71–80 of 126 posts
Bought a U2F Yubikey more than a year ago. It is pretty sturdy. Better buy two and use one as a backup. U2F is really convenient to use. Compare that to all the OTP apps out there.
As an alternative to a second key as a backup, you can always keep a set of printable backup OTP tokens offline in a safe etc, ideally encrypted.
I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token. Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link…
Are there any safe software alternatives to Google Authenticator? Duo? LastPass?
Thanks for writing this! One nitpick: the guide says "If you're curious why it's important to not have a phone number on your account, see the security key FAQ", but the linked security FAQ doesn't actually appear to say why it's important.
I have answers/arguments along those lines here: https://github.com/lrvick/security-token-docs/blob/master/FA... Would be interested in seeing contrasting views though!
The real answer for "why not a smartphone app" is "because code generators are just as phishable as passwords". In the real world, that's how people are being compromised, not by elaborate phone exploit pivots but by phishing pages. It also speaks to why phone authenticators are acceptable backups to tokens.
The real answer for "why not SMS" is "because both teenagers and intelligence services can get a phone number redirected; your phone number is not your phone."
Obviously, you don't PIN-lock a U2F token; the answer to "what if it's stolen" is "whoever stole it probably doesn't have your password, which they'll need in order to use the token, so if your token is stolen remove it from your account and then fish $17.99 out of your couch cushions and buy a new one".
Bought a U2F Yubikey more than a year ago. It is pretty sturdy. Better buy two and use one as a backup. U2F is really convenient to use. Compare that to all the OTP apps out there.
My Yubikey recently died, so I'd +1 on this approach to have another as backup. They offered to replace it under warranty, though.
Earlier quoted context omitted.
If only there were a similar guide to getting gpg agent working with the yubikey stored gpg keys and ssh. I've done it, but for the life of my I couldn't tell you how as it was mostly just trying magic incantations of things until it started working.
Here you go: Simple GPG setup: https://github.com/lrvick/security-token-docs/blob/master/Us... Advanced GPG setup with backups: https://github.com/lrvick/security-token-docs/blob/master/Us... SSH Setup: https://github.com/lrvick/security-token-docs/blob/master/Us... I also will be adding an alternate "quick ssh setup" guide via PKCS#11 flows to just store an existing ssh private key. Still I think GPG is the way to g…
Security tokens are a nice little bonus for security, and they're a major corrective for the kinds of real-world attacks that screw real people over, like phishing (and dumb passwords). But they're pretty marginal against the kinds of attackers who will target SSH keys. Don't get fetishistic about them; at bottom, for serious systems security, they're mostly cosmetic. It feels good to say that all your SSH keys are held in secure devices, but it doesn't mean much.
Earlier quoted context omitted.
Are there any safe software alternatives to Google Authenticator? Duo? LastPass?
I use Authy: https://www.authy.com/ Now I'm wondering are there similar security concerns here as with Google Authenticator?
Earlier quoted context omitted.
Are there any safe software alternatives to Google Authenticator? Duo? LastPass?
I use Authy: https://www.authy.com/ Now I'm wondering are there similar security concerns here as with Google Authenticator?
Security is hard enough when everything is open source. Closing foundational security tools so only a select few biased individuals can deem them secure on a deadline is never a good plan.
Earlier quoted context omitted.
tokenizerrr | https://news.ycombinator.com/item?id=14105616 Even without root. Just run a backup and extract it from that. You can do it with just adb or helium. -- I can't quickly find any examples online that don't specifically mention requiring rooting the phone. Just this anecdote: https://community.spiceworks.com/topic/465582-google-authent... If you do a backup (even if not rooted you can use ADB to backup your…
Well the scenario we are wanting to defend against is an attacker that can remotely (or even locally) exploit/root the phone (see long list of vulns for ios and android that have allowed exactly this). How many of these still exist not yet patched? Depending on who you work for, someone might just burn a 0-day on you. It all depends on your threat profile. Putting the secret in a hardware token gives you easy to reas…
When we work with lawyers, reporters, and NGOs, what we find are people with much more urgent security problems. They're one carefully worded email away from giving their entire email account away to a 25 year old in Estonia. They aren't worried that their phone is about to get owned up --- mostly because that isn't going to happen, but for other reasons too.
Real targets are going to be compromised for 3 reasons:
1. They're going to be phished out of losing their credentials.
2. They're going to share credentials between sites and lose them in a breach of one of those sites.
3. They're going to click on an attachment and lose their whole computer to an attacker.
The U2F/TOTP stack this post recommends nicely addresses (1) and (2), and nothing anyone on this thread is talking about addresses (3). I'm not sure why we're spending so much time considering (13).
Earlier quoted context omitted.
I have answers/arguments along those lines here: https://github.com/lrvick/security-token-docs/blob/master/FA... Would be interested in seeing contrasting views though!
These are indeed answers, but they aren't the real answers. The real answer for "why not a smartphone app" is "because code generators are just as phishable as passwords". In the real world, that's how people are being compromised, not by elaborate phone exploit pivots but by phishing pages. It also speaks to why phone authenticators are acceptable backups to tokens. The real answer for "why not SMS" is "because both…
No matter how much you protect the secret though, not getting phished is left to the hopefully paranoid user, which is for sure not ideal, but we are probably years out from TOTP being replaced with U2F for most sites.
TOTP via hardware tokens is a stopgap.
Great comments though. Will update to reflect them.
I'd like some advice about safely accessing gmail from your phone. In particular an android phone that might not have the latest version of android on it. Also for situations where not only do you access your gmail from your phone but also your google authenticator app is installed on it.
Encrypt + add PIN + disable SMS/Phone authentication? Is this insufficient?