14 ms·
Beyond Passwords: 2FA, U2F and Google Advanced Protection
- whitepoplar 8y agoDoes anyone know if Smart Lock for iOS works with the new Yubikey 5 NFC, or is it still necessary to use the Feitian Bluetooth device?
- BillinghamJ 8y agoSmart Lock on iOS does not support NFC currently. BLE only.
- daniel-s 8y agoWhy is SQRL [1] not more popular? [1] https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm
- cm2187 8y agoReference source in assembly, sponsor not particularly popular or known in the silicon valley. It's a pity because I think the concept is really smart and practical. I would not run it on a windows machine though.
- mtgx 8y agoI assume it could be implemented on a secure USB stick for key storage, too.
- botto 8y agoI think Steve mentioned Yubikey was looking at implementing SQRL once it was complete
- groovybits 8y agoNot sure about Silicon Valley, but Steve Gibson is well known in the security community. He has been working on this for years now, and has had beta testers for the past year I believe. SQRL (as a whole deliverable package) is not finished yet though.
- tialaramex 8y agoIt ends up with the same gap as the TOTP approaches. The user is _supposed_ to verify that this is goodguy.example, their bank's site. But they don't. Humans are very, very bad at spotting that a routine course of events didn't happen. If the human doesn't do this apparently pointless busywork, their security is secretly destroyed. If you ignore the fact that the SQRL says "goodguy.example" but the phishing site you're on says "badguy.example" then you authorise the bad guys to log into your bank account. Oops. In WebAuthn and U2F this doesn't work because the web browser was brought in to the party. "This" says the browser, "is badguy.example", and the user isn't asked to do any busywork with a risk of getting themselves in trouble. The bad guys get nowhere. Railway example: Train drivers do the same routes over, and over, and over. They get used to things that they know intellectually are just patterns, routines, not set down anywhere as facts. Hypothetical example: maybe at Oakwood junction on the Down Fast with the Express you always get a Caution, never Clear or Danger, if you're on time, because the signaller is moving a local out of your way ahead. Without any computer assistance, drivers, despite being trained about this specific problem, will look at a signal showing Danger at Oakwood junction on the Down Fast, and their brain says "No, this is always Caution" and _even though they saw a Danger signal_ and even though they are trained that if they aren't sure they must treat signals as "Danger" - they act as though it was definitely Caution. With a computer helping, the driver can be "shaken" out of this mistake, for example the computer can sound an audible alarm that the train seems not to be slowing appropriately, and then since this alarm doesn't normally sound, the driver may go "Wait, was that Caution? Actually I think it was Danger! Oops" and brake. But we must be cautious with such aids, most of the British railways have a system that sounds a horn each time you're shown a signal that is NOT Clear. The driver acknowledges the horn, or if they do not the train autonomously brakes to a halt. But both "Caution" and "Danger" are not Clear, at our hypothetical Oakwood junction the driver would get used to hearing the horn, because the signal says "Caution", except today it is "Danger" ...
- botto 8y agoI mean SQRL does help with the fact that if you scan the login of a bad site that is portraying as a good guy then you log in with different credentials as the site url is embedded in the QR login image. If your talking about iframing goodguys website inside of badguy website, then yes this is an issue that goodguy should not allow iframing of their login page.
- groovybits 8y agoSQRL is not finished yet. Steve has said he will do an SN episode on it when its finished, soon(tm).
- stock_toaster 8y agoReally hope apple adds u2f (native/safari) support at some point in the nearish future.
- arkh 8y agoI'd like to see another article showing the steps to go through if you lose your keys.
- avn2109 8y agoYeah. That is the million dollar question.
- fyfy18 8y agoThis is my biggest concern about 2FA. On Google I have TOTP 2FA enabled, with my phone number as a backup. But everything goes through my phone - I'm not really worried about some stealing my phone to gain access, but what happens if I break or lose my phone. A few years ago I was travelling abroad and had my suitcase stolen - which had my laptop (with FDE) and passport inside. Fortunately I had my phone and wallet on me, otherwise I really don't know what I would have done - I probably wouldn't even have remembered the name of the hotel I was staying at that night.
