5 ms·

Google Titan Security Key

45 points by moviuro 8y ago

moviuro 8y ago
See also https://www.cnet.com/news/google-made-the-titan-key-to-toughen-up-your-online-security/ https://www.cnet.com/news/google-made-the-titan-key-to-tough...
larkeith 8y ago
Discussion (16 hrs ago): https://news.ycombinator.com/item?id=17610516 https://news.ycombinator.com/item?id=17610516
mtgx 8y ago
I think Google uses this same Titan chip for it: https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-security-in-plaintext.html https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-... I'm not sure if this is the "hardware security module" they've been touting for Pixel 2 devices, too. I assume this project was spun-off from Project Vault, or at least they re-used some of the ideas/code from that, but it's still a shame we won't be getting the microSD "HSM" anymore. I guess that idea died when Google and other manufacturers decided to kill support for microSD in their devices altogether. https://techcrunch.com/2015/05/29/googles-project-vault-is-a-secure-computing-environment-on-a-micro-sd-card-for-any-platform/ https://techcrunch.com/2015/05/29/googles-project-vault-is-a... This is Yubico's response to the Titan Key announcement, if you care to read it: https://www.yubico.com/2018/07/the-key-to-trust/ https://www.yubico.com/2018/07/the-key-to-trust/
- gonvaled 8y ago
  regarding yubico: they talk open, global standards, but then say security can only be met by producing in the USA (and Sweden!). Why should I trust USA produced products?
  - albntomat0 8y ago
    Looking at the list of IC exports[0], where should they be produced that will be trusted by the vast majority of those who care? [0]: https://en.wikipedia.org/wiki/List_of_countries_by_integrated_circuit_exports https://en.wikipedia.org/wiki/List_of_countries_by_integrate...
    - whitepoplar 8y ago
      Now I'm wondering how Malta made the top-20 list of IC export countries.
- moviuro 8y ago
  Meh... "open" https://www.yubico.com/2016/05/secure-hardware-vs-open-source/ https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...
  - teamhappy 8y ago
    You might like Nitrokey: https://www.nitrokey.com/ https://www.nitrokey.com/
  - mtgx 8y ago
    Yeah, that stood out to me, too. It's kind of funny that they're using the "open" as a competitive advantage against Google, when they no longer have that competitive advantage. I bet they wish they had stayed open right about now.
lodyb 8y ago
They need to do better at explaining what this is. Is it a physical device like in the pictures, or a piece of software? It does not make it clear. I can make a best guess, but from this landing page it is uncertain.
- ckocagil 8y ago
  My understanding is that it's a FIDO U2F key, like the ones from Yubico.
  - simias 8y ago
    Judging by the drawings it looks exactly like a yubikey[1]. Did they partner in some way or did they just use the same design? [1] https://www.yubico.com/wp-content/uploads/2015/12/YubiKey-4-1000.png https://www.yubico.com/wp-content/uploads/2015/12/YubiKey-4-...
- caiob 8y ago
  Funny how this climbed to the top on HN, without anyone knowing what this is exactly.
aichi 8y ago
Why Google 'sell' this as an advantage over 2FA over mobile phone? In this case it works on computer only, or you have to be at some computer, with mobile app, you can be anywhere? I see that as huge disadvantage.
- Cthulhu_ 8y ago
  Mobile phones can be hacked; if you use your Authenticator app to log into an application on your mobile phone, it's by definition no longer two-factor authentication. The basis of that is having a separate device. Having that in a key that cannot be compromised by e.g. being rootable, internet connected, etcetera is an extra layer of security. The mobile phone is more convenient though, and I also don't know how these things work when you try and log in via a mobile device. For high security access though, like google cloud consoles and such, a policy of not allowing access via mobile phones does make sense. (also because said console is probably not very usable on mobile).
- simias 8y ago
  Security tokens are more secure and can't be as easily fished as phone-based 2FA solutions. It's not about using the key on a mobile phone, it's about replacing phone-based 2FA. You're right however that their key doesn't seem to have any interface other than USB so it won't be practically usable on smartphones. Yubico has NFC tokens[1] for that use case but it doesn't seem that Google's version offers that yet. [1] https://www.yubico.com/products/yubikey-for-mobile/ https://www.yubico.com/products/yubikey-for-mobile/
