Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

cyberscoop.com

Post reply on HN
Print view View original

71–80 of 147 posts

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#71

Post by Grazester »

opencl wrote: post #47
danjoc wrote: post #39

Earlier quoted context omitted.

>Wrong! No, sorry, you are wrong. https://plus.google.com/+BensonLeung/posts/UFCHbSDRa2o

99% of people do not care what the USB spec says is allowed, if the thing works they will buy and use it. See: every phone charger that outputs more than 500mA over a USB-A port. Doesn't comply with the spec, nobody cares, everyone does it. Even the post says the only reason C-A adapters aren't allowed in the spec is that they can be chained with a C-C cable to make an A-A cable. They work fine if you don't do stupid…

Isn't current drawn? Meaning that the device doesn't have to use 500mA but could draw up to that much if need? So it would not hurt the device.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#72

Post by mfer »

agl wrote: post #7
ridgewell wrote: post #3

I don't think I'm all that opposed to competition in this space. Yubico has a virtual monopoly on high-quality Fido U2F keys at the moment. Google is a giant admittedly, and could crush Yubico overtime though. Not sure if this is just a cheaply made Feitian Key though rebranded for Google Cloud, or if it is a new product in itself. However, I've heard that Google is kind of going on a tangent with its own U2F impleme…

> However, I've heard that Google is kind of going on a tangent with its own U2F implementations, emphasizing an old-school implementation instead of the Web Authentication Standard that's pushed by the W3C. Chrome has supported "U2F" (the first FIDO spec) for a while and all support for Security Keys in the last few years has been via this protocol. But we're implementing the W3C Web Authentication (webauthn) spec a…

> Chrome has supported "U2F" (the first FIDO spec) for a while and all support for Security Keys in the last few years has been via this protocol.

Google U2F to their sites only works in Chrome. You can't use a Yubikey in say Firefox (FF supports it). They way they are making this all work isn't using open common cross browser standards.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#73

Post by jfim »

michaelmior wrote: post #64

This is definitely threadjacking, but curious if anyone here has tried the Yubikey Neo? I'd like to purchase a 2FA device and it seems like this is the only option with NFC which I would appreciate given how often I find I'm logging into things on my phone these days.

The NEO is pretty nice, especially when combined with the Yubico authenticator app for TOTP codes.

One issue with the authenticator apps (eg. Google authenticator) is that if you reset your phone, you lose all your secrets and need to reset 2FA for all your accounts. With the Yubico authenticator, the secret is stored in the key and the phone only gives a time signal and authenticates to the key over NFC. The app is also available for desktops, making it pretty easy to use 2FA without having your phone.

The NEO is older unfortunately, so it's only available in USB A form factor and has weaker crypto than newer Yubikeys (2048 bit vs 4096, iirc) for private keys stored in it if you're planning to use GPG (for email encryption or signing git commits). In practice, that's not a real limitation.

However, it also does not support signing Docker images, which is unfortunate.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#74

Post by opencl »

dfox wrote: post #59
NedIsakoff wrote: post #50

Earlier quoted context omitted.

Doesn't that mean that 99.99% of all USB chargers for phones violate the spec? Since the spec says USB A only outputs 500mA ? Holy shit!

IIRC since at least 2.0 the USB spec is very liberal in what current can A port source and the 500mA is relevant only as maximum that can device with B port negotiate as it's sink current.

The spec is not liberal. See Section 7.2.1 for power delivery information. "A unit load is defined to be 100 mA. The number of unit loads a device can draw is an absolute maximum, not an average over time. A device may be either low-power at one unit load or high- power, consuming up to five unit loads."

http://sdphca.ucsd.edu/Lab_Equip_Manuals/usb_20.pdf

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#75

Post by gleenn »

mfer wrote: post #72
agl wrote: post #7

Earlier quoted context omitted.