- andyjohnson0 8y agoGoogle allows you to print a set of codes [1] that can be used to access your account if your device is lost. I printed a set and have them stored in a secure place at home. Some people keep them in their wallet/bag/similar. [1] https://support.google.com/accounts/answer/1187538 https://support.google.com/accounts/answer/1187538
- michaelt 8y agoAccording to [1] Advanced Protection uses a stricter implementation than Google has offered in the past: Only those physical keys—along with a password—will unlock your account. If you lose them, you can't use a printed out backup code So, no printed backup codes for Advanced Protection users!
- andyjohnson0 8y ago(Presumably your [1] reference is this: https://www.wired.com/story/google-advanced-protection-locks-down-accounts/ https://www.wired.com/story/google-advanced-protection-locks... ) Good point, although I think the parent comment was about Google's existing 2FA rather than the new advanced protection setting.
- limpkin 8y agoI wonder if he'll do an article on webauthn... that seems fairly promising as well!
- WorldMaker 8y agoWebAuthn is the spec that enables U2F tokens in browsers. When he adds the keys to his account in Chrome, and when he logs into Gmail on Chrome, that's all utilizing WebAuthn in the background as a technical detail.
- borplk 8y agoDoes anyone know if Google allows registering more than 2 keys? Like what if i want to register 3 or 4 keys for advanced protection?
- chimeracoder 8y ago> Does anyone know if Google allows registering more than 2 keys? Like what if i want to register 3 or 4 keys for advanced protection? Most sites do. Google and Github both allow multiple U2F keys (note that this means any key can be used to unlock your account, not that all are required). Of all the large and popular sites that support U2F, the only one that I'm aware of that only allows one key is Twitter.
- mimming 8y agoYes google does. The spec strongly encourages providers to allow multiple keys, and allow you to nickname them. As far as I know everyone allows as many keys as you like except Vanguard and Amazon AWS (which both also only accept Yubico keys)
- theli0nheart 8y agoYep, they do. I’ve registered 6 without a problem.
- blfr 8y agoSix seems like a lot. Why do you need so many?
- theli0nheart 8y agoIt’s cheap insurance against getting locked out of my Google account forever.
- blfr 8y agoSure but you're diluting the second factor. The more tokens you have, the easier it is to get one and without you noticing.
- xaduha 8y agoI wish that SmartCards were used more for this purpose https://github.com/OpenSC/OpenSC/wiki https://github.com/OpenSC/OpenSC/wiki There's an applet you can load into your own JavaCard presumably https://github.com/LedgerHQ/ledger-u2f-javacard https://github.com/LedgerHQ/ledger-u2f-javacard
- IloveHN84 8y agoThey died when everybody ditched Java applets for web. I wish they were more useful and programmable without a Java applet (eg. Custom C/C++ driver)
- xaduha 8y agoSmartcards aren't dead, they are all around us in sim cards and credit cards. > They died when everybody ditched Java applets for web. How's that relevant? Are you saying no one uses Java anymore?
- Technetium_Hat 8y agoMany smart cards use an extremely minimal version of java, so I imagine that java applets were able to interact with them more easily.
- xaduha 8y agoI'm not saying that writing for Javacards is easy, but that's not the problem here. There is plenty of software written already https://github.com/EnigmaBridge/javacard-curated-list https://github.com/EnigmaBridge/javacard-curated-list It's just didn't catch on, there's no thriving community around it. You have the software, you have the hardware (search for JCOP21 or JCOP3 on Aliexpress), but no users.
- IloveHN84 8y agoWell, Java for frontend / client side not anymore, since Java applets are insecure and can be exploited easily.
- timvdalen 8y agoAm I correct in seeing that U2F can't be enabled for G-Suite accounts yet? I can't find the setting in the Admin panel.
- tptacek 8y agoNo, you can definitely enroll U2F keys in GSuite accounts.
