3 ms·

Unlike TOTP, U2F devices like the Yubikey protect against phishing attacks. The more expensive (not-just-U2F) Yubikeys also work as a GPG smartcard, which you c

by pfg 10y ago

Unlike TOTP, U2F devices like the Yubikey protect against phishing attacks. The more expensive (not-just-U2F) Yubikeys also work as a GPG smartcard, which you can use for things like SSH authentication.

chrissnell 10y ago
Can you explain how a smartphone-generated (or received via SMS) 2FA token is susceptible to pishing or other remote theft? I like the idea of the Yubikey but I just don't see how it's any different or better from receiving, say, a Google 2FA SMS on the smartphone that's always within reach. I genuinely want to understand this so I'm hoping you or someone else can explain.
- zie 10y ago
  Smartphones are a very high target for everyone, from the FBI on down, and their attack surface is very large. So there is always (and will likely always be) security vulnerabilities in any smartphone, regardless of the brand/vendor/etc. These can be gotten at remotely because these devices have WiFI, bluetooth, etc in them, making them much more accessible remotely. Yubikey's and the like are a high target item, but probably only for government-level adversaries, in general you have to be pretty well funded to attack these things, plus their attack surface is very very small, and most all of the attack surface is physical (i.e. you have to physically get the yubikey device to attempt any hacks on it). These devices generally only have a USB port, so to get at them remotely you have to first get remote access to the device(computer) they are plugged into, making it even harder of a target. That's the general overview. Specifically, SMS received tokens are not secure (because of the SMS part not being secure). NIST recently declared SMS based 2FA to be a bad idea, for instance.
- pfg 10y ago
  A phishing page can simply imitate the 2FA step in the login process and ask for the OTP to be entered, and then use it for its own login attempt. With U2F, the site basically authenticates itself as well, so a third-party phishing page wouldn't get anywhere.
- jwatte 10y ago
  The 2FA apps on the phone (like authify and google authenticator) use a shared secret between the server and phone, plus the time, to generate the code. (This is the alphanumeric or qr code you set up with) If someone can remotely root your phone, they can remotely retrieve your shared secret, and thus generate your authentication tokens.
- nickik 10y ago
  If a site looks like google and you enter your TOTP it will just take it and login. The only thing TOTP protects against is somebody collecting logins and using them later. Today good phishers do attacks JIT, so TOTP is pretty useless for that attack vector (and that is the most importent one). Your Yubikey can pretty much be connected to your computer all the time. So usability is actually better. Plus there is of course the problem of smartphone security.
- j_s 10y ago
  Many attacks on ISP / IaaS companies have involved social engineering to "SIM swap"; allowing intercepting 2FA SMS messages. https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/ https://www.wired.com/2016/06/hey-stop-using-texts-two-facto... Other comments expalain the vulnerbility of phones, but Linode's Time-based One-time Password implementation (tied to a phone app) may have been hacked server-side. http://www.securityweek.com/how-attackers-likely-bypassed-linodes-two-factor-authentication-hack-pagerduty http://www.securityweek.com/how-attackers-likely-bypassed-li...

by pfg 10y ago

chrissnell 10y ago

Can you explain how a smartphone-generated (or received via SMS) 2FA token is susceptible to pishing or other remote theft? I like the idea of the Yubikey but I just don't see how it's any different or better from receiving, say, a Google 2FA SMS on the smartphone that's always within reach. I genuinely want to understand this so I'm hoping you or someone else can explain.

zie 10y ago
Smartphones are a very high target for everyone, from the FBI on down, and their attack surface is very large. So there is always (and will likely always be) security vulnerabilities in any smartphone, regardless of the brand/vendor/etc. These can be gotten at remotely because these devices have WiFI, bluetooth, etc in them, making them much more accessible remotely. Yubikey's and the like are a high target item, but probably only for government-level adversaries, in general you have to be pretty well funded to attack these things, plus their attack surface is very very small, and most all of the attack surface is physical (i.e. you have to physically get the yubikey device to attempt any hacks on it). These devices generally only have a USB port, so to get at them remotely you have to first get remote access to the device(computer) they are plugged into, making it even harder of a target. That's the general overview. Specifically, SMS received tokens are not secure (because of the SMS part not being secure). NIST recently declared SMS based 2FA to be a bad idea, for instance.
pfg 10y ago
A phishing page can simply imitate the 2FA step in the login process and ask for the OTP to be entered, and then use it for its own login attempt. With U2F, the site basically authenticates itself as well, so a third-party phishing page wouldn't get anywhere.
jwatte 10y ago
The 2FA apps on the phone (like authify and google authenticator) use a shared secret between the server and phone, plus the time, to generate the code. (This is the alphanumeric or qr code you set up with) If someone can remotely root your phone, they can remotely retrieve your shared secret, and thus generate your authentication tokens.
nickik 10y ago
If a site looks like google and you enter your TOTP it will just take it and login. The only thing TOTP protects against is somebody collecting logins and using them later. Today good phishers do attacks JIT, so TOTP is pretty useless for that attack vector (and that is the most importent one). Your Yubikey can pretty much be connected to your computer all the time. So usability is actually better. Plus there is of course the problem of smartphone security.
j_s 10y ago
Many attacks on ISP / IaaS companies have involved social engineering to "SIM swap"; allowing intercepting 2FA SMS messages. https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/ https://www.wired.com/2016/06/hey-stop-using-texts-two-facto... Other comments expalain the vulnerbility of phones, but Linode's Time-based One-time Password implementation (tied to a phone app) may have been hacked server-side. http://www.securityweek.com/how-attackers-likely-bypassed-linodes-two-factor-authentication-hack-pagerduty http://www.securityweek.com/how-attackers-likely-bypassed-li...