3 ms·
What are these keys used for? Is it for 2FA? I would love to use my phone for 2FA, and not have to carry an usb device with me, because - I often log in to web
by y0ghur7_xxx 8y ago
What are these keys used for? Is it for 2FA? I would love to use my phone for 2FA, and not have to carry an usb device with me, because
- I often log in to web services on my phone, and I don't have an usb adapter cable with me to use the key, and
- because having to carry a device always with me sounds cumbersome. My phone is always with me anyways.
Is there some other use case I am overlooking? I am eagerly awaiting browser vendors to implement these use cases: https://w3c.github.io/webauthn/#use-cases https://w3c.github.io/webauthn/#use-cases
- confounded 8y agoYou could still use the TOTP Heads validation method with a phone (currently how it works on Librem laptops with a TPM).
- jonotime 8y agoI agree. I would rather use my phone then a separate hardware device especially since I use a lot of computers. I might look into something like this https://krypt.co/ https://krypt.co/
- cal5k 8y agoTOTP/HOTP can still be sort of trivially MITM'd - a phishing form could ask for your auth code and then turn around and supply it to the site in question. U2F uses a challenge-response protocol that should (in theory) make it impossible to MITM. Google has said that they have had zero successful phishing attacks since they switched to using U2F devices (I think Yubikeys) for all employees.