4 ms·

Anyone else unimpressed with Twitter's U2F/FIDO token support? They support a total of 1 (one) U2F token on an account :( The only other company I know that do

by graton 6y ago

Anyone else unimpressed with Twitter's U2F/FIDO token support? They support a total of 1 (one) U2F token on an account :( The only other company I know that does that is AWS and one U2F token. Every other site I use allows multiples, usually at least 5 or more. I setup U2F on Twitter but then got rid of it after realizing they only allow one.

koolba 6y ago
AWS has a simple workaround though as you can create as many users as you want, each with its own unique token. Combined with roles it’s straightforward to set up a backup user / device. It makes sense technically to have a single token anyway. Otherwise you either need to include then identifier of the auth token (in addition to the secret) or have the verification step try out all N options.
- graton 6y ago
  > It makes sense technically to have a single token anyway. Otherwise you either need to include then identifier of the auth token (in addition to the secret) or have the verification step try out all N options. I'm not sure if that is true. Most sites support multiple tokens. Off the top of my head I can think of Google, Facebook, Github, Gitlab, and more that support multiple. So it seems like the normal method is to support multiple. One one site I have over 5 auth tokens configured. And tested with four of them connected to my PC at the same time. I could tap on any one of them to authenticate. This is on a Windows 10 PC.
  - koolba 6y ago
    None of those sites have a concept of users within an account. For each the user and the account are one in the same.
- blibble 6y ago
  so how do I do that for the root account, of which there can be only one?
ciarannolan 6y ago
Isn't it kind of insane to lock your account into using a single U2F/FIDO key? Lost the physical key, lose the account?
- Andrex 6y ago
  Twitter doesn't let you disable SMS verification so that's their answer. :/
blibble 6y ago
the entirety of AWS seems to be half assed in general as you've described: the U2F functionality is completely useless because if you lose/break your single U2F key then you're completely screwed and they still have no support for ed25519 keys (which were added to OpenSSH in 2013), unlike every other cloud service I have to have an RSA key just for AWS (particuraly annoying as I have all my other ssh keys stored in a hardware token) if they didn't validate the damn key type then it would probably just work out of the box
- __blockcipher__ 6y ago
  > if they didn't validate the damn key type then it would probably just work out of the box That thought makes it so much for frustrating. ed25519 is the future anyway, it’s hilarious how many cling to RSA (I’ve got nothing against RSA but at some point we’ll have to switch anyway)
- deathanatos 6y ago
  Oh don't worry, Azure also demands an RSA key for bringing up VMs, too. > if they didn't validate the damn key type then it would probably just work out of the box Yep. So incredibly frustrating.
- manquer 6y ago
  You can script your vm creation pretty easily and pipe your hardware key to the script
renewiltord 6y ago
And you can't use your hardware key on the CLI either. Switched to using an authenticator app. What a nightmare.

by graton 6y ago

koolba 6y ago

AWS has a simple workaround though as you can create as many users as you want, each with its own unique token. Combined with roles it’s straightforward to set up a backup user / device. It makes sense technically to have a single token anyway. Otherwise you either need to include then identifier of the auth token (in addition to the secret) or have the verification step try out all N options.

graton 6y ago
> It makes sense technically to have a single token anyway. Otherwise you either need to include then identifier of the auth token (in addition to the secret) or have the verification step try out all N options. I'm not sure if that is true. Most sites support multiple tokens. Off the top of my head I can think of Google, Facebook, Github, Gitlab, and more that support multiple. So it seems like the normal method is to support multiple. One one site I have over 5 auth tokens configured. And tested with four of them connected to my PC at the same time. I could tap on any one of them to authenticate. This is on a Windows 10 PC.
- koolba 6y ago
  None of those sites have a concept of users within an account. For each the user and the account are one in the same.
blibble 6y ago
so how do I do that for the root account, of which there can be only one?

ciarannolan 6y ago

Isn't it kind of insane to lock your account into using a single U2F/FIDO key? Lost the physical key, lose the account?

Andrex 6y ago
Twitter doesn't let you disable SMS verification so that's their answer. :/

blibble 6y ago

the entirety of AWS seems to be half assed in general as you've described: the U2F functionality is completely useless because if you lose/break your single U2F key then you're completely screwed and they still have no support for ed25519 keys (which were added to OpenSSH in 2013), unlike every other cloud service I have to have an RSA key just for AWS (particuraly annoying as I have all my other ssh keys stored in a hardware token) if they didn't validate the damn key type then it would probably just work out of the box

__blockcipher__ 6y ago
> if they didn't validate the damn key type then it would probably just work out of the box That thought makes it so much for frustrating. ed25519 is the future anyway, it’s hilarious how many cling to RSA (I’ve got nothing against RSA but at some point we’ll have to switch anyway)
deathanatos 6y ago
Oh don't worry, Azure also demands an RSA key for bringing up VMs, too. > if they didn't validate the damn key type then it would probably just work out of the box Yep. So incredibly frustrating.
manquer 6y ago
You can script your vm creation pretty easily and pipe your hardware key to the script

renewiltord 6y ago

And you can't use your hardware key on the CLI either. Switched to using an authenticator app. What a nightmare.