6 ms·
Can someone confirm, what is actual market coverage of U2F/Yubikey? I am reading about it for some time now and it looks to me that only few web pages and/or ap
by wst_ 8y ago
Can someone confirm, what is actual market coverage of U2F/Yubikey? I am reading about it for some time now and it looks to me that only few web pages and/or applications is actually supporting it. If that's only to get secure access to Google or GitHub then it seems an overkill to me. Am I missing something?
- blfr 8y agoYou can use a Yubikey with GPG and even SSH but the Google account is for many people by far the most important online asset, especially for Android users, so is it an overkill to spend a hundred bucks?
- bradfa 8y agoMy assessment matches yours, very few online account login systems support U2F. Heck, many don't even support using a TOTP or SMS second factor. But the real value is for the most critical logins, such as to Google, or similar, where a breach would be tremendously harmful to you.
- duality 8y agohttps://twofactorauth.org/ https://twofactorauth.org/ has a list of websites which support two-factor authentication, including using hard tokens.
- wst_ 8y agoThat's a great summary. Sadly, from what I see, hard key support is marginal.
- deleted 8y ago[deleted]
- Yizahi 8y agoThis is a nice site but people need to know that half of listed resources will only work in Chrome and its derivatives. Firefox does support U2F for example but Google, Facebook and others does not support U2F via FF on their resources. This situation is at least 1-2 year old and I suspect will keep like that for a long time.
- krn 8y agoWhat about other Chromium-based browsers such as Brave, Vivaldi, Opera?
- superdaniel 8y agoGoogle does support U2F on Firefox. Just not for registering the key.
- LaikaF 8y agoIt works with password managers like Lastpass.
- dmoy 8y agoU2F does not work with LastPass, sadly. Edit: here https://lastpass.com/support.php?cmd=showfaq&id=8126 https://lastpass.com/support.php?cmd=showfaq&id=8126 U2F works with dashlane I think?
- jotux 8y agoI got a yubikey a few weeks ago and enabled U2F wherever I could. You can also get yubico authenticator, which replaces google authenticator, but stores all your TOTP codes on the yubikey instead. I was always afraid of losing my phone with all my TOTP codes on it, since I wasn't very consistent about saving backup codes. Now all my TOTP codes are on two yubikeys and they are only visible if I swipe the key near my phone. tl;dr: You can use the yubikey to replace google authenticator wherever you're using standard TOTP codes.
- davchana 8y agoOne can also save the QR codes and or secret keys at enrollment in password managers for future proofing the totp auth codes against phone loss.
- ecesena 8y agoMy personal opinion: it's enough and you should recommend it on Google & Facebook, particularly to protect against phishing, and especially to non-tech people. Security keys are supported on Google and Facebook on (almost) all browser/devices. Almost means you still need to be a bit careful when you buy the key to check exactly the support, but you'll find the right combination that works for you. If you want some extra websites, you also have Twitter, Dropbox, Github, etc. This said, I personally wouldn't want to enable my security keys on too many websites, because loosing or breaking a key it's a major pain. I much prefer to use oauth and delegate authentication to Google or Facebook, and keep these two highly protected.