3 ms·
Why to use security keys: http://fc16.ifca.ai/preproceedings/25_Lang.pdf http://fc16.ifca.ai/preproceedings/25_Lang.pdf (updated from my earlier link to the yu
by dgacmu 9y ago
Why to use security keys: http://fc16.ifca.ai/preproceedings/25_Lang.pdf http://fc16.ifca.ai/preproceedings/25_Lang.pdf
(updated from my earlier link to the yubico article about that paper: https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys-focus-of-2-year-google-study/ https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys... )
Review of security keys by Adam Langley:
https://www.imperialviolet.org/2017/08/13/securitykeys.html https://www.imperialviolet.org/2017/08/13/securitykeys.html
and testing security keys:
https://www.imperialviolet.org/2017/10/08/securitykeytest.html https://www.imperialviolet.org/2017/10/08/securitykeytest.ht...
tl;dr: Yubikeys are $$ but really solid for USB and NFC; the Feitian is probably the best option for Bluetooth but YMMV there. Those are what I personally use.
(Note that Yubico recently announced a problem with their RSA key generation, which they're fixing, but that bug does not affect the security of the device when used as a FIDO authenticator as it is for Google/Github/Dropbox/Vanguard/etc.)
- camiller 9y agoI think the Feitian one is NFC
- dgacmu 9y agoYou're right. The feitan MultiPass (naming win!) Is the Bluetooth one I use: https://www.amazon.com/Feitian-MultiPass-FIDO-Security-Key/dp/B01LYV6TQM https://www.amazon.com/Feitian-MultiPass-FIDO-Security-Key/d...
- tonyztan 9y agoAccording to Yubico, the RSA vulnerability only affects the YubiKey 4 and "all YubiKey 4 products shipped by Yubico after June 6, 2017 (version 4.3.5 or higher) use" a new implementation that is secure from this. https://www.yubico.com/support/security-advisories/ysa-2017-01/ https://www.yubico.com/support/security-advisories/ysa-2017-...
- arnarbi 9y agoFIDO U2F does not use RSA anyways.
- craftyguy 9y ago> Why to use security keys: https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys.. https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys.... I'm just going to point out that this article is written by Yubico, who undoubtedly wants to sell you a device.
- dgacmu 9y agoSorry - I linked it because it's a slightly less technical intro to the underlying paper by Google: http://fc16.ifca.ai/preproceedings/25_Lang.pdf http://fc16.ifca.ai/preproceedings/25_Lang.pdf Probably should have linked that directly. I've updated my comment to link to the paper instead of the article. Thanks!