3 ms·

At a price tag of $30, you're better off buying a U2F hardware key such as a Solo[0], a YubiKey, or Google's Titan. TOTP is still vulnerable to phishing attack

At a price tag of $30, you're better off buying a U2F hardware key such as a Solo[0], a YubiKey, or Google's Titan. TOTP is still vulnerable to phishing attacks and MitM, while U2F machine-verifies the application ID, thus making phishing impossible (unless the phishing site tricks the user into using a non-U2F backup method for 2FA.) The downside is limited adoption, such as no support from Safari, and no support on most websites today. But I expect U2F to have a bright future ahead. [0]: https://shop.solokeys.com/ https://shop.solokeys.com/

yangl1996 7y ago
Webkit's webauthn support is in development [0]. Hopefully the adoption will improve a lot once all major browsers support it. [0]: https://bugs.webkit.org/show_bug.cgi?id=181943 https://bugs.webkit.org/show_bug.cgi?id=181943
- StavrosK 7y ago
  WebAuthn can't get here soon enough. I am really really looking forward to it.
- icebraining 7y ago
  What's the user story for mobile browsers? Other than having a key hanging off an OTG adapter, how can we secure a login made over a phone or tablet?
  - kitotik 7y ago
    There are NFC capable yubikeys, but I think in general the Secure Enclave of the phone itself is used to store auth creds.
  - Freak_NL 7y ago
    WebAuthn can use the TPM chip in smartphones. It works the same as a discrete hardware WebAuthn token: the key material is generated on the chip, and never leaves it. The smartphone OS can't access the key on the TPM either, only use it cryptographically to prove possession of the key. You can test it right now with any recent Android smartphone with TPM chip: https://webauthn.io/ https://webauthn.io/ Apple will eventually join the club too once they stop dragging their feet. Of course with the TPM you effectively have a hardware token permantently physically linked to your smartphone, so it changes the security analysis a bit. For users this means that WebAuthn for accessing websites on a TPM-capable smartphone is really just a matter of unlocking the device when prompted. Quite user friendly.
icebraining 7y ago
OTOH, an advantage of TOTP is that it can be used without plugging in stuff, so it works on machines that don't let you access the USB ports, or that don't have them at all.
dmix 7y ago
Is Solo better than Yubikey in any way? Edit: looks like solo has a USB-C + NFC option that seems to be missing from Yubikey's selection. Edit 2: Same with Feitian which also only has USB-A for the NFC product...

yangl1996 7y ago

Webkit's webauthn support is in development [0]. Hopefully the adoption will improve a lot once all major browsers support it. [0]: https://bugs.webkit.org/show_bug.cgi?id=181943 https://bugs.webkit.org/show_bug.cgi?id=181943

StavrosK 7y ago
WebAuthn can't get here soon enough. I am really really looking forward to it.
icebraining 7y ago
What's the user story for mobile browsers? Other than having a key hanging off an OTG adapter, how can we secure a login made over a phone or tablet?
- kitotik 7y ago
  There are NFC capable yubikeys, but I think in general the Secure Enclave of the phone itself is used to store auth creds.
- Freak_NL 7y ago
  WebAuthn can use the TPM chip in smartphones. It works the same as a discrete hardware WebAuthn token: the key material is generated on the chip, and never leaves it. The smartphone OS can't access the key on the TPM either, only use it cryptographically to prove possession of the key. You can test it right now with any recent Android smartphone with TPM chip: https://webauthn.io/ https://webauthn.io/ Apple will eventually join the club too once they stop dragging their feet. Of course with the TPM you effectively have a hardware token permantently physically linked to your smartphone, so it changes the security analysis a bit. For users this means that WebAuthn for accessing websites on a TPM-capable smartphone is really just a matter of unlocking the device when prompted. Quite user friendly.

icebraining 7y ago

OTOH, an advantage of TOTP is that it can be used without plugging in stuff, so it works on machines that don't let you access the USB ports, or that don't have them at all.

dmix 7y ago

Is Solo better than Yubikey in any way? Edit: looks like solo has a USB-C + NFC option that seems to be missing from Yubikey's selection. Edit 2: Same with Feitian which also only has USB-A for the NFC product...