3 ms·

Doesn't this defeat the whole purpose? I love my multiple U2F keys, but I don't understand why getting a software one would do any good...

• jjoonathan 7y ago
  From the README.md: > Some people may decide the attack scenario above is worth the usability tradeoff of hardware key storage. But, for many, the security of software-based U2F is sufficient and helps to mitigate against many common attacks such as password dumps, brute force attacks, and phishing related exploits.
• skybrian 7y ago
  U2F keys cost money. Maybe you don't want to buy more than one, but you need a backup. Inexpensive ways to do it will help adoption and people who care more will stick with hardware keys.
  • sdan 7y ago
    I guess what you're saying makes sense. But instead of "faking" U2F keys just go with something like authy or phone verification. I still believe it defeats the hardware purpose of u2f given that it's software (even if it's a backup)
    • dmoy 7y ago
      authy and phone also defeat one purpose of u2f, in that they are trivially phishable Any backup for a u2f that isn't another physical u2f is compromising in some way, it's just a matter of which way. In reality though I agree with you and use one time code backup for u2f, and just trust that I will be careful if I ever need to use them. (But maybe I'll be panicking already and get phished? Who knows...)
• deleted 7y ago
  [deleted]