8 ms·

That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe),

That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe), I found the most common problem was that websites/services don't tread these keys as first class citizens. For example GitHub: I have my two keys setup there, but I can't opt-out of SMS authentication. If I knew I could use my keys at more services, I would already have upgrade the daily driver to a NFC variant (so I could use it with my phone). So, to any webdevs on HN reading this: Take that shit serious and implement 2FA ;-) //edit: GitHub is just a single example; and it's possible to opt-out of SMS, if a authenticator app is used instead. That's what I mean by second class citizen: Security Key(s) + X is possible, but while X alone can be configured, Security Key(s) alone is(/are) not allowed.

cj 7y ago
Last year I got the Google Titan security keys and connected it with all of my work + personal accounts that support it. The #1 weakness is the simple fact that many services don't allow you to disable alternate forms of 2fa. Github is an example, you can always trigger the fallback SMS 2fa code. Dashlane is another example (and arguably the most important). It's impossible to make your security key the only form of 2-FA. If you have a security key on your account, you must also have regular app-based 2-FA enabled as a fall back. What's the point of using security keys with services that require regular SMS or app-based 2-FA as a fallback? Edit: G Suite is one of the few services that got it right. G Suite has an optional security control that when enabled, forces authentication using security keys (explicitly forbidding alternate 2-fa methods).
- somepig 7y ago
  regular "app based" is just OATH-TOTP in most cases. This uses a shared secret and the time to generate one time codes. The Yubikey explicitly supports TOTP, and will happily store your secret on the key. You can then use Yubioath to pull codes from the Yubikey as needed. I'm a huge fan of the ability to use either U2F or TOTP with the same hardware token.
  - mfontani 7y ago
    Note that the Yubikey only supports up to 32 TOTP.
- Macha 7y ago
  My understanding is the issues that lead to U2F being considered to be better than TOTP were mainly about it being phished easily compared something which will only dispense the right code with the right challenge. But if you never actually login with TOTP, and always use your U2F key, then does it actually decrease security to have it as a backup/removal option and you know that's the only reason you'd enter it. It feels like its competition there is "convince phone support with a sob story" and TOTP feels like a clear step up from that.
  - antsar 7y ago
    TOTP is one thing. Having your backup TOTP key locked in a safe effectively stops it from being abused. SMS 2FA, on the other hand, has real security issues[0][1]. In my experience, SMS 2FA is most commonly the required type of 2FA, before you can add TOTP/U2F as a secondary. SMS 2FA is the hardest to lose or break, so forcing everyone to keep it enabled minimizes support costs for the provider. [0] https://www.theregister.co.uk/2016/07/24/nist_says_sms_no_good_for_authentication https://www.theregister.co.uk/2016/07/24/nist_says_sms_no_go... [1] https://duo.com/decipher/reddit-breach-illustrates-dangers-of-2fa-over-sms https://duo.com/decipher/reddit-breach-illustrates-dangers-o...
    - yborg 7y ago
      The other thing driving SMS 2FA is that this is a clean way for the site/org to get their hands on a real phone number for you with no extra effort. SMS 2FA has been repeatedly proven to be trivial to break with a simple phone call to a mobile provider, since there so far is no downside at all that I am aware of to the providers. If someone jacks your SMS and drains your bank account, at least in the US your mobile provider just goes "oops". Until there is some penalty for them allowing your number to be ported without your consent, SMS is essentially useless for real 2FA security. Even if the account security was foolproof, though, it still is vulnerable to SS7 routing attacks.
    - srathi 7y ago
      Using Authy may be a good idea. There is a slight risk of exposing the TOTP key to the cloud, but having it available on all devices (current and future) is very convenient. Authy has an option to encrypt the key using a user specified passphrase, so it is at least better than storing the raw TOTP key in the cloud.
- jxcl 7y ago
