4 ms·

U2F keys are great but I look forward to the day when they’re more widely available outside the US. And I’m still waiting for my replacement from Feitian for th

U2F keys are great but I look forward to the day when they’re more widely available outside the US. And I’m still waiting for my replacement from Feitian for the recent vulnerability. Not to say you shouldn’t use them, but... they have their limits. Particularly Advanced Protection which forces you to use Google’s browser in many situations and disables API access so I can’t use the API to get my own data, only Google’s official apps and a small exception for Apple’s.

jchw 7y ago
Yeah, Chromium is needed to add keys, which effectively means you can’t enable Advanced Protection without Chromium. I personally ran into this wall. I acknowledge that this sucks, as a person that intentionally only uses Firefox, but to be clear logging in and most other operations work absolutely fine with Advanced Protection. Does it really disable all API access? I thought it only blocked certain OAuth scopes, but to be honest I haven’t really tried. I was able to login to a NVIDIA Shield, but only by resetting and bootstrapping off a spare Android device (!!!) because U2F keys are broken on Shield. Interestingly, my Samsung TV remains signed into Youtube, which is kind of odd now that I think about it.
- mrkstu 7y ago
  Youtube/YoutubeTV seem to be walled off on 2nd factor auth. I've been able to log into both on browsers w/o 2nd factor and then get prompted when logging into web gmail.
- archi42 7y ago
  Seems like Firefox U2F is just disabled by default: https://www.yubico.com/2017/11/how-to-navigate-fido-u2f-in-firefox-quantum/ https://www.yubico.com/2017/11/how-to-navigate-fido-u2f-in-f... (tl;dr: Open about:config, search for u2f, enable) With that done, GitHub prompts me for my key. My Linux office workstation is missing the necessary udev rule, so I couldn't test more. (Funnily, pressing Cancel caused them to send me a SMS, so their 2FA is practically worthless).
  - jchw 7y ago
    Oh yeah, I’ve set all that stuff up already and I am able to login; NixOS makes it mostly pretty easy.
  - OrwellianChild 7y ago
    I've run into strange interactions where adding a key is disabled in Firefox (even with the security.webauth.u2f flag set to true), but once one key is added, you can add subsequent keys no problem. This is how Github worked for me - I think it's just a mis-match in the code checking for U2F functionality...
    - archi42 7y ago
      I think adding the key use a different mechanism - there are two JS interfaces for U2F, and FF only supports one of them. TBH I've added my key to GitHub with chromium, but have since moved to FF; so that might be what you're seeing with GitHub.

jchw 7y ago

Yeah, Chromium is needed to add keys, which effectively means you can’t enable Advanced Protection without Chromium. I personally ran into this wall. I acknowledge that this sucks, as a person that intentionally only uses Firefox, but to be clear logging in and most other operations work absolutely fine with Advanced Protection. Does it really disable all API access? I thought it only blocked certain OAuth scopes, but to be honest I haven’t really tried. I was able to login to a NVIDIA Shield, but only by resetting and bootstrapping off a spare Android device (!!!) because U2F keys are broken on Shield. Interestingly, my Samsung TV remains signed into Youtube, which is kind of odd now that I think about it.

mrkstu 7y ago
Youtube/YoutubeTV seem to be walled off on 2nd factor auth. I've been able to log into both on browsers w/o 2nd factor and then get prompted when logging into web gmail.
archi42 7y ago
Seems like Firefox U2F is just disabled by default: https://www.yubico.com/2017/11/how-to-navigate-fido-u2f-in-firefox-quantum/ https://www.yubico.com/2017/11/how-to-navigate-fido-u2f-in-f... (tl;dr: Open about:config, search for u2f, enable) With that done, GitHub prompts me for my key. My Linux office workstation is missing the necessary udev rule, so I couldn't test more. (Funnily, pressing Cancel caused them to send me a SMS, so their 2FA is practically worthless).
- jchw 7y ago
  Oh yeah, I’ve set all that stuff up already and I am able to login; NixOS makes it mostly pretty easy.
- OrwellianChild 7y ago
  I've run into strange interactions where adding a key is disabled in Firefox (even with the security.webauth.u2f flag set to true), but once one key is added, you can add subsequent keys no problem. This is how Github worked for me - I think it's just a mis-match in the code checking for U2F functionality...
  - archi42 7y ago
    I think adding the key use a different mechanism - there are two JS interfaces for U2F, and FF only supports one of them. TBH I've added my key to GitHub with chromium, but have since moved to FF; so that might be what you're seeing with GitHub.