17 ms·

This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and

This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work. Is a separate USB key meaningfully more secure?

jasoncartwright 11y ago
I've used a YubiKey for 2FA for a year or so now. It just sits in my USB port and it feels too convenient - steal my laptop and you get my key. At least my phone has a PIN.
- fak3r 11y ago
  Mine is on my keychain, plus you need my username, password and yubikey to authenticate, so if someone steals my laptop (oh noes!) they still have hurdles to jump.
- sandstrom 11y ago
  I think the (relatively) small overlap between knowing your password and stealing your computer is important here. Passwords are weak vs. many types of hacks, U2F is strong. And vice-versa (easy to steal the Yubi-key + computer, but they still need the password).
- deleted 11y ago
  [deleted]
- tetraodonpuffer 11y ago
  I use it for my email, and have set it up with yubikey + password, given that you need both it's not like you can brute-force the login anyways
- aiiane 11y ago
  U2F is protection against someone phishing/stealing your credentials online. Your password is your protection against someone stealing your laptop. The likelihood that a person who steals your laptop also managed to phish/steal your credentials is minute.
efm 11y ago
Github will support a token generating app on your phone: https://help.github.com/articles/providing-your-2fa-authentication-code/#generating-a-code-through-a-totp-application https://help.github.com/articles/providing-your-2fa-authenti...
- scrollaway 11y ago
  It already does. Been using 2fa for a year or so.
dudus 11y ago
This is actually more convenient sometimes. I already have one of these FOBs permanently attached to my computer. It's a tiny pieces that fit into usb and only protrudes a couple of milimiters. Since I have this always connected all I have to do is touch it and I'm in. Takes me less than once second while taking my phone, opening the app and typing the code by hand takes 10-20 seconds. The downside is that it takes a USB port, which is one of the reasons I hated this years MacBook so much. UPDATE: I found the exact model I have on Amazon http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7MM/ref=sr_1_7?ie=UTF8&qid=1443721900&sr=8-7&keywords=U2F http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7...
- treve 11y ago
  Dumb question... what does the yubikey then do that a normal computer can't do? If you keep it plugged in, what security benefit does it have over storing (strong) passwords?
  - toomuchtodo 11y ago
    Think of it the same as the EMV chip on a credit card.
dudus 11y ago
This is actually more convenient sometimes. I already have one of these FOBs permanently attached to my computer. It's a tiny pieces that fit into usb and only protrudes a couple of milimiters. Since I have this always connected all I have to do is touch it and I'm in. Takes me less than once second while taking my phone, opening the app and typing the code by hand takes 10-20 seconds. The downside is that it takes a USB port, which is one of the reasons I hated this years MacBook so much. UPDATE: I found the exact model I have on Amazon http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7MM/ref=sr_1_7?ie=UTF8&qid=1443721900&sr=8-7&keywords=U2F http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7...
WorldMaker 11y ago
From another angle they are more convenient: Most of the USB keys are in a form factor that fits well on an existing key ring. If you are like most people, you presumably also already have a pile of keys connected to a key ring on you at all times. You don't have to unlock your phone device and launch the appropriate app, you just need to plug into an open USB slot on the machine you are using.
calebegg 11y ago
OTP based 2FA is susceptible to phishing and MITM attacks. U2F is phish-proof and makes MITM more difficult. For computers you frequently use, you can get multiple keys and leave them in the port (Yubico makes a small one that stays in the port and only sticks out enough for you to be able to touch it, but it's a bit pricey).
bhuga 11y ago
Yubikey has a "always available" form factor if you're already bringing your laptop to work in the neo-n: http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7MM/ http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7.... It just lives in your USB port. The user experience is also better with U2F than previous 2FA systems. When GitHub prompts you for U2F, you press the yubikey and are instantly logged in. No typing random numbers with n seconds, no fake keyboard. YMMV of course, but if you've tried U2F, it feels incredibly slick.
- dankohn1 11y ago
  I think the issue is that I have a laptop at home and iMac at work so I don't bring my computer on my commute. Also, I like the extra security of the fingerprint scanner on my iPhone.
  - bhuga 11y ago
    In that case, I might prefer an authenticator to a keyfob that requires insertion too. The yubikey is slightly more secure since it's actually signing a message from the server rather than sending a password that can be (briefly) intercepted and replayed. But it's probably not 'better enough' to encourage someone not to use 2FA at all if U2F isn't convenient. If user security has taught us anything in the last 20 years, it's that security features have to be convenient or may as well not exist. I think we'll be seeing a lot more 2FA options in the next few years. In this segment, user choice is a huge improvement in and of itself. I've also been testing Duo push for some internal stuff, which is a phone-based experience that's as smooth as silk. To each their own!
  - tokenizerrr 11y ago
    Your iPhone is completely covered with your fingerprints. Also, if your phone gets hacked/compromised the attacker could steal the secret used to generate your TOTPs. This is not possible with the Yubikey, it is absolutely impossible to extract the private key. I have a Yubikey on my keychain (it can easily withstand this), and it takes very little effort to plug it into the USB port when I require it. Less than it would be to take my phone out. As a side-note, some time ago the Yubikey had a vulnerability with its GPG module so they shipped out new ones for free. I now have the old key (with no GPG keys loaded on it) permanently plugged into my USB hub at my desktop. It is amazingly convenient.
piemonkey 11y ago
One thing to consider is the possibility of your phone itself being compromised (stagefright et al.). Note how Duo issued a security advisory to limit access for Android devices [1]. A fully isolated component like a Yubikey has a smaller attack surface area for these kinds of things (easier to audit smaller code, no sustained Internet or cellular connectivity). [1]https://www.duosecurity.com/blog/understanding-your-exposure-to-stagefright-vulnerabilities https://www.duosecurity.com/blog/understanding-your-exposure...
mongol 11y ago
For me that key is the emergency key. I have it on my keychain. I use Google Authenticator normally. I don't yet have U2F key always inserted the computer in my home but I think it would be convenient. I have a regular Yubikey inserted in the USB slot in my monitor to unlock Password Safe with a 25 char password. I don't think I would like it permanently inserted on a device I carry outside of my home.
zobzu 11y ago
Some phones actually provide U2F. I think the SGS6 does. The secret in stored in the harware backed credentials storage.
mikecb 11y ago
A pin can be phished, a U2F handshake cannot.

