Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

cyberscoop.com

Post reply on HN
Print view View original

81–90 of 147 posts

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#81

Post by jbronn »

jfim wrote: post #73
michaelmior wrote: post #64

This is definitely threadjacking, but curious if anyone here has tried the Yubikey Neo? I'd like to purchase a 2FA device and it seems like this is the only option with NFC which I would appreciate given how often I find I'm logging into things on my phone these days.

The NEO is pretty nice, especially when combined with the Yubico authenticator app for TOTP codes. One issue with the authenticator apps (eg. Google authenticator) is that if you reset your phone, you lose all your secrets and need to reset 2FA for all your accounts. With the Yubico authenticator, the secret is stored in the key and the phone only gives a time signal and authenticates to the key over NFC. The app is…

When you use encrypted backups on iOS, Google Authenticator maintains its state and there's no need to reset 2FA. I'm sure there are similar mechanisms for Android.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#82

Post by jfim »

michaelmior wrote: post #80
jfim wrote: post #73

Earlier quoted context omitted.

The NEO is pretty nice, especially when combined with the Yubico authenticator app for TOTP codes. One issue with the authenticator apps (eg. Google authenticator) is that if you reset your phone, you lose all your secrets and need to reset 2FA for all your accounts. With the Yubico authenticator, the secret is stored in the key and the phone only gives a time signal and authenticates to the key over NFC. The app is…

I didn't realize that the Neo was so outdated. I wonder why 2FA with NFC hasn't caught on more.

No idea, since the NFC was actually pretty convenient. Considering the Yubico authenticator has a relatively small amount of downloads on the play store (50k), I'm guessing that feature wasn't used that much.

If you're thinking of getting the USB C versions of Yubikeys and using them with your phone, it does work but since the Yubikey appears as a keyboard, it disables the Android keyboard while it's plugged in. If I remember correctly, U2F support on Android also requires installing the Google authenticator app even though you might not store any codes in it.

You'd think it would be easier to have these things working.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#83

Post by jfim »

jbronn wrote: post #81
jfim wrote: post #73

Earlier quoted context omitted.

The NEO is pretty nice, especially when combined with the Yubico authenticator app for TOTP codes. One issue with the authenticator apps (eg. Google authenticator) is that if you reset your phone, you lose all your secrets and need to reset 2FA for all your accounts. With the Yubico authenticator, the secret is stored in the key and the phone only gives a time signal and authenticates to the key over NFC. The app is…

When you use encrypted backups on iOS, Google Authenticator maintains its state and there's no need to reset 2FA. I'm sure there are similar mechanisms for Android.

There might be nowadays, I remember it didn't work for me when migrating between two Nexus phones (4 to 5X iirc) a couple of years ago.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#84

Post by yayana »

dmoy wrote: post #27
ridgewell wrote: post #3

I don't think I'm all that opposed to competition in this space. Yubico has a virtual monopoly on high-quality Fido U2F keys at the moment. Google is a giant admittedly, and could crush Yubico overtime though. Not sure if this is just a cheaply made Feitian Key though rebranded for Google Cloud, or if it is a new product in itself. However, I've heard that Google is kind of going on a tangent with its own U2F impleme…

> Not sure if this is just a cheaply made Feitian Key though rebranded for Google Cloud, or if it is a new product in itself. The article implies otherwise: """ “It’s built with a secure element including firmware we built ourselves,” Google’s Rob Sadowski said. “It provides a ton of security with very little interaction and effort on the part of the user.” """

Feitian announced a few months back that all of their u2f products were using their normal javacard chips.. (Some of the low end older ones were either different chips or could only ship permantly "personalized".)

Bulk orders of any recent feitian u2f should be able to ship with firmware you built yourself (probably with their SDK and help.) Effectively, that might mean very little since they probably can't support much more in combination with a u2f applet, but it would allow a vague statement like in the article and explain an avoidance of clarifying whether they support other pki or otp which is what distinguishes the high end tokens people like to talk about.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#85

Post by bogomipz »

icebraining wrote: post #61
bogomipz wrote: post #44

Earlier quoted context omitted.

How does CAP provide protection when logging into your bank account online?

You get a device (like those in the pictures), which you then connect to your computer, and insert your debit card. When you do an online operation (e.g. bank transfer), the bank site requires the transaction to be digitally signed by your card (and which requires your PIN).

Ah OK I didn't look closely enough as I thought the picture were of POS terminal devices. I was confusing CAP with "chip and pin" - the tech used inside debit cards.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#87

Post by steve19 »

mimming wrote: post #53
w9r09eridlk wrote: post #36

I feel stupid for asking this, but what if you lose your key?

It’s not as big of a deal as you might expect because: - The spec requires providers to allow independent addition / removal of multiple keys per account, so it’s easy to manage backup U2F keys. - Providers can use any backup authentication method they want. This includes SMS codes, TOTP / HOTP apps, email resets, or maybe VCing in to tech support. And even if the backup method is less awesome (e.g. sms codes) it sti…

Is it a good way to store SSH keys? Looking at the company website is seems a little hacky.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#88

Post by scott00 »

puzzle wrote: post #8
agl wrote: post #7

Earlier quoted context omitted.

> However, I've heard that Google is kind of going on a tangent with its own U2F implementations, emphasizing an old-school implementation instead of the Web Authentication Standard that's pushed by the W3C. Chrome has supported "U2F" (the first FIDO spec) for a while and all support for Security Keys in the last few years has been via this protocol. But we're implementing the W3C Web Authentication (webauthn) spec a…

Can you use local storage and upload local applets to these new keys? The main use case is authenticating under Secure Shell on a Chromebook without having to configure the key on e.g. Linux first: https://groups.google.com/a/chromium.org/forum/#!topic/chrom... https://chromium.googlesource.com/apps/libapps/+/HEAD/nassh/...

Don't know anything about the Google Titan keys, but they are most likely Feitian hardware with custom firmware, and you can buy unlocked versions of Feitian security keys by contacting them. On unlocked keys you can install your own javacard applets.

Re: Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device

#90

Post by pvg »

jrochkind1 wrote: post #89

Uh, so was that last article about how these keys prevented phishing attempts at google just marketting for this product?

What exactly would warrant such 'marketing'? You think Google is going to make mad money selling little USB doodads to uber-nerds?
Post reply on HN