3 ms·

This is called FIDO2 and can be used for passwordless authentication as well as two-factor. It’s compatible with Windows Hello or Touch ID (in Chrome, not Safar

This is called FIDO2 and can be used for passwordless authentication as well as two-factor. It’s compatible with Windows Hello or Touch ID (in Chrome, not Safari), and there are a number of dedicated USB tokens available if you want a second factor beyond your device authenticating itself. It’s just not well-known enough on enough sites and services yet, but it exists and WebAuthN makes it easy. Outside of the browser, it has OpenSSH support but not git or pgp/gpg support. GPG (and by extension git) don’t support very many security technologies... Windows Hello and CryptoKit are solutions but rarely implemented yet. Perhaps this will change over the next decade as hardware-based security authentication supplements or replaces soft- or password-based authentication.... Touch ID on phone apps can show how it’s done...

jjoonathan 6y ago
Agreed, FIDO2 is the way. It hit a huge maturity milestone last year when the last major browser/OS combination got support for USB keys by default. Now the user story is "insert key, boop button." It's intuitive enough for my parents to understand, it's easy enough to habitually use, and the security is a big step up.
est31 6y ago
While I agree that FIDO2 is great, especially far more secure than SMS based 2fA, people will still lose their FIDO2 sticks, they will still get stolen. And there will still be stories of people getting into accounts by pretending to be you to support.
- lstamour 6y ago
  You should always register more than one, and services should accept or require more than one, ideally. Google Advanced Protection shows how it could be done for extra security-conscious users though it does not, itself, use FIDO2 yet, I believe it’s still on an older iteration, U2F? The best article I’ve found to explain USB security keys has so far been https://paulstamatiou.com/getting-started-with-security-keys/ https://paulstamatiou.com/getting-started-with-security-keys... but it’s ... very long.
  - sbr464 6y ago
    I agree, but I dont think AWS even allows more than one key, you’d need to create another user account. Just to point out how a billion dollar company also has issues here.
    - justinc8687 6y ago
      You can make it work by creating multiple IAM users, for different keys. Just make sure they have billing and full admin access. Still doesn't help for root 2fa, but just give that a random 32 char password and stick that in a safe deposit box or something.
    - jjoonathan 6y ago
      Yeah, but AWS is a bit, uhh... just because AWS screws it up doesn't mean everyone else will. That probably came across like speculation based on AWS's reputation, but it's also my actual experience after going on a U2F spree. Out of maybe 7 or 8 accounts, AWS was the only one that didn't support a backup key. Point is: I don't think it spells doom for U2F. Wasn't it just a few days ago that AWS was allowing password resets that couldn't be used for login because of validation? I don't remember the service, just that I saw it on HN.
    - tialaramex 6y ago
      They don't, but that's a non-compliance. The WebAuthn (WebAuthn is the standard way to support FIDO in a browser) specification explicitly tells Relying Parties (which is what AWS are here) that they need to allow users to enrol more than one key. The whole API design incorporates this thinking. The API call to tell a browser "Hey I want to enrol a Security Key" navigator.credentials.create() takes an array as a parameter with IDs for keys you don't want to enrol because they enrolled already. The call for "Hey, prove you still have that second factor" navigator.credentials.get() needs among many things an array again, this time for IDs for keys that you'd accept, and one reason that's needed is that other keys needn't bother doing anything as they can't help.

jjoonathan 6y ago

Agreed, FIDO2 is the way. It hit a huge maturity milestone last year when the last major browser/OS combination got support for USB keys by default. Now the user story is "insert key, boop button." It's intuitive enough for my parents to understand, it's easy enough to habitually use, and the security is a big step up.

est31 6y ago

While I agree that FIDO2 is great, especially far more secure than SMS based 2fA, people will still lose their FIDO2 sticks, they will still get stolen. And there will still be stories of people getting into accounts by pretending to be you to support.

lstamour 6y ago
You should always register more than one, and services should accept or require more than one, ideally. Google Advanced Protection shows how it could be done for extra security-conscious users though it does not, itself, use FIDO2 yet, I believe it’s still on an older iteration, U2F? The best article I’ve found to explain USB security keys has so far been https://paulstamatiou.com/getting-started-with-security-keys/ https://paulstamatiou.com/getting-started-with-security-keys... but it’s ... very long.
- sbr464 6y ago
  I agree, but I dont think AWS even allows more than one key, you’d need to create another user account. Just to point out how a billion dollar company also has issues here.
  - justinc8687 6y ago
    You can make it work by creating multiple IAM users, for different keys. Just make sure they have billing and full admin access. Still doesn't help for root 2fa, but just give that a random 32 char password and stick that in a safe deposit box or something.
  - jjoonathan 6y ago
    Yeah, but AWS is a bit, uhh... just because AWS screws it up doesn't mean everyone else will. That probably came across like speculation based on AWS's reputation, but it's also my actual experience after going on a U2F spree. Out of maybe 7 or 8 accounts, AWS was the only one that didn't support a backup key. Point is: I don't think it spells doom for U2F. Wasn't it just a few days ago that AWS was allowing password resets that couldn't be used for login because of validation? I don't remember the service, just that I saw it on HN.
  - tialaramex 6y ago
    They don't, but that's a non-compliance. The WebAuthn (WebAuthn is the standard way to support FIDO in a browser) specification explicitly tells Relying Parties (which is what AWS are here) that they need to allow users to enrol more than one key. The whole API design incorporates this thinking. The API call to tell a browser "Hey I want to enrol a Security Key" navigator.credentials.create() takes an array as a parameter with IDs for keys you don't want to enrol because they enrolled already. The call for "Hey, prove you still have that second factor" navigator.credentials.get() needs among many things an array again, this time for IDs for keys that you'd accept, and one reason that's needed is that other keys needn't bother doing anything as they can't help.