

nikolay wrote: post #67

You can still order: 1. Go to https://www.yubico.com/github-special-offer/ 2. Add the special edition security key to cart 3. Apply the "GITHUB" coupon 4. Check out Once you get it, don't forget to also use it with Dropbox and Google, which both predate GitHub in the U2F support. If you know any other provider, comment below, please!

For more sites that support U2F (or how to bug them to add support): https://news.ycombinator.com/item?id=10315888

Re: GitHub supports Universal 2nd Factor authentication

#70

Post by imrehg »

nikolay wrote: post #67

You can still order: 1. Go to https://www.yubico.com/github-special-offer/ 2. Add the special edition security key to cart 3. Apply the "GITHUB" coupon 4. Check out Once you get it, don't forget to also use it with Dropbox and Google, which both predate GitHub in the U2F support. If you know any other provider, comment below, please!

Looks in the meantime it was overwhelmed, only 1 hour since your post.

> We are experiencing difficulties and the GitHub Special Offer is temporarily unavailable. We are working hard to fix the issue and appreciate your understanding.

> Keep an eye on Twitter (@yubico) for updates on when we will have the GitHub Special Offer available again.

Post reply on HN