  Fastmail allows you to do this too. They have a long section in the documentation that strongly discourages it, and it seems like they will refuse to restore your account if you lose your 2FA, which is exactly what I want: https://www.fastmail.com/help/account/2fa.html https://www.fastmail.com/help/account/2fa.html >> Why do I have to add a recovery phone number to set up two-step verification? > Keeping your account safe from attackers is very important. But so too is making sure you don't get locked out of your own account. We are aware that SMS is not the most secure of methods for 2FA, and has been deprecated by NIST. However, for the majority of users, the risk of losing their two-step verification device is far greater than the risk of someone hacking their SMS. If you lose your phone, the TOTP key is lost but normally you can get a new SIM card with the same number from your carrier. We therefore believe requiring a phone as a backup option strikes the best balance of confidentiality (no one else can read your data) and availability (you can read your data) for the majority of our users. > Please note, if two-step verification is enabled, access to the phone number itself is not sufficient to gain access to an account: you still need two factors (your password AND the SMS). > Advanced users that understand the risk may remove the phone number from their account once two-step verification is enabled. Once the recovery phone is removed from the account, SMS is no longer an option as the second factor for login. If you choose to do this, we strongly recommend you write down or print your recovery code and store it in a safe location, and that you set up at least two security keys or authenticator devices. Should you lose access to all two-step verification devices and not have your recovery code, you may be permanently locked out of your own account.
  - alasarmas 7y ago
    Fastmail used to have a mechanism where you could hold down <alt> (I believe) on that screen and phone number would no longer be a required field to continue creating your account. Maybe that's still possible.
    - jxcl 7y ago
      I don't remember phone number being required while creating an account, they only wanted to collect it when enabling 2FA. If I recall correctly they had a little info button that said something like "we need this to start but you can remove it later if you _really_ want to."
- ecesena 7y ago
  > Github is an example, you can always trigger the fallback SMS 2fa code. You can setup OTP (no SMS) and either keep it as a backup, or destroy the key. I don't have SMS on Github. Admittedly, it won't solve issues with all services. From the service perspective, dealing with users who lost their security key (or don't have a backup one) is too painful wrt to forcing you to have an alternative.
- apex3stoker 7y ago
  > What's the point of using security keys with services that require regular SMS or app-based 2-FA as a fallback? It addresses the problem with phishing. The main problem with Authenticator is not that an attacker knows the one-time password, but that an attacker tricks user into entering the one-time password to their UI and uses that right away to take control of the user's account. https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu...
- zymhan 7y ago
  Dashlane's support isn't an issue IMO. TOTP is secure, unlike SMS 2FA.
munchbunny 7y ago
I'm surprised that you can't remove/disable the fallback SMS number. One thing you can do to mitigate that problem is to create a Google Voice number. Those are harder to port as long as you created it on Google Voice.
- jeromegv 7y ago
  A solution often mentioned but not available to anyone outside the US.
  - munchbunny 7y ago
    Can you create one that doesn't forward to your phone? Could a US friend create one for you in a new account and hand that account over to you? It's more about sinking that second factor somewhere that can't be redirected and only you can theoretically access by logging into Google Voice. You don't have to forward the messages to your actual phone.
    - davchana 7y ago
      I think each Google Voice number needs a real US phone number, where calls/texts sent to GV Number will be forwarded to.
      - dbancajas 7y ago
        > print your recovery code and store it in a safe location, and that you set up at least two security keys or authenticator devices. Should you lose access to all two-step verification devic but this can be configured to not forward the text/voicemail.
  - kalleboo 7y ago
    Or just get a prepaid phone with a number you don't tell anyone. And if your country allows it, without registering your name/ID to it.
- archi42 7y ago
eurleif 7y ago
FYI, a YubiKey (but not a lower-end Security Key by Yubico) supports OTP in addition to U2F. I have my GitHub account set up with U2F and OTP as the two 2FA options, both from my YubiKey. No SMS. This also works for pretty much any site that supports app-based 2FA; e.g., AWS doesn't support U2F at all, but I use it with my YubiKey via OTP.
- anilakar 7y ago
