10 ms·

Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U2F Security Key [pdf]

49 points by eaguyhn 8y ago

jiveturkey 8y ago
Title (original from TFA) is very misleading. The study is too late in the process of setting up 2FA. No one in the study was motivated to set up 2FA in the first place. This is "merely" a UX study that benefits Yubico. It doesn't address (at all) why people do or do not want 2FA in the first place. To use my own insight: regular joe does not want to buy an expensive product and install some hardware. (the "cheap" $20 ones are literally worse than useless. but even $20 is too much.) 2FA's future is in touchID (integrated into touch bar on mac) and push to a phone app. The latency of push to a phone app is more acceptable than the confusion and vagary around adding an expensive usb key that you don't understand and then doesn't work on your mobile anyway.
- mvanbaak 8y ago
  "then doesn't work on your mobile anyway." The yubikey neo works perfectly on your mobile, as long as it has NFC support.
  - javagram 8y ago
    U2F through the yubikey doesn’t work on iOS devices because iOS NFC is only 1-way outside of Apple Pay.
    - jacquesm 8y ago
      I hate private APIs. There ought to be a law that vendors can only use public APIs.
  - Tomte 8y ago
    So Apple is out, right?
    - DarkStar851 8y ago
      What? iPhone 6s and newer supports NFC.
      - gruez 8y ago
        6s supports NFC for EMV only. 8 and newer has generic NFC support. https://developer.apple.com/documentation/corenfc https://developer.apple.com/documentation/corenfc
        devinl 8y ago
        The "generic NFC" support you refer to is read only which means that protocols like U2F still don't work so usability of U2F for iPhone users is still not there (without bluetooth keys which have their own problems).
        dbb01 8y ago
        The neo NFC works with iPhones 7 and above
      - deleted 8y ago
        [deleted]
      - sofaofthedamned 8y ago
        Only for Apple Pay, which is another reason Apple are disingenuous when it comes to security.
  - jiveturkey 8y ago
    i'm sure the neo is flying off the shelves at $50 ... it's awkward enough for desktop use that push to mobile is a superior UX
  - m-p-3 8y ago
    Sadly my Xiaomi device doesn't..
- techsupporter 8y ago
  > the "cheap" $20 ones are literally worse than useless. How so? > 2FA's future is in touchID (integrated into touch bar on mac) and push to a phone app. As another person pointed out, this is quite literally what krypt.co's Krypton app does and it integrates with existing U2F/FIDO standards so either a hard or soft device can be used.
  - StavrosK 8y ago
    Krypt.co looks pretty nice, I have a Yubikey and andOTP but I hate either getting up to fetch the hardware key or fumbling about for the right TOTP code, so the soft-approve by Krypton looks like the most convenient option, and reasonably secure, to boot.
  - yayana 8y ago
    I find that quote odd too. I find the $10 USB-only ones useful, I just wish they had dual normal/micro USB like some flash sticks. I don't want Bluetooth, NFC or software u2f devices for security reasons, but I also think they could each have additional support problems if given to family members. The ideal option for me would be an applet on a smartcard in my phone's 2nd sim bay and a hard power toggle for the 2nd bay. Then I suppose my phone could also provide proxying of u2f as a USB device. But last I looked Android was blocking access to simcard slots for general purpose..
- dijit 8y ago
  What about krypt.co ?
throwawaymanbot 8y ago
Johnny does not want to use a physical FIDO U2F security key, because he regularly loses his phone and regular keys, and does not like to think about losing his entire digital life because he mislaid this FIDO U2F key.
Tomte 8y ago
Why I‘m using my three or four U2F keys rarely: almost nobody supports them. Yeah, Google, GitHub, Facebook. But my bank doesn‘t. My insurance companies don‘t. My broker doesn‘t. It‘s all very sad.
- dijit 8y ago
  Recently I tried adding U2F support to my chat bot. It was so complicated and I couldn’t find comprehensive documentation for it so I gave up. Admittedly, the chat bot is a hobby project so I was only looking for a couple of weeks in my spare time, maybe I “looked wrong” but everything I found was focusing on clients and rarely on servers.
  - tialaramex 8y ago
    The MDN docs look adequate to me. You do need to go into this either understanding what's actually going on or open to just being told what to do rather than trying to plug it into a model you have from, say, using password authentication. Your code (typically JavaScript) running on the client is going to feed input from your server (getting it to the client is your problem, inline it in the HTML, read it from a WebSocket, whatever) into this API and get back a result. The result needs to go to server - again how you do this is up to you. The server verifies stuff, I guess that could be handled in a library or something, and then you've authenticated the user, done, set a session cookie or whatever.
- techsupporter 8y ago
  > But my bank doesn‘t. My insurance companies don‘t. My broker doesn‘t. It‘s all very sad. Disappointingly, my (former) bank, insurance, and broker companies only supported "2"FA via SMS, which is even worse--in my opinion--than not supporting anything at all because it gives a false sense of security. My bank and my mobile phone provider would both allow me to completely reset my credentials using solely a verification via SMS, so anyone who hijacked my phone number could steal from me. Even more obnoxiously, lots of businesses don't accept "VoIP" SMS numbers because they are deemed "insecure," even though my VoIP numbers are hardened behind much better account security than anything my mobile provider offers.
Hnrobert42 8y ago
A usability study prsented in a pdf that is quite difficult to read on mobile. Funny.
Adutude 8y ago
This article is good as far as UX goes. Myself, I love my Yubikey. I use it to store my ssh keys, then tunnel them using ssh-agent/gpg-agent, something along the lines of this article. https://www.bootc.net/archives/2013/06/09/my-perfect-gnupg-ssh-agent-setup/ https://www.bootc.net/archives/2013/06/09/my-perfect-gnupg-s... and this article https://wiki.gnupg.org/AgentForwarding https://wiki.gnupg.org/AgentForwarding. It's set up so that you have to have the key to get into the bastion host first, then you have to tunnel your key through the bastion to get to the other side. If you remove the key it breaks your connection. A good way to ssh w/out having your private keys sitting on a disk.

