4 ms·

Isn't mobile phone 2FA more advantageous?

fixxer 10y ago
Yes, in the sense of convenience... but you are storing the generator on a networked device with potential for malicious exploitation. OK for my gmail, but maybe not the keys to a 6 figure brokerage account... Of course, in the case, I'm getting issued a key from the brokerage.
- happy-go-lucky 10y ago
  OK, the token security outweighs the usability.
  - ascorbic 10y ago
    It can be easier too. I have a U2F key that lives in my USB hub, which means it's totally seamless and much easier than pulling out my phone and fiddling with authenticator apps. I also have a Yubikey on my keychain, which gives me U2F when I'm not at my desk (you can register more than one key) as well as TOTP for things that don't support U2F.
jnpatel 10y ago
If you leave your U2F key in your laptop or PC, I find it to be much more convenient than mobile 2FA. Just one tap and you're in... versus pulling out your phone, unlocking, and typing in the code. Btw, all U2F services allow you to fall back to phone 2FA if you're on an unsupported device.
- sliken 10y ago
  Better smartphone auth setups doesn't require typing in the code. Like Duo Push.
lorenzhs 10y ago
No, as U2F prevents nearly all phishing attacks. See this post on FastMail's blog (the last section): https://blog.fastmail.com/2016/07/23/how-u2f-security-keys-work/ https://blog.fastmail.com/2016/07/23/how-u2f-security-keys-w...
- happy-go-lucky 10y ago
  Of course, I don't deny there're security benefits, but IMHO it's worth mentioning that there're some trade-offs. >Well, of course there are always tradeoffs. The biggest one right now is that Google Chrome is the only major browser that supports U2F. >Because it requires browser support to act as an intermediary between the website and the security key, you can only use it if the browser supports it. >Mobile is also an issue, as they don't have USB ports! >Some YubiKeys support U2F via wireless NFC, but support for this in mobile phones is very limited at the moment.
  - lorenzhs 10y ago
    Sure, U2F has its drawbacks, too. NFC U2F and NFC TOTP are quite nice if your phone supports it. The YubiKey Neo can store TOTP secrets and show codes via the Yubico Authenticator app (also works on Desktop with yubioath), while Google Authenticator handles U2F via NFC. This is something that could really use an opening-up of NFC in iOS, only having it on Android is too limited to make it a success.
sliken 10y ago
Generally I trust my U2F that has a simple button on it to not reveal it's private key much more so than a hugely complicated smartphone. Especially the button, which makes it very hard for a remote attacker to get anything from the U2F token. How many apps are on your phone? How secure is the software stack? Kernel? Hardware? Drivers? If android, how good is your manufacturer + cell provider at distributing the latest updates? Can you prove that an app can't see the screen and send a touch event? Also generally it's faster to hit the single button on a U2F widget than it is to do anything with a smartphone.

Yes, in the sense of convenience... but you are storing the generator on a networked device with potential for malicious exploitation. OK for my gmail, but maybe not the keys to a 6 figure brokerage account... Of course, in the case, I'm getting issued a key from the brokerage.

happy-go-lucky 10y ago
OK, the token security outweighs the usability.
- ascorbic 10y ago
  It can be easier too. I have a U2F key that lives in my USB hub, which means it's totally seamless and much easier than pulling out my phone and fiddling with authenticator apps. I also have a Yubikey on my keychain, which gives me U2F when I'm not at my desk (you can register more than one key) as well as TOTP for things that don't support U2F.

jnpatel 10y ago

If you leave your U2F key in your laptop or PC, I find it to be much more convenient than mobile 2FA. Just one tap and you're in... versus pulling out your phone, unlocking, and typing in the code. Btw, all U2F services allow you to fall back to phone 2FA if you're on an unsupported device.

sliken 10y ago
Better smartphone auth setups doesn't require typing in the code. Like Duo Push.

lorenzhs 10y ago

No, as U2F prevents nearly all phishing attacks. See this post on FastMail's blog (the last section): https://blog.fastmail.com/2016/07/23/how-u2f-security-keys-work/ https://blog.fastmail.com/2016/07/23/how-u2f-security-keys-w...

happy-go-lucky 10y ago
Of course, I don't deny there're security benefits, but IMHO it's worth mentioning that there're some trade-offs. >Well, of course there are always tradeoffs. The biggest one right now is that Google Chrome is the only major browser that supports U2F. >Because it requires browser support to act as an intermediary between the website and the security key, you can only use it if the browser supports it. >Mobile is also an issue, as they don't have USB ports! >Some YubiKeys support U2F via wireless NFC, but support for this in mobile phones is very limited at the moment.
- lorenzhs 10y ago
  Sure, U2F has its drawbacks, too. NFC U2F and NFC TOTP are quite nice if your phone supports it. The YubiKey Neo can store TOTP secrets and show codes via the Yubico Authenticator app (also works on Desktop with yubioath), while Google Authenticator handles U2F via NFC. This is something that could really use an opening-up of NFC in iOS, only having it on Android is too limited to make it a success.

sliken 10y ago

Generally I trust my U2F that has a simple button on it to not reveal it's private key much more so than a hugely complicated smartphone. Especially the button, which makes it very hard for a remote attacker to get anything from the U2F token. How many apps are on your phone? How secure is the software stack? Kernel? Hardware? Drivers? If android, how good is your manufacturer + cell provider at distributing the latest updates? Can you prove that an app can't see the screen and send a touch event? Also generally it's faster to hit the single button on a U2F widget than it is to do anything with a smartphone.