  Yubico's OTP requires you to register your secret on their server and adds a mandatory third party to the authentication process, so it's literally the second worst authentication method a Yubikey supports right after a static password.
  - akerl_ 7y ago
    Yubico’s OTP protocol requires that. But Yubikeys also support storing TOTP and HOTP secrets, which do not add any 3rd party to the process. Also, to say that using Yubico OTP is “the second worst method” is potentially true, but in a relatively uninteresting way: adding Yubico-OTP-based MFA is so much better than just using a static password that the gap between 1st and 2nd place is huge. The comparative benefit between Yubico OTP and TOTP is tiny by comparison. It’s also worth noting that Yubico has released the spec for validating their OTPs, so it’s possible to do so without a 3rd party: https://www.yubico.com/products/services-software/open-source-servers/ https://www.yubico.com/products/services-software/open-sourc...
po 7y ago
In addition to what you're saying, I also would like to register multiple keys to services such that any one would work, not that both are required. I don't need them to be nuclear keys... I want a backup key stored in a safe and one on my keychain. This seems to be very uncommon amongst service providers.
- akerl_ 7y ago
  I’d say this is actually the most common. I’m not aware of any websites that allow >1 U2F/FIDO key in the configuration where you need to use all-of-them to log in. Sites either only support 1 key, or support multiple keys and you need 1 of them to log in.
  - coughlanio 7y ago
    Yep, I recently got Google's Titan pair of keys, and anywhere that supports hardware keys, I was able to register both, and I'm only required to use one to login.
  - po 7y ago
    Odd.. I tried to set this up with AWS and it either wasn't supported or works as I was saying. Will have to look again.
akerl_ 7y ago
I’m not sure what you mean. I have SMS and Fallback SMS both disabled: https://imgur.com/a/bLnRuOq https://imgur.com/a/bLnRuOq
- archi42 7y ago
  Hm, but you have an Authenticator App enabled. If I "Edit" my SMS Number, I get to choose whether I want to proceed with "Set up using app" or "Set up using SMS", but not "Set up using security key". The point of having two keys is that there is no need for neither an authenticator app nor SMS.
  - akerl_ 7y ago
    It would rock to be able to avoid having the Authenticator app, but I think “U2F plus a TOTP device” is pretty solidly better than “U2F plus SMS”, and this comment tree is suggesting that GitHub doesn’t allow for disabling SMS. If you do U2F with 2 keys, TOTP, and throw away the TOTP secret after you activate it, you’re exposed to a slight additional risk because the TOTP secret is still stored by Github, but that’s radically better than a world where they mandate SMS.
    - archi42 7y ago
      True, I just amended my initial comment to reflect the fact that GitHub is not as bad as I made it look like, but the second class citizen point still stands, even if some workaround like "throw away the TOTP" is applied.
      - akerl_ 7y ago
        I agree with your overall point. I’m hopeful that bringing U2F/FIDO2 to iPhone will help continue to push these standards into being first-class citizens. Right now, I use TOTP for a ton of sites because I’m using an iPad Pro as my primary workstation, despite the fact that it has a USB-C port and I’ve got a pile of USB-C Yubikeys.
  - jwr 7y ago
djsumdog 7y ago
I think the trouble is key loss. Even more than falling back to SMS is the fact that if you lose a key and don't have a recovery key file, you can basically beat the whole thing with social engineering. In a corporate environment, it can be a bit different since if someone breaks their phone or Yubikey and needs me to disable MFA, you can make them call you, tell you the last board game you played together or the last project you helped them with, and verify their identity. But that only works in companies of ~100 developers. You get larger than that, and you can't even do that anymore, and need to fall back to pre-set security questions. Services like Google, Github, etc. don't have huge support staffs for their free projects, so it makes sense (for them) to have these fallbacks. Honestly, having security and unique passwords for everything (especially e-mail accounts that get password resets) is probably more important than MFA for these big services.
sly010 7y ago
Also, I have yet to find an Electron based app that supports it. On the other hand I was positively surprised when it just worked on Android (for Google login).
gcbw2 7y ago
github (and everything microsoft) have two incentives for forcing SMS always: Advertising* and US law. * github has no ads, yet. But microsoft is the 3rd largest.