49 points by eaguyhn 8y ago

Title (original from TFA) is very misleading. The study is too late in the process of setting up 2FA. No one in the study was motivated to set up 2FA in the first place. This is "merely" a UX study that benefits Yubico. It doesn't address (at all) why people do or do not want 2FA in the first place. To use my own insight: regular joe does not want to buy an expensive product and install some hardware. (the "cheap" $20 ones are literally worse than useless. but even $20 is too much.) 2FA's future is in touchID (integrated into touch bar on mac) and push to a phone app. The latency of push to a phone app is more acceptable than the confusion and vagary around adding an expensive usb key that you don't understand and then doesn't work on your mobile anyway.

mvanbaak 8y ago
"then doesn't work on your mobile anyway." The yubikey neo works perfectly on your mobile, as long as it has NFC support.
- javagram 8y ago
  U2F through the yubikey doesn’t work on iOS devices because iOS NFC is only 1-way outside of Apple Pay.
  - jacquesm 8y ago
    I hate private APIs. There ought to be a law that vendors can only use public APIs.
- Tomte 8y ago
  So Apple is out, right?
  - DarkStar851 8y ago
    What? iPhone 6s and newer supports NFC.
    - gruez 8y ago
      6s supports NFC for EMV only. 8 and newer has generic NFC support. https://developer.apple.com/documentation/corenfc https://developer.apple.com/documentation/corenfc
      - devinl 8y ago
        The "generic NFC" support you refer to is read only which means that protocols like U2F still don't work so usability of U2F for iPhone users is still not there (without bluetooth keys which have their own problems).
      - dbb01 8y ago
        The neo NFC works with iPhones 7 and above
    - deleted 8y ago
      [deleted]
    - sofaofthedamned 8y ago
      Only for Apple Pay, which is another reason Apple are disingenuous when it comes to security.
- jiveturkey 8y ago
  i'm sure the neo is flying off the shelves at $50 ... it's awkward enough for desktop use that push to mobile is a superior UX
- m-p-3 8y ago
  Sadly my Xiaomi device doesn't..
techsupporter 8y ago
> the "cheap" $20 ones are literally worse than useless. How so? > 2FA's future is in touchID (integrated into touch bar on mac) and push to a phone app. As another person pointed out, this is quite literally what krypt.co's Krypton app does and it integrates with existing U2F/FIDO standards so either a hard or soft device can be used.
- StavrosK 8y ago
  Krypt.co looks pretty nice, I have a Yubikey and andOTP but I hate either getting up to fetch the hardware key or fumbling about for the right TOTP code, so the soft-approve by Krypton looks like the most convenient option, and reasonably secure, to boot.
- yayana 8y ago
  I find that quote odd too. I find the $10 USB-only ones useful, I just wish they had dual normal/micro USB like some flash sticks. I don't want Bluetooth, NFC or software u2f devices for security reasons, but I also think they could each have additional support problems if given to family members. The ideal option for me would be an applet on a smartcard in my phone's 2nd sim bay and a hard power toggle for the 2nd bay. Then I suppose my phone could also provide proxying of u2f as a USB device. But last I looked Android was blocking access to simcard slots for general purpose..
dijit 8y ago
What about krypt.co ?