- seanhunter 8y agoYup. To the extent I use gsuite, I use it with a yubikey for authentication.
- mimming 8y agoGenerally yes, but the admin has the power to either enforce it (for some or all users) or disable it domain wide. If you were to create a new GSuite domain today, it'd be allowed for all users.
- BillinghamJ 8y agoU2F can, but the Advanced Protection program can't currently.
- rocqua 8y agofrom https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ : I’m interested in Advanced Protection for my work account - Can I enroll a G Suite Account in Advanced Protection? With the help of your Administrator, it’s possible to replicate the features of Advanced Protection on a G Suite account. Take a look at this help center article to get started. the help center link: https://support.google.com/a/answer/9010419 https://support.google.com/a/answer/9010419
- tialaramex 8y agoAdvanced Protection changes your relationship with the administrators (Google). But for GSuite the administrators are some other member of your organisation, so Google can't make a web page that changes that relationship. If your company decides that the New York employee named "Steve Smith" and the London employee "Stephen Smith" are the same person, and either should be able to request account password reset for steve.smith@company.example, both of these chaps are going to have a bad time. Google can _tell_ them this is a terrible idea, but GSuite is a company product, so ultimately it's their terrible idea if that's what they want to do. The _technical_ features of Advanced Protection seem to be mostly: Use FIDO Security Keys (U2F/ WebAuthn), disable stuff we know is useful but insecure. You can opt into those technical changes for your GSuite, either for everybody or a selected group e.g. "Company Security Nerds" or "Executive Level Employees" or "Everybody except Pamela. Damn it Pamela". But the non-technical feature is hard and probably just not replicable at all.
- superzamp 8y ago> The value proposition of a U2F device like the YubiKey is that not only must you have it present, it's not subject to the TOTP being disclosed like with tokens that require the user to enter a password into a third-party service which could still be a phishing page Could someone shed some light on this? What is it that prevents a phising page from basically proxying the crypto challenge from the website to your key and present your answer back?
- mimming 8y agoEssentially it borrows the protections from TLS. Here's a link to the relevant part of the spec: https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fido-u2f-overview-v1.2-ps-20170411.html#man-in-the-middle-protections-during-authentication https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fid... (Sorry if this comes across as RTFM, but I figured the source is better than my attempt at explaining)
- superzamp 8y agoNot at all, the specification is indeed very clear. Thanks for the link!
- Boulth 8y agoChannel ID has been depreciated and replaced by Token Binding but I'm sure U2F sites don't use either. The real protection is quite simple: incorporating the origin (domain name) in the protocol. So phishers would get a bad response from the token.
- BillinghamJ 8y agoThe origin of the page is part of the signed payload. So if another website presented the challenge, the origin part wouldn't match. That does assume the thing communicating with the security key is not compromised though (the browser/OS). Not entirely sure about how Google Smart Lock on iOS works in this regard - since it communicates over BLE and could specify any origin, and then the process of going between the app/web on iOS can't be secured particularly well. Also unclear how origins would work with regards to non-web applications. e.g. URL schemes aren't unique/owned/defendable.
- IloveHN84 8y agoToo bad someone has to use only Chrome for U2F access. I wish Firefox was able to handle it in the same.way of Chrome's way. Not even Chromium can work with it, at least not on Linux.
- polack 8y agoYou can enable u2f in Firefox if you go to about:config and toggle the security.webauth.u2f property. Been using it for a couple of months and it's working great.
- StavrosK 8y agoI can confirm that. I've been using Krypton for my second factor because of the added convenience and Firefox has had zero issues. I can't wait for WebAuthn.
- akavel 8y agoDid you register it on Google via Firefox too? (The first time?) For me, Google complains "must use Chrome" even though I have the u2f in about:config enabled, and it works on other sites. I read somewhere it works via Fx for login later, but for 1st registration step, they still seem to require Chrome :(
- StavrosK 8y agoI think I did? I remember registering for a site in Chrome, though, but I don't remember which one that was. It's terrible that they detect browsers instead of functionality.