cj 7y ago

Last year I got the Google Titan security keys and connected it with all of my work + personal accounts that support it. The #1 weakness is the simple fact that many services don't allow you to disable alternate forms of 2fa. Github is an example, you can always trigger the fallback SMS 2fa code. Dashlane is another example (and arguably the most important). It's impossible to make your security key the only form of 2-FA. If you have a security key on your account, you must also have regular app-based 2-FA enabled as a fall back. What's the point of using security keys with services that require regular SMS or app-based 2-FA as a fallback? Edit: G Suite is one of the few services that got it right. G Suite has an optional security control that when enabled, forces authentication using security keys (explicitly forbidding alternate 2-fa methods).

somepig 7y ago
regular "app based" is just OATH-TOTP in most cases. This uses a shared secret and the time to generate one time codes. The Yubikey explicitly supports TOTP, and will happily store your secret on the key. You can then use Yubioath to pull codes from the Yubikey as needed. I'm a huge fan of the ability to use either U2F or TOTP with the same hardware token.
- mfontani 7y ago
  Note that the Yubikey only supports up to 32 TOTP.
Macha 7y ago
My understanding is the issues that lead to U2F being considered to be better than TOTP were mainly about it being phished easily compared something which will only dispense the right code with the right challenge. But if you never actually login with TOTP, and always use your U2F key, then does it actually decrease security to have it as a backup/removal option and you know that's the only reason you'd enter it. It feels like its competition there is "convince phone support with a sob story" and TOTP feels like a clear step up from that.
- antsar 7y ago
  TOTP is one thing. Having your backup TOTP key locked in a safe effectively stops it from being abused. SMS 2FA, on the other hand, has real security issues[0][1]. In my experience, SMS 2FA is most commonly the required type of 2FA, before you can add TOTP/U2F as a secondary. SMS 2FA is the hardest to lose or break, so forcing everyone to keep it enabled minimizes support costs for the provider. [0] https://www.theregister.co.uk/2016/07/24/nist_says_sms_no_good_for_authentication https://www.theregister.co.uk/2016/07/24/nist_says_sms_no_go... [1] https://duo.com/decipher/reddit-breach-illustrates-dangers-of-2fa-over-sms https://duo.com/decipher/reddit-breach-illustrates-dangers-o...
  - yborg 7y ago
    The other thing driving SMS 2FA is that this is a clean way for the site/org to get their hands on a real phone number for you with no extra effort. SMS 2FA has been repeatedly proven to be trivial to break with a simple phone call to a mobile provider, since there so far is no downside at all that I am aware of to the providers. If someone jacks your SMS and drains your bank account, at least in the US your mobile provider just goes "oops". Until there is some penalty for them allowing your number to be ported without your consent, SMS is essentially useless for real 2FA security. Even if the account security was foolproof, though, it still is vulnerable to SS7 routing attacks.
  - srathi 7y ago
    Using Authy may be a good idea. There is a slight risk of exposing the TOTP key to the cloud, but having it available on all devices (current and future) is very convenient. Authy has an option to encrypt the key using a user specified passphrase, so it is at least better than storing the raw TOTP key in the cloud.
jxcl 7y ago
Fastmail allows you to do this too. They have a long section in the documentation that strongly discourages it, and it seems like they will refuse to restore your account if you lose your 2FA, which is exactly what I want: https://www.fastmail.com/help/account/2fa.html https://www.fastmail.com/help/account/2fa.html >> Why do I have to add a recovery phone number to set up two-step verification? > Keeping your account safe from attackers is very important. But so too is making sure you don't get locked out of your own account. We are aware that SMS is not the most secure of methods for 2FA, and has been deprecated by NIST. However, for the majority of users, the risk of losing their two-step verification device is far greater than the risk of someone hacking their SMS. If you lose your phone, the TOTP key is lost but normally you can get a new SIM card with the same number from your carrier. We therefore believe requiring a phone as a backup option strikes the best balance of confidentiality (no one else can read your data) and availability (you can read your data) for the majority of our users. > Please note, if two-step verification is enabled, access to the phone number itself is not sufficient to gain access to an account: you still need two factors (your password AND the SMS). > Advanced users that understand the risk may remove the phone number from their account once two-step verification is enabled. Once the recovery phone is removed from the account, SMS is no longer an option as the second factor for login. If you choose to do this, we strongly recommend you write down or print your recovery code and store it in a safe location, and that you set up at least two security keys or authenticator devices. Should you lose access to all two-step verification devices and not have your recovery code, you may be permanently locked out of your own account.
- alasarmas 7y ago
  Fastmail used to have a mechanism where you could hold down <alt> (I believe) on that screen and phone number would no longer be a required field to continue creating your account. Maybe that's still possible.
  - jxcl 7y ago
    I don't remember phone number being required while creating an account, they only wanted to collect it when enabling 2FA. If I recall correctly they had a little info button that said something like "we need this to start but you can remove it later if you _really_ want to."
ecesena 7y ago
> Github is an example, you can always trigger the fallback SMS 2fa code. You can setup OTP (no SMS) and either keep it as a backup, or destroy the key. I don't have SMS on Github. Admittedly, it won't solve issues with all services. From the service perspective, dealing with users who lost their security key (or don't have a backup one) is too painful wrt to forcing you to have an alternative.
apex3stoker 7y ago
> What's the point of using security keys with services that require regular SMS or app-based 2-FA as a fallback? It addresses the problem with phishing. The main problem with Authenticator is not that an attacker knows the one-time password, but that an attacker tricks user into entering the one-time password to their UI and uses that right away to take control of the user's account. https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu...
zymhan 7y ago
Dashlane's support isn't an issue IMO. TOTP is secure, unlike SMS 2FA.

