5 ms·

I guess this is a dumb question, but is it still "multi factor authentication" if you only use a single physical device to complete the login process? The way

I guess this is a dumb question, but is it still "multi factor authentication" if you only use a single physical device to complete the login process? The way the article is written, it makes it sound like the physical key is a replacement for 2FA instead of just a hardware device that handles the second factor (while leaving the password component in place).

izacus 8y ago
The key replaces the keycode of 2FA auth - password still has to be used. You can already use the same process on your GMail if you have a compatible U2F key.
- decasia 8y ago
  OK thanks, this clarifies the part that says "it began requiring all employees to use physical Security Keys in place of passwords and one-time codes," which I found super confusing.
  - Freak_NL 8y ago
    The password can be replaced by something simpler like a PIN, which is why you'll read about U2F replacing passwords and one-time codes. Sometimes 'replacing passwords' is used to mean 'replacing the traditional username and password login' as well.
  - ehsankia 8y ago
    Strange sentence, but I believe they mean replcaing "password + one time code" with "password + U2F"
  - Boulth 8y ago
    Actually U2F can be used to devise several different schemes, either token+password, or token alone, even just token without username. Of course each of these has various advantages and disadvantages.
  - cbhl 8y ago
    Some logins are cookie + security key (basically if I've already logged in today) which basically feels like "tap my security key and I'm logged in". Of course, more sensitive stuff (access to production, access to pay stubs, access to $cloud_erp) requires re-entering password plus the security key.
- deleted 8y ago
  [deleted]
giancarlostoro 8y ago
First paragraph answers it: > Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity.
- puzzle 8y ago
  Now the real question becomes: how often were they getting phished before the new policies? Knowing Google, there's no way they will answer THAT before another decade.
  - SmellyGeekBoy 8y ago
    Why? What does it matter? Presumably it must have happened at least once for them to bring in this policy.
    - puzzle 8y ago
      Well, for one, it would put the non negligible costs in perspective. Second, it would be an additional data point. More data is usually better than less of it. In this case, though, it's sensitive data, for a number of reasons, which is why I don't see it happening for years.
- akerl_ 8y ago
  If they "use (physical security keys) in place of (passwords and one-time codes)", that would no longer be MFA: they're authing strictly with "something they have". A more in-depth quote is later in the article: "Once a device is enrolled for a specific Web site that supports Security Keys, the user no longer needs to enter their password at that site (unless they try to access the same account from a different device, in which case it will ask the user to insert their key)." The parenthetical seems to imply that they're doing initial auth (and thus cookie generation) with password + U2F, and then re-validating U2F for specific actions / periodically without re-prompting for the password, similarly to how GitHub prompts for "sudo mode" when you do specific account actions.
brightball 8y ago
The best explanation is really: https://fidoalliance.org/ https://fidoalliance.org/ Short version: the keys are matched directly from the device to the site making it virtually impossible to phish unless you control the site itself.
chimeracoder 8y ago
> I guess this is a dumb question, but is it still "multi factor authentication" if you only use a single physical device to complete the login process? This is a common misconception. The threat model of 2FA is not "I lost my device, and it is now in the hands of someone who knows the password". The threat model of 2FA is one of: 1) "An attacker has gained remote access to my computer, but not physical access" 2) "I have been targeted by a sophisticated phishing attack, and I trust the machine that I am currently using" TOTP (and even SMS) protects against (1) in most cases, though U2F is still preferable. U2F is the only method that protects against (2).
- decasia 8y ago
  That's interesting, thanks. I always thought the 2FA threat model was "Someone acquired my password" or else "someone has access to my email account and may try to do password resets by email."
- wool_gather 8y ago
  > U2F is the only method that protects against (2) Would you be able to elaborate on this? I'm not understanding the difference between TOTP and the physical key from the article for this scenario.
  - toast0 8y ago
    With TOTP, a sufficiently clever phish may convince you to enter the one time code. With U2F, there is communication between the browser and the device, requesting authentication for a specific origin hostname -- that can't (shouldn't) be fooled by a phish hosted at Google.com-super-secure-phishing.net
    - tzs 8y ago
      Where do password managers fit in here? If a phisher convinces me to try to login to google.com-super-secure-phishing.net using my google account I'm going to notice something is wrong when my password manager refuses to fill in the login form.
dboreham 8y ago
Huh? The article literally is about 2FA, as originally conceived. It isn't replacement for 2FA -- it is 2FA. The key (sic) thing about U2F isn't that it is new and special (it isn't -- it's plain old 2FA as used for more than a decade) but rather that it is practical to deploy for smaller organizations. You don't need to buy large quantities of keys. You don't need a special server. You don't need staff with special skills to deploy it. It works with "cloud" providers like Google and Facebook, out the box (same key as you use for your internal services).
- lima 8y ago
  No, the key thing about U2F is that it can't be phished. Any other 2FA method can.
  - dboreham 8y ago
    How do you phish a smart card?
- resonanttoe 8y ago
  Not quite. A 6 digit code can be phished out from users pretty easily. They'll enter it anywhere its asked, similar to a password. However the U2F and Fido spec requires a Cryptographic assertion (with all that replay attack mitigation stuff like Nonces) that makes it so that an attacker can reuse a Token touch. I'd probably encourage a glance over this https://fidoalliance.org/specs/fido-u2f-v1.0-ps-20141009/fido-u2f-overview-ps-20141009.html https://fidoalliance.org/specs/fido-u2f-v1.0-ps-20141009/fid... Sadly the Wikipedia article doesn't have a good layman's explanation yet, but I'm sure it'll will soon. Yes at a high level, its still 2FA but like most options in any factor of Auth. It can be improved upon. (For a simple case, take Fingerprint readers and look at the advances of liveliness checks and how many unique points it requires.)
  - dboreham 8y ago
    When I say "2FA" I mean proper 2FA with a hard token. As used for 20 years or so in government, large companies.