  - rlac16 8y ago
    The page Using Security Key links to mentions that Titan supports Bluetooth & USB, with NFC support in a future update. https://support.google.com/accounts/answer/6103523 https://support.google.com/accounts/answer/6103523
- pliny 8y ago
  The yubikey version of this works with phones, you can plug it in if your phone has the appropriate usb port, and it theoretically supports nfc and bluetooth but those rarely seem to work for me. I'm not sure if the google version also supports the wireless protocols but I don't see why you couldn't plug it into your phone.
raesene9 8y ago
The thing that makes me a bit jumpy about hardware 2FA with things like this or a Yubikey is around what happens if I lose it or it breaks. It's not so much a problem in a corporate setup (like internally at Google) where you could go to a central admin team to revoke/replace the key. But if you're a home user using this for a wide variety of sites and the token fails then the failure mode seems to be "go figure out the fallback for every site you use and use that", which could be really painful. I prefer the, possibly less secure but more flexible option of TOTP applications that let me synch to multiple devices, so the loss of one device isn't very painful.
- pentestercrab 8y ago
  If you want U2F with recovery, the Trezor from SatoshiLabs is a great option. Only issue is the cost is a bit higher than most hardware tokens.
- bertil 8y ago
  For both cases, what you want to have is a central account that you authenticate to using the key, and that account uses OpenSocial/OAuth-like protocols to grant access to separate services. That’s how those central teams manage to revoke keys easily.
- suixo 8y ago
  In the original U2F spec, I think there was an "answer" to this revocation issue: "enroll a second device for every origin, and keep this one in a safe". This way you can still connect even if you lose the first one. In practice, well, meh...
- simias 8y ago
  I think I'd like a version of this scheme which works a bit like email-based verification: you have a trusted provider (like an email provider today, you can self-host or use any of the many 3rd party hosts) that you use to vouch for your identity. When you want to log into a website you use a certificate authenticating you, the website checks if it's valid with your authority (similar to the current email-based verification on most websites). If you want to change your certificate for any reason you only have to do it with your authority and everything else keeps working as usual. The drawback of course is that you have a single point of failure, if the authority is compromised you're naked in the wild. IIRC OpenID worked like that but unfortunately it never gained traction. It's a shame really. More practically I do use a yubikey myself but mostly as a GnuPG smartcard, not for 2FA. I actually have the same key stored on multiple tokens as a backup, so if my current key breaks I just have to fetch an other one. Of course if instead I lose it or it's stolen I'll probably have to generate new keys (even though the PIN should theoretically still protect me) so the problem still exists.
zaarn 8y ago
Quite neat. Though I'm still dissapointed in the U2F/Security Key market. The Yubico's cost 50€ the piece or 20€ for the U2F key only. And to get NFC usage you have to buy a worse variant of the other keys that doesn't support 4096bit RSA and some other features. There is not much competition either, Nitro is just as expensive and doesn't feature a good and cheap key either. Open Source variants are also fairly rare, I would love to DIY some Yubikey 4-like stick with the same or similar/comparable function set. Only thing so far I found is the U2F zero but that didn't offer RSA. Quite annoying, maybe some competitor other than Yubikey and Nitro can solve this. (It doesn't seem Google is selling the Titan, I see no pricetag)
- dogma1138 8y ago
  To be fair for home usage a soft-token is just as good and you can back it up by backing up the seed. If your phone is compromised by someone who can exploit it then your adversarial outlook is pretty dire to begin with.
  - zaarn 8y ago
    I'd rather have a hardware solution tbh, I don't think software U2F or smartcard is what I want or fits my threatmodel.
bdz 8y ago
Will this be available to normal Google users?

