14 ms·
Security Key for safer logins with a touch
- pacaro 10y agoThis is great forward progress, I much prefer U2F where available. I hadn't even realized that FB supported 2fa, so I just tried to set it up on my iPhone, and either automatically or manually cannot get a test code to work. This tends to reduce my confidence in any other aspect of their implementation
- _joel 10y agoThe 2FA code generation has always worked perfectly for me for the past year (or two?) that I've had it enabled
- pacaro 10y agoI have to admit to being quite startled. But I just get "Security code was invalid. Please try again". I've tried again several times. I'll see if setting it up on the website works.
- tetrep 10y agocounter-anecdote: I've had zero issues with FB 2FA and I'm pretty sure many, if not all (I would hope it's an internal policy, but idk...) FB employees have it enabled, so it'd be pretty difficult for them to not notice serious issues with the use of their implementation (as your post suggests exist).
- mtgx 10y agoDoes it rely on SMS as backup, though?
- tyingq 10y agoIt looks like it gives you a choice: "Security keys for Facebook logins currently only work with certain web browsers and mobile devices, so we'll ask you to also register an additional login approval method, such as your mobile phone or Code Generator"
- mtgx 10y agoThat looks like a requirement, not a choice. So as usual, the U2F standard being adopted by companies these days is only as strong as SMS 2FA, because of this requirement. Can someone tell me what's the point then? Is it that they hope that in the end U2F will get popular enough that they'll remove that requirement? I would hope that's it. Otherwise, I don't see the point. I wish they at least allowed you to opt-out of the SMS back-up before you even had to give them your number. Of course, we're talking about Facebook here, so they won't waste any opportunity to make it seem like you have no choice but to give them your phone number.
- evgen 10y agoYou can use a TOTP code generator (e.g. Authy) as your backup. No need to rely upon SMS.
- tptacek 10y agoYou can, but is there a way to do it such that Facebook won't under any circumstances send an SMS message?
- evgen 10y agoGood question. I am not sSure you can do it without using SMS to bootstrap the process, but if you have TOTP set up and then turn on U2F (with TOTP as the backup) then I think you can disable SMS messages.
- AdmiralAsshat 10y agoI'm happy with Authy and TOTP, for the moment. Getting a YubiKey has been on my to-do list for awhile, but I'm not sure that everything I currently have 2FA for will accept it. In which case, I don't like the idea of half-migrating to Yubikey while still having to keep Authenticator around.
- tptacek 10y agoPretty much everyone I've talked to that uses a YK has the same configuration I do, by priority: 1. Security key 2. TOTP via phone authenticator app 3. Offsite saved backup keys (4.) Disable SMS This implies two things: first, that for pretty much every site you rely on, you're going to be both TOTP and U2F anyways, and second, that sites that don't support U2F yet will just start at step 2. U2F is more convenient than TOTP and, because you're virtually never going to actually use it on a site you U2F into, U2F is still mitigating the phishing risk. You're carrying your phone with you anyways. It's pretty much win-win.
- nickik 10y agoYou can use your Yubikey + Yubico Authenticater to replace Authy. It does not add that much security, but you add device switch ability without Cloud Sync.
- edraferi 10y agoI had a lot of problems with Yubico Authenticator. Wound up switching back to a generic app.
- nickik 10y agoWhat problems? I used to not have any, but since a short time it has issues with unlocking when I get NFC connection. I have to restart it sometimes.
- edraferi 10y agoYeah the NFC on my Yubico has burnt out. Or something. Regardless, Yubico Authenticator just flat-out didn't work for me. I got it running, loaded some codes, and then the codes didn't work again. It was like it lost synchronization with the server clock or something. I had the same issues on Android and MacOS. Maybe I could have sorted it, but I lost interest before finding a definitive fix.