- acdha 8y agoI’ve been using it for at least a year and the only problem was way back when Google had a hard-coded user agent check.
- akavel 8y agoI tried that this week, and Google still complains that "you must use Chrome" when I tried to register it. The Yubikey works OK on other pages, also with u2f (e.g. gitlab & github). I read somewhere that one can do the registration on Chrome once and later use Firefox to login. But I don't want to install Chrome even once, that's why I am using Fx in the first place!... :(
- xkgt 8y agoAmidst all the potential ways in which even 2FA can be compromised, I am surprised no one is mentioning the biggest benefit of using 2FA- the ephemeral nature of 2nd password. Not only it protects against misuse of stolen credentials, but it also allows to centrally disable the 2nd password should any leak occur. Is this one of the stated goals of 2FA design? In my view, this makes 2FA an essential security feature, not just a nice improvement over 1FA.
- _pdp_ 8y agoClearly an improvement but let's face it - once you loose/break the keys you will have to go through an extensive verification process (up to 3 days according to google) and there is no guarantee you will pass that stage either. Let's be mindful that more security is at the expense of less accessibility and in some places this is simply not going to cut it.
- zaarn 8y agoGenerally having backup keys is recommended so you don't have this single point of failure.
- _pdp_ 8y agoYour backup key is the second hardware token. You don't have any other backup keys :)
- zaarn 8y agoYou can have more than two hardware tokens on your account, the lowest limit I've ever seen is 5. If you break 5 keys at once, I think having to go through some verification is warranted.
- _pdp_ 8y agoSure. That will be the case in extreme circumstances like your tokens for the AWS root account, etc. The average consumer will have only two at best.
- zaarn 8y agoBut how likely is it that they loose two keys at once, especially since one is basically made to be part of the keychain...
- cjcampbell 8y ago
- gomox 8y agoFor some reason Google Smart Lock doesn't allow you to use a U2F Yubikey as a backup to the phone-based prompt. Seems totally absurd as a Yubikey is the perfect backup to a lost phone. Also did I mention that if you use 2FA, Google's "find my phone" functionality asks you to use your phone to authorize the login before you can find it? Yes. You heard that right. Use your phone to find your phone. Don't ask me how I know.
- CDSlice 8y agoWell, presumably you are using 2FA because you don't want anyone that stole your password to be able to access your account, so do you really want anybody with access to your password to track your location?
- e40 8y agoIsn't the that, in the lost phone case, you can never answer that query?
- tialaramex 8y agoGoogle prompts you (maybe even requires) to enable at least two distinct ways to get in. Now, of course it's possible you've tied both of those to your phone, but I put it to you that this makes it your fault. If my other method works, even if it's a huge pain (e.g. maybe my other FIDO key is at home and I've flown to Tokyo) then I do still have options. Maybe not options I _love_ but that's security for you. If you have a massive house fire that both destroys your bank documents and leaves you so badly burned you can hardly talk let alone sign your name, good luck the first time you try to withdraw cash from that bank account. If you set Advanced Protection both distinct ways have to be FIDO Security Keys, and whilst it's conceivable you could own a phone that functions as _one_ FIDO key (I would expect Apple to do this for example) it doesn't make any sense to have a single phone serving as _both_ your keys, even a non-technical person can hopefully spot that.
- gomox 8y agoEven though my intuition is that the lousy product manager who made that decision did it because of this reasoning, I would venture that 99.999% of the people prefer to find their phone when they lose it than having this guarantee by default. If someone has my password and is trying to track me down, all you have to do is let me know that this is happening with a notification on my phone so I can rapidly change my password by using the device I am holding in my hand. If you are the kind of person where this small time window of physical location disclosure is a significant vulnerability, you shouldn't carry a Google-manufactured phone without putting it in an RF-proof bag anyway.
