6 ms·
Can someone explain how this is an improvement on phone-based, non-SMS 2FA? This solution seems ripe for exploitation by putting your passwords (if you store y
by madamelic 9y ago
Can someone explain how this is an improvement on phone-based, non-SMS 2FA?
This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.
- crummy 9y agoThe improvement is accessibility. It's less secure than physical 2FA but more so than just 1FA. As the article says, "for many, the security of software-based U2F is sufficient and helps to mitigate against many common attacks such as password dumps, brute force attacks, and phishing related exploits."
- nevir 9y agoIt's really not that much less secure than physical 2FA: I'm willing to bet that most people just leave their hardware key in their laptop at all times. (where "most people" ends up being corporate U2F users, who are probably given YubiKey Nanos and the like) At that point, your laptop is basically your 2nd factor - which this software is pretty similar to.
- petee 9y agoBut even if you leave it in, everything is still protected in hardware, and in addition, malware can't trigger a physical presence button push...so, it is in fact significantly less secure...
- djcapelis 9y ago> malware can't trigger a physical presence button push It kinda can, it just needs to trigger a dialog the user thinks looks legit. Or easier, just stay resident until the next time the user pushes the button. Don't get me wrong, U2F has benefits, but it's not invulnerable to malware designed for it. You want real system level protections to back it up and most users aren't running on operating systems that can really cash the check you're trying to write with that threat model.
- deleted 9y ago[deleted]
- bugmen0t 9y agoThis is mostly against phishing. A phisher can get users to insert a token from a USB device or a text into evil.com. But U2F uses public key crypto, so your token derived for evil.com is not the same as for github.com
- madamelic 9y agoAhhhh. That makes a lot more sense. Thank you.
- anfedorov 9y agoAlso, if your machine is compromised, your the cookies used to authenticate you post-login can be stolen just as well. RTFA.
- StavrosK 9y agoThis is a brilliant idea to use as a third factor. Instead of TOTP or the hardware U2F key, just create keys for all your browsers. That way, you're more protected against phishing, but still have a way to log in if you lose your keyfile.
- Emilie_ 9y agoBenjamin answered I'm in shock that some one can make $4929 in 1 month on the internet . ___________http://bit.do/dnRs5 http://bit.do/dnRs5
- Harmony_ 9y agoAre you boring your life for pocket money.if u don’t worry for your pocket money I share my home profit system to everyone.i enjoy my life because I using this easy online jobs and earning $25986 daily wovrk for only 3 hours a day online for doing thivs easiest online home jobz.for more details visit this link… ᴵᴵᴵᴵᴵᴵᴵᴵᴵᴵᴵᴵᴵᴵᴵᴵᴵᴵhttp://usawork.cn.to http://usawork.cn.to
- heavymark 9y agoPasswords are often already on the users phone. Such as if you use say Authy or Google Authenticator for your 2 factor, your phone if say an iPhone already stores all your passwords in your keychain which is accessible on your iPhone just like on your computer. Or if you use 1Password your passwords are accessible on your phone just like on your desktop. So still comes down to you having a strong master password for your keychain and or 1Password, etc that only you know. If you use Authy on your phone, they have long had a chrome extension that allows you to get your codes on your computer, already for years and that works with all your existing codes rather than this which is limited to just GitHub currently it sounds. But hopefully someone else can comment on the security improvements of Soft U2F or if its more just building a standard rather than people having to rely on Authy or such.
- pfg 9y ago> But hopefully someone else can comment on the security improvements of Soft U2F or if its more just building a standard rather than people having to rely on Authy or such. The main difference is that U2F is phishing-resistant because it binds keys to the origin. TOTP, on the other hand, can still be phished. (I believe Authy attempted to solve some of this with their browser extension for sites that use their first-party integration, rather than just for users using Authy as a generic TOTP app. I would generally avoid their first-party integration because of their reliance on SMS.)
- Faith_ 9y agoMy last pay check was $9500 working 12 hours a week online. My sisters friend has been averaging 15k for months now and she works about 20 hours a week. I can't believe how easy it was once I tried it out. This is what I do===http://www.millionaireprofit.cf/ http://www.millionaireprofit.cf/
- mastahyeti 9y agoI think the greatest practical threat to TOTP is phishing. U2F, regardless of where keys are stored, binds a keypair to an origin. Only authentication requests from `github.com` can use the `github.com` keys. For my money, any U2F implementation is a win over any TOTP.
- jdc0589 9y agoon an unrelated note: can someone explain why SMS based 2FA was every considered to be a good idea? That crap drives me NUTS.
- ptoomey3 9y agoMostly because, thus far, it has the best user setup experience (doesn't require user to download a new app and hence can often get enabled in seconds) and has the best "lost device"/"broken device" story (people tend to not have their backup codes). I think things like Soft U2F can change that equation a bit. An iCloud keychain synced 2FA credential would go a long way toward addressing some of the usability issues with traditional TOTP based 2FA.
- stephengillie 9y agoIt feels inherently insecure to blast a 2FA code across every device where you've got Hangouts installed. (And if you've got Hangouts installed on the PC where you're logging into, then it's not 2FA anymore.)
- kbenson 9y ago> It feels inherently insecure to blast a 2FA code across every device where you've got Hangouts installed. I think that may be Project Fi specific. To my knowledge, Hangouts doesn't do SMS anymore except for Project Fi customers, and even prior to them forcibly removing SMS handling from Hangouts on my Samsung and telling me to find something else after an update, it never synced SMS messages it to other Hangouts instances.
- fitzroy 9y agoSMS-based 2FA also gives companies a good excuse to collect users' mobile phone numbers — particularly sites for which one might not otherwise feel compelled to provide that information. Not saying it was a good idea for security, but that probably made it easier to justify internally.
- w8rbt 9y agoYou have to get people to buy into using 2fa. SMS and cell phones were good for that. They are not secure and are being abused now (SS7 attacks) and one day won't be used for 2fa at all, but the platform was a good start and certainly better than nothing at all. Hopefully, OATH (HOTP and TOTP) and FIDO will take over where SMS leaves off. And the real danger of cell phones and SMS is account recovery processes that SMS a recovery code to your cell. That's way more concerning than 2fa via SMS IMO.
- pilif 9y agoU2F has the advantage that a server compromise won't compromise the second factor as there's no shared secret accessible to both parties. Of course, keeping the token on the same machine that you're using for logging in is reducing the security, but then, the token is stored in the Keychain and once you're at the point where malware is so deeply hooked into the system that it has access to the system Keychain, then it can also inject itself into your browser and get a 2FA token whenever you log in.