- DINKDINK 10y agoHappy to see Facebook finally supporting U2F but haven't assessed how robust their implementation is. Another U2F hardware key is the Trezor bitcoin hardware wallet ( https://blog.trezor.io/secure-two-factor-authentication-with-trezor-u2f-e940fd5a60af#.j8z0lkgvf https://blog.trezor.io/secure-two-factor-authentication-with... ) which has the added benefit that you can backup all your U2F private keys. I'm not aware of how you could do this with a Yubico U2F key -- if someone knows, please enlighten me.
- hdhzy 10y agoW.r.t yubico u2f you don't backup it you just register to or more tokens that work as backup keys.
- unknownsavage 10y agoThis is really awful, for it to work well you would need to buy multiple keys and each time use them all to register (which precludes the option of storing the backup key somewhere safe). Straight from the yubico website: "It is recommended that users register at least two U2F devices with every service provider should a U2F device be misplaced" That's just a plain usability nightmare, and not to mention expensive. The trezor one works a lot more sanely for u2f, you get a recovery key when you first set it up (it uses the screen to output it, so even if your computer has malware it can't be compromised) and can leave it in a safe at your friends place.
- tptacek 10y agoPart of the point of hardware tokens is that you can't back up and restore their keys. If backup and restore is important to your userbase, you should stick with soft tokens.
- unknownsavage 10y agoThe trezor only lets you backup the key during the initialization stage. After that the key can never be recovered. Also you can set a password so it's encrypted as well, so even if someone finds your paper backup it's not particularly useful.
- grandsham 10y agoI am slightly disappointed that this doesn't work in Firefox, despite the fact that I have an add-on[1] installed to add U2F support. Github for instance is able to detect U2F support and let me use it. That said, I understand the lack of support since I am an extremely small niche, and this did prompt me to finally add 2FA to facebook (U2F and code generation from my Yubikey Neo) [1] https://addons.mozilla.org/en-US/firefox/addon/u2f-support-add-on/?src=api https://addons.mozilla.org/en-US/firefox/addon/u2f-support-a...
- artursapek 10y agoI don't understand how it has taken them so long to add it natively... they just shipped FLAC audio support but still don't care about U2F?
- deleted 10y ago[deleted]
- callahad 10y agoBarring unforeseen complications, U2F support should land in stable Firefox this year. The tree of bugs to follow is rooted at https://bugzilla.mozilla.org/show_bug.cgi?id=1065729 https://bugzilla.mozilla.org/show_bug.cgi?id=1065729
- cesarb 10y agoFLAC audio support is simpler, it's just adding a self-contained FLAC decoding library, and wiring it to the already-existing audio code. For U2F, they have to write code to interact with the operating system USB API (for each operating system), plus the main U2F code, plus a Javascript API, all while taking care to not cause any new privacy leaks or worse. If you want to follow, the main bugzilla item seems to be this one: https://bugzilla.mozilla.org/showdependencytree.cgi?id=1065729&hide_resolved=0 https://bugzilla.mozilla.org/showdependencytree.cgi?id=10657...
- wahern 10y agoThe USB part is the simplest part. U2F uses USB HID for messaging. That's probably less complicated than using the D-Bus interface. And anyhow there's probably already an open source library for U2F USB HID clients. Mozilla will probably use whatever Chrome is using. The real complexity is in exposing the interfaces through Javascript and orchestrating all the GUI components. In fact, U2F doesn't even require a hardware token. It was designed so browsers could implement everything in software to hasten adoption.
- cesarb 10y agoLast time I looked at Facebook 2FA, it didn't allow you to enable it unless you had a browser with old enough cookies from Facebook, which is not possible if you configure your browser to clear all cookies on exit (and close the whole browser at least once a day). Is that still the case?
- gst 10y agoI've used Facebook 2FA for quite a long time now and all of my browsers are configured to clear cookies on exit (and to disallow 3rd party cookies). Didn't have any issues with activating 2FA.
