9 ms·

> For a general purpose website I doubt any more than 10% of people will ever get anything like a Yubikey I bought a bunch of Yubikeys and tried giving them aw

> For a general purpose website I doubt any more than 10% of people will ever get anything like a Yubikey I bought a bunch of Yubikeys and tried giving them away like candy to friends and family. I couldn't even give them away; people still weren't interested, including several developers (!). We'll never be able to save everyone, so my only wish now is that for the people who do care, everybody implements 2FA/WebAuthn properly and uniformly. Even that we're so far away from. Maybe eventually we'll get to some level of herd immunity, where >90% of accounts are 2FA protected, so trying to exploit them is a massive waste of time, and can be detected early.

JohnFen 8y ago
> I couldn't even give them away; people still weren't interested, including several developers (!). I'm a developer and I own a couple of Yubikeys that I picked up to play with the concept. I don't actually use them for real authentication, though. Now, I know that I'm a weirdo, but the reason I don't use them for real is because they're less convenient for me than just using unique, strong passwords.
- lisper 8y ago
  Also, you can lose a yubikey even more easily than you can lose a phone (because yubikeys are smaller and you typically use them less often).
  - scottlocklin 8y ago
    Don't you people use keys? Stick them on your keychain!
    - hombre_fatal 8y ago
      You need multiple yubikeys. The problem is that they don't use some sort of derived key concept to make syncing easy. You need them physically present to add them to new accounts. You can't just lock one away in the safety deposit box. So you'll probably just lose them both if you lose one. I'm not surprised nobody uses them. The only practical application I can think of is some sort of central authority configuration like a corporation where yubikeys are given to employees.
      - 8note 8y ago
        I've got one on my keys, and one stuck in the back of my monitor. sure, somebody could steal it, but I'm bit going to lose it
  - guitarbill 8y ago
    because printing out some recovery keys is so much hassle, or god forbid you have multiple 2fa methods like two keys and a TOTP authenticator app.
giobox 8y ago
I’m not convinced at all they are good for “normal” people yet. Google’s support is great, especially as securing your email often helps secure password reset links etc, but browser support is sorely lacking even now - you are more or less forced to use Chrome. It’s turned off by default in Firefox and doesn’t work at all in Safari. It does work by default in Edge for the 50 or so users who didn’t just use it to install a third party browser. Mobile browsers are even worse, despite the NFC support on the newer yubikeys. The technology appears fine, it’s the culture/industry norms that aren’t catching up. Until you can reliably and easily use it most places in most browsers it’s always going to be a niche solution for security geeks. I do think they have great potential in the workplace though, especially the nfc ones - the same yubikey could be used for both physical door access controls as well as online services like email etc. I experimented with requiring the yubikey to unlock my MacBook, but the risks are enormous, even with a spare yubikey. Lose the yubikeys and getting your personal data off a FileVault encrypted volume is going to be great fun I imagine...
stordoff 8y ago
> I bought a bunch of Yubikeys and tried giving them away like candy to friends and family. I couldn't even give them away; people still weren't interested, including several developers (!). My problem is what if I lose it. I know there are ways round it, but it's a layer of complexity passwords just _don't_ have. That's enough of a hurdle for me.
jonafato 8y ago
While I like my Yubikeys, they definitely aren't more convenient or intuitive for people who aren't accustomed to using multifactor authentication already. The webauthn spec [0] includes support for "biometric authenticators" and "platform authenticators" (e.g. the fingerprint readers with secure enclaves increasingly present on phones and laptops), and I think that has a real chance at improving authentication security across the board. Once Apple, Google, and the like start pushing "touch to login" via webauthn, people will come to expect that sort of convenience. And if all of your devices include these authenticators, adding a new device should be as simple as authenticating on one that hasn't been lost or stolen. [0]: https://www.w3.org/TR/2019/REC-webauthn-1-20190304/ https://www.w3.org/TR/2019/REC-webauthn-1-20190304/

JohnFen 8y ago

> I couldn't even give them away; people still weren't interested, including several developers (!). I'm a developer and I own a couple of Yubikeys that I picked up to play with the concept. I don't actually use them for real authentication, though. Now, I know that I'm a weirdo, but the reason I don't use them for real is because they're less convenient for me than just using unique, strong passwords.

lisper 8y ago
Also, you can lose a yubikey even more easily than you can lose a phone (because yubikeys are smaller and you typically use them less often).
- scottlocklin 8y ago
  Don't you people use keys? Stick them on your keychain!
  - hombre_fatal 8y ago
    You need multiple yubikeys. The problem is that they don't use some sort of derived key concept to make syncing easy. You need them physically present to add them to new accounts. You can't just lock one away in the safety deposit box. So you'll probably just lose them both if you lose one. I'm not surprised nobody uses them. The only practical application I can think of is some sort of central authority configuration like a corporation where yubikeys are given to employees.
    - 8note 8y ago
      I've got one on my keys, and one stuck in the back of my monitor. sure, somebody could steal it, but I'm bit going to lose it
- guitarbill 8y ago
  because printing out some recovery keys is so much hassle, or god forbid you have multiple 2fa methods like two keys and a TOTP authenticator app.

giobox 8y ago

I’m not convinced at all they are good for “normal” people yet. Google’s support is great, especially as securing your email often helps secure password reset links etc, but browser support is sorely lacking even now - you are more or less forced to use Chrome. It’s turned off by default in Firefox and doesn’t work at all in Safari. It does work by default in Edge for the 50 or so users who didn’t just use it to install a third party browser. Mobile browsers are even worse, despite the NFC support on the newer yubikeys. The technology appears fine, it’s the culture/industry norms that aren’t catching up. Until you can reliably and easily use it most places in most browsers it’s always going to be a niche solution for security geeks. I do think they have great potential in the workplace though, especially the nfc ones - the same yubikey could be used for both physical door access controls as well as online services like email etc. I experimented with requiring the yubikey to unlock my MacBook, but the risks are enormous, even with a spare yubikey. Lose the yubikeys and getting your personal data off a FileVault encrypted volume is going to be great fun I imagine...

stordoff 8y ago

> I bought a bunch of Yubikeys and tried giving them away like candy to friends and family. I couldn't even give them away; people still weren't interested, including several developers (!). My problem is what if I lose it. I know there are ways round it, but it's a layer of complexity passwords just _don't_ have. That's enough of a hurdle for me.

jonafato 8y ago

While I like my Yubikeys, they definitely aren't more convenient or intuitive for people who aren't accustomed to using multifactor authentication already. The webauthn spec [0] includes support for "biometric authenticators" and "platform authenticators" (e.g. the fingerprint readers with secure enclaves increasingly present on phones and laptops), and I think that has a real chance at improving authentication security across the board. Once Apple, Google, and the like start pushing "touch to login" via webauthn, people will come to expect that sort of convenience. And if all of your devices include these authenticators, adding a new device should be as simple as authenticating on one that hasn't been lost or stolen. [0]: https://www.w3.org/TR/2019/REC-webauthn-1-20190304/ https://www.w3.org/TR/2019/REC-webauthn-1-20190304/