- Tepix 8y agoFIDO U2F has a great anti phishing mechanism by incorporating the hostname. However: It's too difficult to setup FIDO U2F for your own webserver. There is still no Apache module or nginx plugin that allows you to protect a directory of your document root. Also U2F is not available for PHPBB. There is a plugin that appears to be unfinished and buggy since 2015.
- afrodc_ 8y agoUsing an OpenID connect provider with one of Hans Zandbelt's plugins for Apache (mod_auth_openidc) or Nginx (lua-resty-openidc) would give you centralized authentication which could use U2F or any other supported 2FA mechanism.
- chusk3 8y agoI can echo this comment. Protecting websites with lua-resty-openidc was very easy and required no changes to the actual application code.
- jillesvangurp 8y agoWe implemented 2FA on our logins in the past year. I'm also looking at implementing U2F. We'll probably add this once there is enough of a user base. IMHO the UX for all this stuff is very confusing to non technical users. People lose their phones, don't print out the codes, or simply don't understand how this works and do silly things like trying to use codes from the wrong account. Since introducing 2FA , requests of people to reset their 2fa are a very regular thing for our support people. Especially when it concerns paying users, saying no is not really an option. So, resets are a common thing. I've since educated our people to at least not do this blindly but obviously, social engineering is a big problem with all this stuff. If this happens to us, you can bet it is an extremely regular thing for basically everything that has 2fa. But my biggest worry with this stuff on my own accounts is somebody talking support into resetting 2FA on my accounts. I can do everything right and still get compromised because some underpayed support contractor falls for some social engineering hack.
- y4mi 8y agoat least you'll be notified about the compromise, as surely everyone that resets the u2f will get notifications through all available channels, right?
- yorwba 8y agoNot if those channels require U2F to access them.
- mikepurvis 8y agoBut that's only really a concern for your email provider, right? Like, as long as I know that resetting my login on service X will trigger an email, then I'm okay with it. And if you're the email provider, you probably already have my phone number anyway and could/should send a text message to notify me about anything like this.
- PyroLagus 8y agoIt would be great if sites had an option to remove reset support for your account permanently. One that is literally impossible to reset. But I'm not sure how to do that without implementing complete user data encryption.
- theli0nheart 8y agoI went through the Google Advanced Protection setup a few weeks ago. My only advice is that if you use Android, download the Smart Lock app before enabling Advanced Protection. If you don’t, you’ll get signed out of your Google account on your phone without a way to log back in (the Play Store won’t work without a linked Google account). If you make this mistake, you need to then disable Advanced Protection, re-login to your phone, then download the Smart Lock app, and THEN re-enable Advanced Protection to get things working. Otherwise you’ll be locked out of your phone.
- anilakar 8y agoI've been looking for a new Android phone for a while now, and my primary selection criterion has become NFC because advanced account protection uses U2F over it. It's frustrating when otherwise decent products are unusable due to the lack of a common feature.
- blfr 8y agoI carefully chose a phone supporting NFC as well. But then installed LineageOS and, as it turns out, it now does not pass Google's SafetyNet test and Google Pay refuses to work. Does the phone need to pass SafetyNet to use a Yubikey over NFC with it?
- yolo1897 8y agoit work fine just use magisk to pass safety net and in Hide panel check google pay. i'm using it everyday
- izacus 8y agoNew Pixels now have the hardware built-in so you don't need a separate Yubikey anymore.
- ecesena 8y agoU2F also works over usb on Android. Not sure it's very usable, but it works.
- wst_ 8y agoCan someone confirm, what is actual market coverage of U2F/Yubikey? I am reading about it for some time now and it looks to me that only few web pages and/or applications is actually supporting it. If that's only to get secure access to Google or GitHub then it seems an overkill to me. Am I missing something?
- blfr 8y agoYou can use a Yubikey with GPG and even SSH but the Google account is for many people by far the most important online asset, especially for Android users, so is it an overkill to spend a hundred bucks?
- bradfa 8y agoMy assessment matches yours, very few online account login systems support U2F. Heck, many don't even support using a TOTP or SMS second factor. But the real value is for the most critical logins, such as to Google, or similar, where a breach would be tremendously harmful to you.