jasoncartwright 11y ago

I've used a YubiKey for 2FA for a year or so now. It just sits in my USB port and it feels too convenient - steal my laptop and you get my key. At least my phone has a PIN.

fak3r 11y ago
Mine is on my keychain, plus you need my username, password and yubikey to authenticate, so if someone steals my laptop (oh noes!) they still have hurdles to jump.
sandstrom 11y ago
I think the (relatively) small overlap between knowing your password and stealing your computer is important here. Passwords are weak vs. many types of hacks, U2F is strong. And vice-versa (easy to steal the Yubi-key + computer, but they still need the password).
deleted 11y ago
[deleted]
tetraodonpuffer 11y ago
I use it for my email, and have set it up with yubikey + password, given that you need both it's not like you can brute-force the login anyways
aiiane 11y ago
U2F is protection against someone phishing/stealing your credentials online. Your password is your protection against someone stealing your laptop. The likelihood that a person who steals your laptop also managed to phish/steal your credentials is minute.

efm 11y ago

Github will support a token generating app on your phone: https://help.github.com/articles/providing-your-2fa-authentication-code/#generating-a-code-through-a-totp-application https://help.github.com/articles/providing-your-2fa-authenti...

scrollaway 11y ago
It already does. Been using 2fa for a year or so.

dudus 11y ago

This is actually more convenient sometimes. I already have one of these FOBs permanently attached to my computer. It's a tiny pieces that fit into usb and only protrudes a couple of milimiters. Since I have this always connected all I have to do is touch it and I'm in. Takes me less than once second while taking my phone, opening the app and typing the code by hand takes 10-20 seconds. The downside is that it takes a USB port, which is one of the reasons I hated this years MacBook so much. UPDATE: I found the exact model I have on Amazon http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7MM/ref=sr_1_7?ie=UTF8&qid=1443721900&sr=8-7&keywords=U2F http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7...

