14 ms·
It's also tremendously more efficient to tap your finger on the plugged in USB than it is to wait for a code to be sent to your phone or go find it on an app to
by brightball 8y ago
It's also tremendously more efficient to tap your finger on the plugged in USB than it is to wait for a code to be sent to your phone or go find it on an app to type in. I've added it to everything that allows it, more for convenience than security at this point.
Most places that allow it require that you have a fallback method available.
- minxomat 8y agoThats the single reason I got a smart watch. Just to have my 2fa codes on my wrist instead of getting my phone out of my pocket (I'm using Authenticator+)
- koolba 8y agoAny specific recommendations for a smart watch exclusively for 2FA?
- minxomat 8y agoThere are probably better options. I'm using a Huawei watch first gen. Rock solid construction, awesome (always on) display, enough battery life, android wear 2, no proprietary strap bs. It's about 100 USD for B Stock.
- braythwayt 8y agoThis is not normally considered a “hacker-friendly” option, but I use an Apple Watch. The above-mentioned 1Password has a watch app, so by using it for my passwords and TOTP codes, I maximize my personal convenience.
- pimeys 8y agoPebbles are quite cheap and offer 7 days of battery. The company went bankrupt, but you can still use the devices with rebble. The Pebble 1 is about 40€ and the rare Pebble 2 about 120€.
- abawany 8y agoI learnt from this thread that my smart watch (Garmin Vivoactive HR) also has 2FA apps available for it (e.g. https://apps.garmin.com/en-US/apps/c601e351-9fa8-4303-aead-441251559064 https://apps.garmin.com/en-US/apps/c601e351-9fa8-4303-aead-4...). I love the watch (long battery life, tons of apps including one from the famous antirez, built-in GPS, etc.) so I am thrilled that I have 2FA options for it as well.
- mrb 8y agoWell, remember the entire point of U2F is to not be phishable. Authentication codes—and your smart watch—are phishable.
- baby 8y agoOne thing I don't understand is why are apps like authy or google authenticator not using push notifications to allow you to directly auth via unlocking or touchID instead of having to go through the app. If you really want the user to type something then you can still use push notitication for easy app access
- jrowley 8y agoAuthy used to have push notification support for LastPass but it has stopped working for me.
- cube2222 8y agoLogging in to Google works exactly like this at the moment. It's probably because setting this up is more involved for the backend, setting up that key which you have to type in is fairly simple technically.
- brightball 8y agoSome do. A lot of companies that use Duo will set that up for their internals. The problem is that those push solutions require that the company have some means of communicating with the app that you're using to trigger the push and the confirmation (as far as I can tell). This technology works around that by letting the browser talk to the plugged in device, circumventing all of the network/api bits.
- spacehunt 8y agoTOTP is designed to be usable even while offline.
- Klathmon 8y agoBut is that trade off worth it? Is the ability to work offline worth giving up a simple prevention of phishing attacks?
- klodolph 8y agoFull circle here, since FIDO U2F has phishing-resistance like push notifications and lets you work offline like TOTP. "Offline" in the sense that everything besides whatever you're authenticating against can be offline.
- tptacek 8y agoIt's more efficient, but remember the point of this story, which is that it mitigates phishing attacks, which code-generating 2FA applications do not.
- meroje 8y ago1password does mitigate it to some extent by automatically copying the code to your clipboard after filling the form, these 2 things only work on the right domain. Of course you can still copy the values from the app but at least it hints at things being wrong.
- tptacek 8y agoIf you're using 1Password-generated passwords and storing TOTP codes in 1Password, how are the TOTP codes not just theater?
- arachnids 8y agoParent's argument is that it mitigates phishing - i.e your normal workflow is you go to a site and your credentials are automatically filled in, so you'd be suspicious if that doesn't happen. In my experience, the autofill breaks so much that I've started copying my password in manually all the time.
- closeparen 8y agoThe TOTP code does not add anything to phishing mitigation.
- Fnoord 8y agoDepends on the exact attack. If its a full MITM (including TLS), no. If its a fake website who don't forward after password-based authentication, yes. U2F would also detect the domain is incorrect, though so does my password manager. Though that's based on a browser extension. I suppose if the browser gets mislead, as would the password manager. And that did happen with LastPass (XSS attack IIRC).
- devy 8y ago> I've added it to everything that allows it, more for convenience than security at this point. It's convenient only when you physically have the security key; it's a hassle if you forgot or lost it.
- rhencke 8y agoI have one. It's attached to my key chain. If I've lost my keys, I have bigger problems. It's convenient.
- deleted 8y ago[deleted]
- brightball 8y agoIt doesn't have to be your only method.
- valenciarose 8y agoYou can (and generally do) have multiples of these tokens. They are easily revoked. The Fido only tokens are $15.
- bogomipz 8y ago>"It's also tremendously more efficient to tap your finger on the plugged in USB than it is to wait for a code to be sent to your phone or go find it on an app to type in." But with regular TOTP and a software device on a smart phone I can print out backup codes in case you lose your phone. This allows one to log in and reset their 2FA token. What happens if you lose your Yubikey or similar? I guess this doesn't matter as much in an enterprise setting where there is a dedicated IT department but for for individual use outside of the enterprise doesn't TOTP and a software device have a better story in case of loss of the 2FA device?
- winthrowe 8y ago> What happens if you lose your Yubikey or similar? Get two, leave one in your safe deposit box. Every service I've seen that supports U2F supports multiple tokens.
- bogomipz 8y agoI see that does't help much if you're on the road travelling unfortunately. At least with ToTP backup codes, someone at home can read you a printed backup code in order disable and reset your TOTP.
- brightball 8y agoAlmost every site that I've set it up with actually requires you have a backup method (app, codes, sms, etc).