3 ms·

I agree that it's a more salient point IMO. Smartphone based authenticator are not exactly difficult to understand, at least from a user's perspective. You ente

by simias 8y ago

I agree that it's a more salient point IMO. Smartphone based authenticator are not exactly difficult to understand, at least from a user's perspective. You enter your username, you get a prompt on your password, you're done. Yubikeys are not difficult either. You enter your username, you focus the password field and you press the button. There, you're done. If anything it's easier and more convenient than a password. Passwords are just the lowest common denominator. Everybody can memorize a character string, not everybody has a smartphone or yubikey with them at all times.

AstralStorm 8y ago
The second way is to use one time pads in addition to passwords. Who needs a smartphone when you can use a piece of paper. Mind you this can be copied so has a similar vulnerability to passwords. But since it can be generated you can think of it as a salted password when combined with a classic one. And then we use the final way of authentication, hard to forge personal documents, government issued... often in poor ways. Computer systems cannot be truly fully trusted. Final security always depends on the human operators and equivalent human impersonators. A skilled social engineer can even convince your friends the account is dead. They can call the delivery company or even initiate the procedure to reissue documents or destroy keys. They can phish and scam you which is even easier.
Sean1708 8y ago
> You enter your username, you focus the password field and you press the button. How much set up does it take to get to that point though? Usability at point of use is great but setting something up is usually far more difficult than actually using it.
- beatgammit 8y ago
  They provide software that you install to configure your device. I haven't used it personally (my Neo 5 is being delivered), but they've done a pretty good job of making it easy. The biggest problems are: - limited selection of sites that support U2F - U2F is off by default in Firefox (it's a little buggy apparently) - somewhat expensive ($45 for Yubikey Neo) Those are getting better, and I think the Yubikey can be used OOTB (you just enable it on an existing login to prove you own it). I'll be regenerating keys, but most users probably won't bother.
  - tialaramex 8y ago
    U2F is a legacy feature. New sites should deploy WebAuthn and existing sites should migrate, the Firefox pref override is for those remaining legacy sites. It basically bodges their WebAuthn implementation to offer a passable imitation of U2F. I don't know if a Neo can replace the secret key that makes FIDO (and thus U2F/WebAuthn) work but doing so seems pointless. If bad guys tampered with it, they presumably neutered this feature; whereas if not it's fine out of the box. Certainly Yubico's cheaper FIDO2-only product offers no way to regenerate the secret. Nobody today deploys WebAuthn to replace passwords, only as a second factor so it doesn't really undermine Troy's point, though perhaps our other countermeasures (long complicated passwords for every site, changed frequently) are less necessary if you have a good second factor like this.

by simias 8y ago

AstralStorm 8y ago

The second way is to use one time pads in addition to passwords. Who needs a smartphone when you can use a piece of paper. Mind you this can be copied so has a similar vulnerability to passwords. But since it can be generated you can think of it as a salted password when combined with a classic one. And then we use the final way of authentication, hard to forge personal documents, government issued... often in poor ways. Computer systems cannot be truly fully trusted. Final security always depends on the human operators and equivalent human impersonators. A skilled social engineer can even convince your friends the account is dead. They can call the delivery company or even initiate the procedure to reissue documents or destroy keys. They can phish and scam you which is even easier.

Sean1708 8y ago

> You enter your username, you focus the password field and you press the button. How much set up does it take to get to that point though? Usability at point of use is great but setting something up is usually far more difficult than actually using it.

beatgammit 8y ago
They provide software that you install to configure your device. I haven't used it personally (my Neo 5 is being delivered), but they've done a pretty good job of making it easy. The biggest problems are: - limited selection of sites that support U2F - U2F is off by default in Firefox (it's a little buggy apparently) - somewhat expensive ($45 for Yubikey Neo) Those are getting better, and I think the Yubikey can be used OOTB (you just enable it on an existing login to prove you own it). I'll be regenerating keys, but most users probably won't bother.
- tialaramex 8y ago
  U2F is a legacy feature. New sites should deploy WebAuthn and existing sites should migrate, the Firefox pref override is for those remaining legacy sites. It basically bodges their WebAuthn implementation to offer a passable imitation of U2F. I don't know if a Neo can replace the secret key that makes FIDO (and thus U2F/WebAuthn) work but doing so seems pointless. If bad guys tampered with it, they presumably neutered this feature; whereas if not it's fine out of the box. Certainly Yubico's cheaper FIDO2-only product offers no way to regenerate the secret. Nobody today deploys WebAuthn to replace passwords, only as a second factor so it doesn't really undermine Troy's point, though perhaps our other countermeasures (long complicated passwords for every site, changed frequently) are less necessary if you have a good second factor like this.