treve 11y ago
Dumb question... what does the yubikey then do that a normal computer can't do? If you keep it plugged in, what security benefit does it have over storing (strong) passwords?
- toomuchtodo 11y ago
  Think of it the same as the EMV chip on a credit card.

dudus 11y ago

WorldMaker 11y ago

From another angle they are more convenient: Most of the USB keys are in a form factor that fits well on an existing key ring. If you are like most people, you presumably also already have a pile of keys connected to a key ring on you at all times. You don't have to unlock your phone device and launch the appropriate app, you just need to plug into an open USB slot on the machine you are using.

calebegg 11y ago

OTP based 2FA is susceptible to phishing and MITM attacks. U2F is phish-proof and makes MITM more difficult. For computers you frequently use, you can get multiple keys and leave them in the port (Yubico makes a small one that stays in the port and only sticks out enough for you to be able to touch it, but it's a bit pricey).

bhuga 11y ago

Yubikey has a "always available" form factor if you're already bringing your laptop to work in the neo-n: http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7MM/ http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7.... It just lives in your USB port. The user experience is also better with U2F than previous 2FA systems. When GitHub prompts you for U2F, you press the yubikey and are instantly logged in. No typing random numbers with n seconds, no fake keyboard. YMMV of course, but if you've tried U2F, it feels incredibly slick.

dankohn1 11y ago
I think the issue is that I have a laptop at home and iMac at work so I don't bring my computer on my commute. Also, I like the extra security of the fingerprint scanner on my iPhone.
- bhuga 11y ago
  In that case, I might prefer an authenticator to a keyfob that requires insertion too. The yubikey is slightly more secure since it's actually signing a message from the server rather than sending a password that can be (briefly) intercepted and replayed. But it's probably not 'better enough' to encourage someone not to use 2FA at all if U2F isn't convenient. If user security has taught us anything in the last 20 years, it's that security features have to be convenient or may as well not exist. I think we'll be seeing a lot more 2FA options in the next few years. In this segment, user choice is a huge improvement in and of itself. I've also been testing Duo push for some internal stuff, which is a phone-based experience that's as smooth as silk. To each their own!
- tokenizerrr 11y ago
  Your iPhone is completely covered with your fingerprints. Also, if your phone gets hacked/compromised the attacker could steal the secret used to generate your TOTPs. This is not possible with the Yubikey, it is absolutely impossible to extract the private key. I have a Yubikey on my keychain (it can easily withstand this), and it takes very little effort to plug it into the USB port when I require it. Less than it would be to take my phone out. As a side-note, some time ago the Yubikey had a vulnerability with its GPG module so they shipped out new ones for free. I now have the old key (with no GPG keys loaded on it) permanently plugged into my USB hub at my desktop. It is amazingly convenient.

piemonkey 11y ago

One thing to consider is the possibility of your phone itself being compromised (stagefright et al.). Note how Duo issued a security advisory to limit access for Android devices [1]. A fully isolated component like a Yubikey has a smaller attack surface area for these kinds of things (easier to audit smaller code, no sustained Internet or cellular connectivity). [1]https://www.duosecurity.com/blog/understanding-your-exposure-to-stagefright-vulnerabilities https://www.duosecurity.com/blog/understanding-your-exposure...

mongol 11y ago

For me that key is the emergency key. I have it on my keychain. I use Google Authenticator normally. I don't yet have U2F key always inserted the computer in my home but I think it would be convenient. I have a regular Yubikey inserted in the USB slot in my monitor to unlock Password Safe with a 25 char password. I don't think I would like it permanently inserted on a device I carry outside of my home.

zobzu 11y ago

Some phones actually provide U2F. I think the SGS6 does. The secret in stored in the harware backed credentials storage.

mikecb 11y ago

A pin can be phished, a U2F handshake cannot.