throwawaymanbot 8y ago

Johnny does not want to use a physical FIDO U2F security key, because he regularly loses his phone and regular keys, and does not like to think about losing his entire digital life because he mislaid this FIDO U2F key.

Tomte 8y ago

Why I‘m using my three or four U2F keys rarely: almost nobody supports them. Yeah, Google, GitHub, Facebook. But my bank doesn‘t. My insurance companies don‘t. My broker doesn‘t. It‘s all very sad.

dijit 8y ago
Recently I tried adding U2F support to my chat bot. It was so complicated and I couldn’t find comprehensive documentation for it so I gave up. Admittedly, the chat bot is a hobby project so I was only looking for a couple of weeks in my spare time, maybe I “looked wrong” but everything I found was focusing on clients and rarely on servers.
- tialaramex 8y ago
  The MDN docs look adequate to me. You do need to go into this either understanding what's actually going on or open to just being told what to do rather than trying to plug it into a model you have from, say, using password authentication. Your code (typically JavaScript) running on the client is going to feed input from your server (getting it to the client is your problem, inline it in the HTML, read it from a WebSocket, whatever) into this API and get back a result. The result needs to go to server - again how you do this is up to you. The server verifies stuff, I guess that could be handled in a library or something, and then you've authenticated the user, done, set a session cookie or whatever.
techsupporter 8y ago
> But my bank doesn‘t. My insurance companies don‘t. My broker doesn‘t. It‘s all very sad. Disappointingly, my (former) bank, insurance, and broker companies only supported "2"FA via SMS, which is even worse--in my opinion--than not supporting anything at all because it gives a false sense of security. My bank and my mobile phone provider would both allow me to completely reset my credentials using solely a verification via SMS, so anyone who hijacked my phone number could steal from me. Even more obnoxiously, lots of businesses don't accept "VoIP" SMS numbers because they are deemed "insecure," even though my VoIP numbers are hardened behind much better account security than anything my mobile provider offers.

Hnrobert42 8y ago

A usability study prsented in a pdf that is quite difficult to read on mobile. Funny.

Adutude 8y ago

This article is good as far as UX goes. Myself, I love my Yubikey. I use it to store my ssh keys, then tunnel them using ssh-agent/gpg-agent, something along the lines of this article. https://www.bootc.net/archives/2013/06/09/my-perfect-gnupg-ssh-agent-setup/ https://www.bootc.net/archives/2013/06/09/my-perfect-gnupg-s... and this article https://wiki.gnupg.org/AgentForwarding https://wiki.gnupg.org/AgentForwarding. It's set up so that you have to have the key to get into the bastion host first, then you have to tunnel your key through the bastion to get to the other side. If you remove the key it breaks your connection. A good way to ssh w/out having your private keys sitting on a disk.