munchbunny 7y ago

I'm surprised that you can't remove/disable the fallback SMS number. One thing you can do to mitigate that problem is to create a Google Voice number. Those are harder to port as long as you created it on Google Voice.

jeromegv 7y ago
A solution often mentioned but not available to anyone outside the US.
- munchbunny 7y ago
  Can you create one that doesn't forward to your phone? Could a US friend create one for you in a new account and hand that account over to you? It's more about sinking that second factor somewhere that can't be redirected and only you can theoretically access by logging into Google Voice. You don't have to forward the messages to your actual phone.
  - davchana 7y ago
    I think each Google Voice number needs a real US phone number, where calls/texts sent to GV Number will be forwarded to.
    - dbancajas 7y ago
      > print your recovery code and store it in a safe location, and that you set up at least two security keys or authenticator devices. Should you lose access to all two-step verification devic but this can be configured to not forward the text/voicemail.
- kalleboo 7y ago
  Or just get a prepaid phone with a number you don't tell anyone. And if your country allows it, without registering your name/ID to it.
archi42 7y ago

eurleif 7y ago

FYI, a YubiKey (but not a lower-end Security Key by Yubico) supports OTP in addition to U2F. I have my GitHub account set up with U2F and OTP as the two 2FA options, both from my YubiKey. No SMS. This also works for pretty much any site that supports app-based 2FA; e.g., AWS doesn't support U2F at all, but I use it with my YubiKey via OTP.