> However, I've heard that Google is kind of going on a tangent with its own U2F implementations, emphasizing an old-school implementation instead of the Web Authentication Standard that's pushed by the W3C. Chrome has supported "U2F" (the first FIDO spec) for a while and all support for Security Keys in the last few years has been via this protocol. But we're implementing the W3C Web Authentication (webauthn) spec a…

> Chrome has supported "U2F" (the first FIDO spec) for a while and all support for Security Keys in the last few years has been via this protocol. Google U2F to their sites only works in Chrome. You can't use a Yubikey in say Firefox (FF supports it). They way they are making this all work isn't using open common cross browser standards.

I'm not sure if we're talking about the same exact service, but I'm definitely using a Yubikey with Firefox for Gmail. Not sure if it's enabled by default yet, iirc I had to go into Firefox about:config and twiddle a bit somewhere. What service(s) don't work?

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#76

Post by pg_bot »

Animats wrote: post #55

It's a Google product. Does it phone home to Google, or what?

No, it is a security key for universal second factor authentication. Read the spec[0] before you put on your tinfoil hat John.

[0]: https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/FID...

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#77

Post by mrrsm »

gleenn wrote: post #75
mfer wrote: post #72

Earlier quoted context omitted.

> Chrome has supported "U2F" (the first FIDO spec) for a while and all support for Security Keys in the last few years has been via this protocol. Google U2F to their sites only works in Chrome. You can't use a Yubikey in say Firefox (FF supports it). They way they are making this all work isn't using open common cross browser standards.

I'm not sure if we're talking about the same exact service, but I'm definitely using a Yubikey with Firefox for Gmail. Not sure if it's enabled by default yet, iirc I had to go into Firefox about:config and twiddle a bit somewhere. What service(s) don't work?

I know there used to be a bug where Google services, as well as some others, used some different code to handle u2f which broke on Firefox. This has been fixed for a while now it seems so I am not sure if this issues still exists.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#78

Post by rrdharan »

technologia wrote: post #69
dmoy wrote: post #27

Earlier quoted context omitted.

> Not sure if this is just a cheaply made Feitian Key though rebranded for Google Cloud, or if it is a new product in itself. The article implies otherwise: """ “It’s built with a secure element including firmware we built ourselves,” Google’s Rob Sadowski said. “It provides a ton of security with very little interaction and effort on the part of the user.” """

Its not atypical for Google to do this, for instance Google Hangouts is actually a licensed software deal and not something in-house (albeit not the greatest example).

I'm not really sure what this is referring to - did you mean the Vidyo codec deal (which was subsequently dropped in favor of VP8)?

https://vsee.com/blog/google-hangouts-dropped-vidyo/

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#79

Post by jlgaddis »

gleenn wrote: post #75
mfer wrote: post #72

Earlier quoted context omitted.

> Chrome has supported "U2F" (the first FIDO spec) for a while and all support for Security Keys in the last few years has been via this protocol. Google U2F to their sites only works in Chrome. You can't use a Yubikey in say Firefox (FF supports it). They way they are making this all work isn't using open common cross browser standards.

I'm not sure if we're talking about the same exact service, but I'm definitely using a Yubikey with Firefox for Gmail. Not sure if it's enabled by default yet, iirc I had to go into Firefox about:config and twiddle a bit somewhere. What service(s) don't work?

Support was included starting with FF57, IIRC, although it was disabled by default -- I also enabled it at that time.

Now, in current versions of Firefox, I believe it is enabled by default (starting with FF59?).

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#80

Post by michaelmior »

jfim wrote: post #73
michaelmior wrote: post #64

This is definitely threadjacking, but curious if anyone here has tried the Yubikey Neo? I'd like to purchase a 2FA device and it seems like this is the only option with NFC which I would appreciate given how often I find I'm logging into things on my phone these days.

The NEO is pretty nice, especially when combined with the Yubico authenticator app for TOTP codes. One issue with the authenticator apps (eg. Google authenticator) is that if you reset your phone, you lose all your secrets and need to reset 2FA for all your accounts. With the Yubico authenticator, the secret is stored in the key and the phone only gives a time signal and authenticates to the key over NFC. The app is…

I didn't realize that the Neo was so outdated. I wonder why 2FA with NFC hasn't caught on more.
Post reply on HN