6 ms·
I'll repeat a comment I made last week: I love the principle, but I can't use it with AWS, I can't use it with my bank, I can't use it with my domain registrar
by technion 9y ago
I'll repeat a comment I made last week:
I love the principle, but I can't use it with AWS, I can't use it with my bank, I can't use it with my domain registrar, and I can't use it with Office 365.
That's 0/4 of the high priority targets for me.
Edit: If anyone from AWS is around, please consider this. Your organisation has made huge headway in the field of security, but the AWS console logon is a very high profile target.
- idlewords 9y agoThe highest profile target is your personal email account, because that's generally the account that can reset the others. Does your email have support for U2F or at least an authenticator app?
- technion 9y agoI'm running Office 365 with the only thing is supports - Microsoft's app. Which is not infallible: https://lolware.net/2017/08/01/capturing-mfa-logons.html https://lolware.net/2017/08/01/capturing-mfa-logons.html Edit: I've always felt strongly about having things like the AWS logon connected to a dedicated and otherwise unused mailbox, it helps minimise the risk discussed here.
- ownagefool 9y agoLast time I used Office 365 you could disable the push requirment when configuring the auth app, that would then allow you to use alternatives. I used freeotp with my o365. :)
- ihattendorf 9y agoYep, just set it up a couple days ago. Supports Google Authenticator/Authy/etc.
- tokenizerrr 9y ago> Edit: I've always felt strongly about having things like the AWS logon connected to a dedicated and otherwise unused mailbox, it helps minimise the risk discussed here. Do you check this mailbox frequently? If not, won't you miss important communication?
- 0xffff2 9y agoI'm also using Office 365, but I use the same TOTP app that I use for every other 2-factor service I use...
- icebraining 9y agoI have my email protected by an SSH key plus TOTP (using the cool Google Authenticator PAM module), but I just realized I haven't enabled 2FA on the VPS control panel, so everything is protected only by a single password. sigh
- PappaPatat 9y agoWhen you are hosting your email / whatever on a VPS... access to your system is possible via a whole bunch of "not 2FA enabled" routes. I would treat that as the least trusted storage available.
- icebraining 9y agoYeah, maybe. My "threat model" is mostly drive-by automated attacks (like malware stealing my not-very-protected SSH keys) or overly broad warrants, not people specifically targeting me.
- viraptor 9y agoFor AWS, you can. https://github.com/Yubico/yubioath-desktop https://github.com/Yubico/yubioath-desktop For domain registrar, depends who you use. Gandi uses oath as well. Banks are still a decade behind in almost every way. Can't help you there.
- technion 9y agoThe Yubico Authenticator app does TOTP and HOTP, but not U2F.
- viraptor 9y agoYou need yubikey to use that authenticator. The key itself does u2f (unless it's a very old version), so the authenticator is irrelevant in that case.
- pfg 9y agoThe website (AWS) doesn't use U2F in that scenario, so you don't get the phishing-resistance U2F brings to the table. It's just regular TOTP, with the secret stored on your Yubikey instead of your phone (or wherever else you'd store it normally).
- tmerse 9y agoHere is an overview of current 2FA support of service providers: https://twofactorauth.org/ https://twofactorauth.org/ To apply some pressure, there are handy "public shaming" twitter-shortcuts.
- pjc50 9y agoSimilarly I remember the first organisation that really tried to get me as a user to care about account security with a hardware token was .. World of Warcraft. Followed a bit later by the use of TOTP in Steam. Banks meanwhile are either stuck in the past or have tried bad proprietary solutions. Domain registrars are an odd one, because so rarely does one need to log in or do anything - but when you do it may be urgent.
- deleted 9y ago[deleted]
- dalore 9y agoBanks in the UK have been handing out hardware fobs. Not USB devices you put in, but a calculator like interface where you input the challenge they give you and you type the response back. I guess it works since it doesn't need anything else special and can easily work with web flows.
- majewsky 9y agoI think you mean a ChipTAN generator. https://en.wikipedia.org/wiki/Transaction_authentication_number#ChipTAN_.2F_CardTAN https://en.wikipedia.org/wiki/Transaction_authentication_num...
- jon-wood 9y agoThe nice thing about these is that you do need something else special but that something else is your bank card, and the PIN used to access it.
- dr4g0n 9y agoOnly for some banks, e.g. Barclays. HSBC's version[1] does not require a card to use. [1]: https://www.hsbc.co.uk/1/2/contact-and-support/security-centre/secure-key/demos#physical-secure-key https://www.hsbc.co.uk/1/2/contact-and-support/security-cent...
- _joel 9y ago
- johnmaguire2013 9y agoI work for Duo Security. We have an SSO product that allows you to use U2F Yubikey tokens with AWS, Office 365, and anything else that supports SAML. Other companies offer similar products.
- bogomipz 9y ago>"I love the principle, but I can't use it with AWS, ..." You can use Google Authenticator with TOTP with you AWS console. Or am I misunderstanding your comment? It's not a hardware device obviously but its the same principle, just implemented in software.
- technion 9y agoYes, you can use TOTP, but TOTP can be phished. The article I was responding to, was written regarding U2F keys, which is a different protocol, with protection for this scenario.