anilakar 7y ago
Yubico's OTP requires you to register your secret on their server and adds a mandatory third party to the authentication process, so it's literally the second worst authentication method a Yubikey supports right after a static password.
- akerl_ 7y ago
  Yubico’s OTP protocol requires that. But Yubikeys also support storing TOTP and HOTP secrets, which do not add any 3rd party to the process. Also, to say that using Yubico OTP is “the second worst method” is potentially true, but in a relatively uninteresting way: adding Yubico-OTP-based MFA is so much better than just using a static password that the gap between 1st and 2nd place is huge. The comparative benefit between Yubico OTP and TOTP is tiny by comparison. It’s also worth noting that Yubico has released the spec for validating their OTPs, so it’s possible to do so without a 3rd party: https://www.yubico.com/products/services-software/open-source-servers/ https://www.yubico.com/products/services-software/open-sourc...

po 7y ago

In addition to what you're saying, I also would like to register multiple keys to services such that any one would work, not that both are required. I don't need them to be nuclear keys... I want a backup key stored in a safe and one on my keychain. This seems to be very uncommon amongst service providers.

akerl_ 7y ago
I’d say this is actually the most common. I’m not aware of any websites that allow >1 U2F/FIDO key in the configuration where you need to use all-of-them to log in. Sites either only support 1 key, or support multiple keys and you need 1 of them to log in.
- coughlanio 7y ago
  Yep, I recently got Google's Titan pair of keys, and anywhere that supports hardware keys, I was able to register both, and I'm only required to use one to login.
- po 7y ago
  Odd.. I tried to set this up with AWS and it either wasn't supported or works as I was saying. Will have to look again.

akerl_ 7y ago

I’m not sure what you mean. I have SMS and Fallback SMS both disabled: https://imgur.com/a/bLnRuOq https://imgur.com/a/bLnRuOq

archi42 7y ago
Hm, but you have an Authenticator App enabled. If I "Edit" my SMS Number, I get to choose whether I want to proceed with "Set up using app" or "Set up using SMS", but not "Set up using security key". The point of having two keys is that there is no need for neither an authenticator app nor SMS.
- akerl_ 7y ago
  It would rock to be able to avoid having the Authenticator app, but I think “U2F plus a TOTP device” is pretty solidly better than “U2F plus SMS”, and this comment tree is suggesting that GitHub doesn’t allow for disabling SMS. If you do U2F with 2 keys, TOTP, and throw away the TOTP secret after you activate it, you’re exposed to a slight additional risk because the TOTP secret is still stored by Github, but that’s radically better than a world where they mandate SMS.
  - archi42 7y ago
    True, I just amended my initial comment to reflect the fact that GitHub is not as bad as I made it look like, but the second class citizen point still stands, even if some workaround like "throw away the TOTP" is applied.
    - akerl_ 7y ago
      I agree with your overall point. I’m hopeful that bringing U2F/FIDO2 to iPhone will help continue to push these standards into being first-class citizens. Right now, I use TOTP for a ton of sites because I’m using an iPad Pro as my primary workstation, despite the fact that it has a USB-C port and I’ve got a pile of USB-C Yubikeys.
- jwr 7y ago

djsumdog 7y ago

I think the trouble is key loss. Even more than falling back to SMS is the fact that if you lose a key and don't have a recovery key file, you can basically beat the whole thing with social engineering. In a corporate environment, it can be a bit different since if someone breaks their phone or Yubikey and needs me to disable MFA, you can make them call you, tell you the last board game you played together or the last project you helped them with, and verify their identity. But that only works in companies of ~100 developers. You get larger than that, and you can't even do that anymore, and need to fall back to pre-set security questions. Services like Google, Github, etc. don't have huge support staffs for their free projects, so it makes sense (for them) to have these fallbacks. Honestly, having security and unique passwords for everything (especially e-mail accounts that get password resets) is probably more important than MFA for these big services.

sly010 7y ago

Also, I have yet to find an Electron based app that supports it. On the other hand I was positively surprised when it just worked on Android (for Google login).

gcbw2 7y ago

github (and everything microsoft) have two incentives for forcing SMS always: Advertising* and US law. * github has no ads, yet. But microsoft is the 3rd largest.