45 points by moviuro 8y ago

See also https://www.cnet.com/news/google-made-the-titan-key-to-toughen-up-your-online-security/ https://www.cnet.com/news/google-made-the-titan-key-to-tough...

larkeith 8y ago

Discussion (16 hrs ago): https://news.ycombinator.com/item?id=17610516 https://news.ycombinator.com/item?id=17610516

mtgx 8y ago

I think Google uses this same Titan chip for it: https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-security-in-plaintext.html https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-... I'm not sure if this is the "hardware security module" they've been touting for Pixel 2 devices, too. I assume this project was spun-off from Project Vault, or at least they re-used some of the ideas/code from that, but it's still a shame we won't be getting the microSD "HSM" anymore. I guess that idea died when Google and other manufacturers decided to kill support for microSD in their devices altogether. https://techcrunch.com/2015/05/29/googles-project-vault-is-a-secure-computing-environment-on-a-micro-sd-card-for-any-platform/ https://techcrunch.com/2015/05/29/googles-project-vault-is-a... This is Yubico's response to the Titan Key announcement, if you care to read it: https://www.yubico.com/2018/07/the-key-to-trust/ https://www.yubico.com/2018/07/the-key-to-trust/

gonvaled 8y ago
regarding yubico: they talk open, global standards, but then say security can only be met by producing in the USA (and Sweden!). Why should I trust USA produced products?
- albntomat0 8y ago
  Looking at the list of IC exports[0], where should they be produced that will be trusted by the vast majority of those who care? [0]: https://en.wikipedia.org/wiki/List_of_countries_by_integrated_circuit_exports https://en.wikipedia.org/wiki/List_of_countries_by_integrate...
  - whitepoplar 8y ago
    Now I'm wondering how Malta made the top-20 list of IC export countries.
moviuro 8y ago
Meh... "open" https://www.yubico.com/2016/05/secure-hardware-vs-open-source/ https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...
- teamhappy 8y ago
  You might like Nitrokey: https://www.nitrokey.com/ https://www.nitrokey.com/
- mtgx 8y ago
  Yeah, that stood out to me, too. It's kind of funny that they're using the "open" as a competitive advantage against Google, when they no longer have that competitive advantage. I bet they wish they had stayed open right about now.

lodyb 8y ago

They need to do better at explaining what this is. Is it a physical device like in the pictures, or a piece of software? It does not make it clear. I can make a best guess, but from this landing page it is uncertain.

ckocagil 8y ago
My understanding is that it's a FIDO U2F key, like the ones from Yubico.
- simias 8y ago
  Judging by the drawings it looks exactly like a yubikey[1]. Did they partner in some way or did they just use the same design? [1] https://www.yubico.com/wp-content/uploads/2015/12/YubiKey-4-1000.png https://www.yubico.com/wp-content/uploads/2015/12/YubiKey-4-...
caiob 8y ago
Funny how this climbed to the top on HN, without anyone knowing what this is exactly.

aichi 8y ago

Why Google 'sell' this as an advantage over 2FA over mobile phone? In this case it works on computer only, or you have to be at some computer, with mobile app, you can be anywhere? I see that as huge disadvantage.