- forgottenpass 10y agoI've been a big fan of yubikeys for years, but I'd never use mine for something like Facebook. I work in computer security, so I know this sounds crazy. But my brain has been rewired to work in failure modes by the not-security domain I happen to do security stuff in. The obvious argument for TFA is to reduce the chances that my Facebook account is subject to the bad consequences of that come from a compromised Facebook account. I'd much rather they reduce or eliminate the severity of the failure mode in the first place. TFA is only a mitigation that reduces the likelihood of account compromise. It shouldn't be possible for someone who swipes my yubikey to do any more than cause a minor social annoyance. Unfortunately the presence of the mitigation (TFA) will - if adopted to significant numbers - combine with Facebook's other incentives to produce more severe failure effects for account compromise. Remember back when facebook was still in it's just-college phase? And dicking around on your friend's facebook account if they left their computer unlocked was normal? And when you saw someone acting unusual, you sorta assumed someone was messing with their account? Yeah, I don't want a compromise of my facebook account to ever be more severe than it was back then.
- CaveTech 10y agoI don't think I follow your reasoning of how increased security increases the severity of a compromise. Can you elaborate on that?
- nothrabannosir 10y agoIt lowers the barrier to adopting "login with facebook" on other platforms. "You get 2fa for free!"
- OJFord 10y agoIf my network knows that I use PGP to login, they may well accept an (illegitimate) announcement that I'm changing my keys to {attacker-generated.asc}. Of course, really such a login key should only be able to authenticate, and my network should only accept a proper revocation certificate that would need to have been generated by a different key with the 'Certify' action enabled. How likely or damaging that is obviously depends a lot on who you are, and probably wouldn't be for many people at all. But I assume that's the sort of thing your parent commenter is alluding to.
- transfire 10y agoLooks like a logistical nightmare to me. You think forgetting a password is a pain in the ass, just wait until you loose your security key. It won't be one service you have to reset through an alternate verification route, but every single one you ever used! I also foresee potential issues with data corruption on keys, and multiple-keys getting out of sync (e.g. work vs home). And I have no doubt that clever hackers will find ways to get the codes off those keys (they will be plugged into a computer all the time and at the very least even the most cautious are susceptible to phishing). Also, it just doesn't seem as secure as an SMS code b/c the SMS code doesn't exist but for a short window of time and is transmitted by a completely separate communications channel -- but I suppose that's also why the big companies want to get rid of it, SMS costs more money. The more I think about it, it seems to me that the Internet itself really needs to be a two-channel system. If communication has two separate physical channels then it becomes much easier to ensure security.
- Analemma_ 10y agoIs it really that big a deal? I just have it on my key ring, which I'm not really in danger of losing. And if it is a concern, get something like Tile or TrackR. Seems less likely than forgetting the 15-character fully random passwords we're supposed to memorize.
- NickBusey 10y agoI recently lost my security key. Now I have to pull out my phone and type in 6 digits from Google Authenticator instead. It's been such a nightmare, let me tell you..
- draw_down 10y agoActually, the saddest part is what a pain it is when it's all working correctly.
- eeZah7Ux 10y agoThat's why you buy two keys. No, they don't have anything to "sync".
- 10y ago
- greggman 10y agoAnd yet I'm told by other security minded people I should epoxy over my USB ports. So which is it?
- modeless 10y agoUse a Yubikey Nano. You could easily epoxy it in place. ... but physical access is game over no matter how much epoxy you use.
- todd8 10y agoActually, use glitter nail polish: Thwarting Evil Maid Attacks (YouTube) https://youtu.be/KV4XnvE2p34 https://youtu.be/KV4XnvE2p34
- arnarbi 10y agoDon't plug anything in your computer that you don't trust. And "trust" doesn't just mean "trust them to be non-malicious", but also "trust them to competently secure themselves against malware"
- amluto 10y agoShameless plug: if you want this to work on Linux without diddling the device node permissions, install this: https://github.com/amluto/u2f-hidraw-policy https://github.com/amluto/u2f-hidraw-policy I need to get around to integrating this with upstream udev so it can stop being needed as a standalone project.
