4 ms·
I’ve always been fascinated by these, but never had a justifiable reason to get one. The only use I could think of was protecting my LastPass account, but I fi
by village-idiot 8y ago
I’ve always been fascinated by these, but never had a justifiable reason to get one.
The only use I could think of was protecting my LastPass account, but I figured my main risk there is their security getting breached, which Yubico wouldn’t help with.
- kasey_junk 8y agoGithub and google support u2f. If you are a gmail user you should get a u2f device to protect your email. That said the cheaper yubi do this as well. I use my yubi 4 for securing my ssh key as well though this is a) a pain & b) likely theater.
- village-idiot 8y agoI use an app based 2FA for that. Maybe I’ll look into a YubiKey though. My problem is that I’m halfway in my own personal transition from USB A to USB C
- martinwww 8y agoI wish you successful personal transition, why you skipped USB B ?
- village-idiot 8y agoBecause host machines don’t have USB B connectors, you typically only see them on hubs and printers.
- Latty 8y agoApp based 2FA is still more vulnerable to phishing than a U2F key, because it relies on the user to check they are entering the code into the right website. It's also faster and easier (no pulling out your phone, getting a code, typing it in, just touch the key). Plus, the keys have other features (GPG keys, etc...) which can be useful.
- village-idiot 8y agoAh, I didn’t know that u2F was even more phish-proof. Good to know!
- deleted 8y ago[deleted]
- fabian2k 8y agoI have one of the old blue U2F tokens (~20 EUR), and pretty much only used it for GMail so far. That alone is worth it to me because many other passwords can be reset by someone that gains control over my email account. I personally find the token much more convenient than a TOTP code via app on my smartphone. And the U2F/FIDO part is very interesting as it eliminates phishing as a risk. I ordered a Yubikey 5 NFC just now to play around especially with the NFC part and see if I can do something useful on my phone with that. I'm still looking for a password manager that could use an NFC Yubikey to unlock it on a smartphone.
- tP5n 8y ago> I'm still looking for a password manager that could use an NFC Yubikey to unlock it on a smartphone. AFAIK that's what lastpass+yubikeyneo (nfc) did, and what this should also be able to do.
- martinwww 8y agowell code which U2f token generate with the help of Google authenticator has ONLY 6 digits. 6 digits that's not extremely hard to brute force is that right ? If you are using additional backup u2f token (2 tokens in total) hacker has chance 1:500 000 to find out correct PIN is my assumption right ?
- tialaramex 8y agoYou seem confused. I think you're describing TOTP, but this whole thread is about FIDO. WebAuthn, U2F and similar FIDO based schemes are sending some public key signed blobs over the network. A PIN is purely a local protection, it's not sent over the wire. So a hacker can't just try guessing the PIN. First they need to steal your physical token, only then could they start guessing PINs for the stolen token.
- emlun 8y agoAnd even then, the token would lock itself down after too many incorrect PIN attemtpts.
- lvh 8y agoU2F keys make you basically immune to phishing.
- jiveturkey 8y agofor the 10 or so websites that use them
- lvh 8y agoThey tend to be the websites that matter a lot.
- ecesena 8y agoI just wrote a blog post about "Why FIDO2": [1]. Would love to hear if the messages resonate with you. [1] https://medium.com/@0x0ece/why-choosing-a-fido2-security-key-8cb0e5a1a71e https://medium.com/@0x0ece/why-choosing-a-fido2-security-key...