- duality 8y agohttps://twofactorauth.org/ https://twofactorauth.org/ has a list of websites which support two-factor authentication, including using hard tokens.
- wst_ 8y agoThat's a great summary. Sadly, from what I see, hard key support is marginal.
- deleted 8y ago[deleted]
- Yizahi 8y agoThis is a nice site but people need to know that half of listed resources will only work in Chrome and its derivatives. Firefox does support U2F for example but Google, Facebook and others does not support U2F via FF on their resources. This situation is at least 1-2 year old and I suspect will keep like that for a long time.
- mkagenius 8y ago> Password and SMS I see no mention of SS7 attacks, is that a solved problem?
- ptman 8y ago"SIM porting"
- mkagenius 8y agoHow will SIM porting help in such attacks?
- ggm 8y agoIt doesn't help: it exemplifies the full scale of the problem which is bigger than ss7. SIM porting attack is social-engineering. You don't even need to "fix" ss7 to port out of some carriers, because humans are in the loop to do it for you because tears on the phone.
- czbond 8y agoHas anyone seen external reported audits of code & hardware for keys like Yubikey, Google Titan?
- thefounder 8y agoThis is complicated(even for developers) and requires additional devices. People hate extra devices. Verdict: fail!
- megous 8y ago$20 for one in a bundle? Why is it so expensive? I get a 4-core 1.3GHz 1GB RAM SBC I can run desktop and all the crypto in the world on, incl. shipping from China for less than the price of a single U2F knob. I'd pay $2-3 max per piece. Especially since you need more than a few in order not to cause yourself more trouble than this is worth (to someone who already uses random unique passwords and emails for services).
- yayana 8y agoThe goal is really nonclonable key storage with a minimal CPU and purpose specific firmware, i.e. a sim card. The USB u2fs are about $10 which is pretty reasonable for a newish card with ECC algorithms.
- megous 8y agoWhy is it a goal though? I don't care. U2F to me is useful for protecting from stolen credentials on the web. These attackers will never have physical access to my u2f device to clone it. If you fear people getting physical access to your u2f, they can simply use it if they also know the password. No need for cloning. And if they don't know the password, it's still useless. From that attacker's perspective, your security was reduced to password only. Which is still good, if you take care of your passwords.
- deleted 8y ago[deleted]
- stcredzero 8y agoHere's what I'd like to see in a 2FA "something you have" device: You could just leave it in your pocket, and you wouldn't have to interact with it. It would also unlock your computer when you sit down at your desk and lock it when you leave.
- satysin 8y agoYou mean like an Apple Watch does with a macOS machine?
- stcredzero 8y agoAn app that would turn an Apple Watch into a U2F 2FA device would be great. It would also need to work as such a device for logins to Google and AWS.
- tim333 8y agoI wonder if you could do that with your phone via bluetooth? I mean most people have bluetooth capable phones on them and I can already connect to mine by clicking an icon on the computer.
- stcredzero 8y agoI'd prefer to have a really small device, like something I'd leave on a physical keychain. I don't always take my phone with me when I step away from the desk.
- technion 8y agoIt continues to be an annoyance that we have this great technology in the form of U2F, but Office365/Azure (where troyhunt.com's MX records currently point by the way) doesn't support it. In fact their UX still strongly pushes you towards SMS if you don't know where to look.
- zeveb 8y ago> Now, hopefully the problem here is already self-evident but let's just be crystal clear anyway: adding a second step to authentication should not be seen as an excuse to weaken the first step. I'm hesitant to call this guy's approach 2FA (if it's true MFA at all), it's more like 1.5FA or something thereabouts. The point is, use the approaches above as additional security controls, not as an excuse to weaken existing ones! Well, right now I use passwords of the form j6lqPKQKQ1RHv87PES4iy5; it'd be nice if using U2F meant that I could securely switch to something like 'correct horse battery staple' instead …