7 ms·

Why can’t we have more than one u2f key??? The most important guarantee that u2f gives you is a significant reduction in phishing risk. I can still be phished w

Why can’t we have more than one u2f key??? The most important guarantee that u2f gives you is a significant reduction in phishing risk. I can still be phished with a totp code by a social engineering attack and something like Modlishka...

karpathy 7y ago
I was also really hoping they would slip this into the update too, but looks like not yet unfortunately :( The whole login security ecosystem across the web is in a state of high entropy flux. Some websites still don't offer 2FA, some only do text, some demand text, some don't even offer text, some offer authenticator apps, some force specific authenticator apps, some offer hardware tokens, some allow only a single hardware token, ... The U2F hardware tokens themselves are only compatible with some of your devices due to the variety in ports, etc. And a typical person will have to have an account with ~100 different places that they want to use with continuity across multiple devices.
filleokus 7y ago
Yeah, recently demo'ed Modlishka to my org, really scary stuff... Re U2F keys: I think I would prefer a security model where I provision a U2F key based on some master secret stored in a "secure" but accessible way, i.e paper. Then I could create a new key with the same secret when I loose or break the first one. Having two U2F fobs seems almost like having two different locks on all your doors, setup so that only one is needed to open the door.
- mrb 7y ago
  It's possible to do what you describe with existing open-source/open-hardware U2F security keys, as they let you define the master secret from which the per-site private elliptic keys are generated. I haven't personally tried it, though. But for security you should still have at least two U2F security keys using different master secrets (if you lose one security key, you can deactivate it without deactivating the other).

karpathy 7y ago

I was also really hoping they would slip this into the update too, but looks like not yet unfortunately :( The whole login security ecosystem across the web is in a state of high entropy flux. Some websites still don't offer 2FA, some only do text, some demand text, some don't even offer text, some offer authenticator apps, some force specific authenticator apps, some offer hardware tokens, some allow only a single hardware token, ... The U2F hardware tokens themselves are only compatible with some of your devices due to the variety in ports, etc. And a typical person will have to have an account with ~100 different places that they want to use with continuity across multiple devices.

filleokus 7y ago

Yeah, recently demo'ed Modlishka to my org, really scary stuff... Re U2F keys: I think I would prefer a security model where I provision a U2F key based on some master secret stored in a "secure" but accessible way, i.e paper. Then I could create a new key with the same secret when I loose or break the first one. Having two U2F fobs seems almost like having two different locks on all your doors, setup so that only one is needed to open the door.

mrb 7y ago
It's possible to do what you describe with existing open-source/open-hardware U2F security keys, as they let you define the master secret from which the per-site private elliptic keys are generated. I haven't personally tried it, though. But for security you should still have at least two U2F security keys using different master secrets (if you lose one security key, you can deactivate it without deactivating the other).