Cthulhu_ 8y ago
Mobile phones can be hacked; if you use your Authenticator app to log into an application on your mobile phone, it's by definition no longer two-factor authentication. The basis of that is having a separate device. Having that in a key that cannot be compromised by e.g. being rootable, internet connected, etcetera is an extra layer of security. The mobile phone is more convenient though, and I also don't know how these things work when you try and log in via a mobile device. For high security access though, like google cloud consoles and such, a policy of not allowing access via mobile phones does make sense. (also because said console is probably not very usable on mobile).
simias 8y ago
Security tokens are more secure and can't be as easily fished as phone-based 2FA solutions. It's not about using the key on a mobile phone, it's about replacing phone-based 2FA. You're right however that their key doesn't seem to have any interface other than USB so it won't be practically usable on smartphones. Yubico has NFC tokens[1] for that use case but it doesn't seem that Google's version offers that yet. [1] https://www.yubico.com/products/yubikey-for-mobile/ https://www.yubico.com/products/yubikey-for-mobile/
- rlac16 8y ago
  The page Using Security Key links to mentions that Titan supports Bluetooth & USB, with NFC support in a future update. https://support.google.com/accounts/answer/6103523 https://support.google.com/accounts/answer/6103523
pliny 8y ago
The yubikey version of this works with phones, you can plug it in if your phone has the appropriate usb port, and it theoretically supports nfc and bluetooth but those rarely seem to work for me. I'm not sure if the google version also supports the wireless protocols but I don't see why you couldn't plug it into your phone.

raesene9 8y ago

The thing that makes me a bit jumpy about hardware 2FA with things like this or a Yubikey is around what happens if I lose it or it breaks. It's not so much a problem in a corporate setup (like internally at Google) where you could go to a central admin team to revoke/replace the key. But if you're a home user using this for a wide variety of sites and the token fails then the failure mode seems to be "go figure out the fallback for every site you use and use that", which could be really painful. I prefer the, possibly less secure but more flexible option of TOTP applications that let me synch to multiple devices, so the loss of one device isn't very painful.

pentestercrab 8y ago
If you want U2F with recovery, the Trezor from SatoshiLabs is a great option. Only issue is the cost is a bit higher than most hardware tokens.
bertil 8y ago
For both cases, what you want to have is a central account that you authenticate to using the key, and that account uses OpenSocial/OAuth-like protocols to grant access to separate services. That’s how those central teams manage to revoke keys easily.
suixo 8y ago
In the original U2F spec, I think there was an "answer" to this revocation issue: "enroll a second device for every origin, and keep this one in a safe". This way you can still connect even if you lose the first one. In practice, well, meh...
simias 8y ago
I think I'd like a version of this scheme which works a bit like email-based verification: you have a trusted provider (like an email provider today, you can self-host or use any of the many 3rd party hosts) that you use to vouch for your identity. When you want to log into a website you use a certificate authenticating you, the website checks if it's valid with your authority (similar to the current email-based verification on most websites). If you want to change your certificate for any reason you only have to do it with your authority and everything else keeps working as usual. The drawback of course is that you have a single point of failure, if the authority is compromised you're naked in the wild. IIRC OpenID worked like that but unfortunately it never gained traction. It's a shame really. More practically I do use a yubikey myself but mostly as a GnuPG smartcard, not for 2FA. I actually have the same key stored on multiple tokens as a backup, so if my current key breaks I just have to fetch an other one. Of course if instead I lose it or it's stolen I'll probably have to generate new keys (even though the PIN should theoretically still protect me) so the problem still exists.

zaarn 8y ago

Quite neat. Though I'm still dissapointed in the U2F/Security Key market. The Yubico's cost 50€ the piece or 20€ for the U2F key only. And to get NFC usage you have to buy a worse variant of the other keys that doesn't support 4096bit RSA and some other features. There is not much competition either, Nitro is just as expensive and doesn't feature a good and cheap key either. Open Source variants are also fairly rare, I would love to DIY some Yubikey 4-like stick with the same or similar/comparable function set. Only thing so far I found is the U2F zero but that didn't offer RSA. Quite annoying, maybe some competitor other than Yubikey and Nitro can solve this. (It doesn't seem Google is selling the Titan, I see no pricetag)

dogma1138 8y ago
To be fair for home usage a soft-token is just as good and you can back it up by backing up the seed. If your phone is compromised by someone who can exploit it then your adversarial outlook is pretty dire to begin with.
- zaarn 8y ago
  I'd rather have a hardware solution tbh, I don't think software U2F or smartcard is what I want or fits my threatmodel.

bdz 8y ago

Will this be available to normal Google users?