- bluecmd 10y agoOr the Yubico official https://developers.yubico.com/libu2f-host/ https://developers.yubico.com/libu2f-host/ - that will do the same
- amluto 10y agoMy version is waaaay better. No, really, it is. Theirs is a little list of known U2F devices from known U2F device vendors. Mine actually detects the the device is a U2F device regardless of its make and model. As far as I know, Yubico wrote that spec, so I'm a bit surprised they didn't implement it in the udev rule.
- nickik 10y agoTry to upstream this. That would be cool, because I use the information by Yubikey atm.
- draw_down 10y agoWe started using these for internal services and Google accounts where I work. It's unfortunately a big pain in the butt- you can't use Safari, you can't use the Mac/iPhone calendar app to see your meetings. It's web apps in Chrome or nothing, more or less. The one type of key supposedly uses Bluetooth, but that functionality isn't built yet or something, so you get to carry around a little 4-inch microUSB cord with you everywhere you go, and connect that every single time you hit a 2FA prompt. At least the Yubikeys have a USB connector built into them.
- tptacek 10y agoHuh? I use the Google applications --- and, particularly, their calendar --- all the time without using Chrome, and U2F is my first-priority 2FA mechanism. You can mint static random application keys for your native applications, and use TOTP as a backup for when you want to use a different browser (really, though, you should use Chrome as much as you can; it's significantly more secure).
- draw_down 10y agoFor some reason application passwords don't seem to work according to everyone who tried. I don't really know what TOTP is or how all of this is configured, that's the domain of our security team. I don't really know what you mean about Google apps, I just want to use the calendar app on my Mac and iPhone to see my meetings but I can't. I asked them about it and they confirmed to me that I should use the Google Calendar web app in Chrome. Using a web app on my Mac isn't the end of the world, but I can't see my meetings on my phone in any type of way, and I'm already missing them sometimes because the little notification on the phone is what reminds me that I have a meeting to go to.
- nickik 10y agoIn the Google security setting you can create new App-Passwords, use those in your Apple Mail or whatever. It should work fine.
- 10y ago
- erelde 10y agoTangent comment: https://i.imgur.com/Xm1qRI4.png https://i.imgur.com/Xm1qRI4.png Does anybody know why the comments under this post are like that, at least for me? Is there a particular reason why people from Myanmar (some with latin name?) would comment this much more than any other?
- biot 10y agoProbably this: https://www.youtube.com/watch?v=oVfHeWTKjag https://www.youtube.com/watch?v=oVfHeWTKjag
- erelde 10y agoI thought they had dealt with that since. Guess they have no real incentive to do so.
- re 10y agoThat video doesn't seem particularly relevant to the question; it talks about fake likes, but makes the point that those fake users don't engage with the content at all.
- erelde 10y agoIt's from 2014. Fake likes could also do fake comments now, it's also a metric used for engagement.
- nickik 10y agoAs a huge fan of U2F I really love this. I don't use Facebook, but we are starting to cover more and more of the internet. Facebook, Google, Dropbox are huge. I would like to see UAF also get some more love.
- batuhanicoz 10y agoI wish Facebook brings something similar to the Instagram. I recently got hacked and lost my account and my first name username for good[0]. They don't even allow 2 factor auth on accounts with low followers there. [0] https://medium.com/@batuhan/i-got-hacked-and-i-dont-think-instagram-cares-fe4160364ef1 https://medium.com/@batuhan/i-got-hacked-and-i-dont-think-in...
- jacurtis 10y agoSame exact thing happened to me on Instagram. Which is crazy to me, its really the first time I was hacked, as I usually am very careful with passwords and security. I used 2FA and password managers and so forth.
- hetfeld 10y ago1 2 3 4 5 6 7 8 9 comments...