izacus 8y ago

The key replaces the keycode of 2FA auth - password still has to be used. You can already use the same process on your GMail if you have a compatible U2F key.

decasia 8y ago
OK thanks, this clarifies the part that says "it began requiring all employees to use physical Security Keys in place of passwords and one-time codes," which I found super confusing.
- Freak_NL 8y ago
  The password can be replaced by something simpler like a PIN, which is why you'll read about U2F replacing passwords and one-time codes. Sometimes 'replacing passwords' is used to mean 'replacing the traditional username and password login' as well.
- ehsankia 8y ago
  Strange sentence, but I believe they mean replcaing "password + one time code" with "password + U2F"
- Boulth 8y ago
  Actually U2F can be used to devise several different schemes, either token+password, or token alone, even just token without username. Of course each of these has various advantages and disadvantages.
- cbhl 8y ago
  Some logins are cookie + security key (basically if I've already logged in today) which basically feels like "tap my security key and I'm logged in". Of course, more sensitive stuff (access to production, access to pay stubs, access to $cloud_erp) requires re-entering password plus the security key.
deleted 8y ago
[deleted]

giancarlostoro 8y ago

First paragraph answers it: > Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity.

puzzle 8y ago
Now the real question becomes: how often were they getting phished before the new policies? Knowing Google, there's no way they will answer THAT before another decade.
- SmellyGeekBoy 8y ago
  Why? What does it matter? Presumably it must have happened at least once for them to bring in this policy.
  - puzzle 8y ago
    Well, for one, it would put the non negligible costs in perspective. Second, it would be an additional data point. More data is usually better than less of it. In this case, though, it's sensitive data, for a number of reasons, which is why I don't see it happening for years.
akerl_ 8y ago
If they "use (physical security keys) in place of (passwords and one-time codes)", that would no longer be MFA: they're authing strictly with "something they have". A more in-depth quote is later in the article: "Once a device is enrolled for a specific Web site that supports Security Keys, the user no longer needs to enter their password at that site (unless they try to access the same account from a different device, in which case it will ask the user to insert their key)." The parenthetical seems to imply that they're doing initial auth (and thus cookie generation) with password + U2F, and then re-validating U2F for specific actions / periodically without re-prompting for the password, similarly to how GitHub prompts for "sudo mode" when you do specific account actions.

brightball 8y ago

The best explanation is really: https://fidoalliance.org/ https://fidoalliance.org/ Short version: the keys are matched directly from the device to the site making it virtually impossible to phish unless you control the site itself.

chimeracoder 8y ago

> I guess this is a dumb question, but is it still "multi factor authentication" if you only use a single physical device to complete the login process? This is a common misconception. The threat model of 2FA is not "I lost my device, and it is now in the hands of someone who knows the password". The threat model of 2FA is one of: 1) "An attacker has gained remote access to my computer, but not physical access" 2) "I have been targeted by a sophisticated phishing attack, and I trust the machine that I am currently using" TOTP (and even SMS) protects against (1) in most cases, though U2F is still preferable. U2F is the only method that protects against (2).

decasia 8y ago
That's interesting, thanks. I always thought the 2FA threat model was "Someone acquired my password" or else "someone has access to my email account and may try to do password resets by email."
wool_gather 8y ago
> U2F is the only method that protects against (2) Would you be able to elaborate on this? I'm not understanding the difference between TOTP and the physical key from the article for this scenario.
- toast0 8y ago
  With TOTP, a sufficiently clever phish may convince you to enter the one time code. With U2F, there is communication between the browser and the device, requesting authentication for a specific origin hostname -- that can't (shouldn't) be fooled by a phish hosted at Google.com-super-secure-phishing.net
  - tzs 8y ago
    Where do password managers fit in here? If a phisher convinces me to try to login to google.com-super-secure-phishing.net using my google account I'm going to notice something is wrong when my password manager refuses to fill in the login form.

dboreham 8y ago

Huh? The article literally is about 2FA, as originally conceived. It isn't replacement for 2FA -- it is 2FA. The key (sic) thing about U2F isn't that it is new and special (it isn't -- it's plain old 2FA as used for more than a decade) but rather that it is practical to deploy for smaller organizations. You don't need to buy large quantities of keys. You don't need a special server. You don't need staff with special skills to deploy it. It works with "cloud" providers like Google and Facebook, out the box (same key as you use for your internal services).

lima 8y ago
No, the key thing about U2F is that it can't be phished. Any other 2FA method can.
- dboreham 8y ago
  How do you phish a smart card?
resonanttoe 8y ago
Not quite. A 6 digit code can be phished out from users pretty easily. They'll enter it anywhere its asked, similar to a password. However the U2F and Fido spec requires a Cryptographic assertion (with all that replay attack mitigation stuff like Nonces) that makes it so that an attacker can reuse a Token touch. I'd probably encourage a glance over this https://fidoalliance.org/specs/fido-u2f-v1.0-ps-20141009/fido-u2f-overview-ps-20141009.html https://fidoalliance.org/specs/fido-u2f-v1.0-ps-20141009/fid... Sadly the Wikipedia article doesn't have a good layman's explanation yet, but I'm sure it'll will soon. Yes at a high level, its still 2FA but like most options in any factor of Auth. It can be improved upon. (For a simple case, take Fingerprint readers and look at the advances of liveliness checks and how many unique points it requires.)
- dboreham 8y ago
  When I say "2FA" I mean proper 2FA with a hard token. As used for 20 years or so in government, large companies.