4 ms·

What are the current best options for hardware tokens then?

exabrial 6y ago
Yubico 5c by far. There is also "soft tokens" that are software devices.
tialaramex 6y ago
If you mostly use a desktop or laptop, purchase two different FIDO authenticators that match the form factor you need. If purchasing a new laptop (or having one purchased for you) and you run Windows or Mac OS consider fingerprint devices that can turn it into a "Platform Authenticator" able to prove that the person with the authorised fingerprint and the machine authorised are together and wish to sign in. If you mostly use a phone, look for a newer iPhone or for select Androids (e.g. Google's "Pixel" series) with fingerprint readers, again these function as a platform authenticator. Unfortunately for the latter case U2F isn't an option. Sites should be migrating to WebAuthn (and please people do not implement U2F instead of WebAuthn in 2020, for the same reason you wouldn't build a new Flash video site, nothing new supports that technology any more, stop it) Today GitLab is U2F only, there is a logical upgrade path to WebAuthn, and they seem to be working through a bunch of patches to land it, but for now it's less compatible with a site with WebAuthn (e.g. GitHub). So that means if you use the site largely or exclusively from a phone hardware tokens do not buy you much yet.
- papaf 6y ago
  Sites should be migrating to WebAuthn (and please people do not implement U2F instead of WebAuthn in 2020, for the same reason you wouldn't build a new Flash video site, nothing new supports that technology any more, stop it) I think this is terrible advice because WebAuthn isn't supported by Linux browsers and I still want to be able to login to services on the internet.
  - tialaramex 6y ago
    Which "Linux browsers" are you thinking of? Firefox only implements WebAuthn, including on Linux, the U2F support in Firefox is essentially a "reverse polyfill" in which the browser pretends it can do U2F but actually is just wiring some commonly used parts of U2F to the WebAuthn implementation to tide you over until your site gets WebAuthn. Chrome on Linux certainly supports WebAuthn although it does have U2F support. I'm sure Lynx can't do WebAuthn, but I'm also 100% sure I don't care.
    - papaf 6y ago
      This site does not work for me with Firefox 79.0 on Linux with a Yubikey 5: https://demo.yubico.com/webauthn https://demo.yubico.com/webauthn Is this a problem with the backend rather the browser? Edit: This site works https://webauthn.io/ https://webauthn.io/ My mistake!
      - tialaramex 6y ago
        The anti-fingerprinting in Firefox will flag that first site you linked. The site is asking your FIDO Authenticator to provide "attestation". In theory this could be useful to require users to pick a high quality authenticator. It might make sense, for example for Big Bank to require customers use an authenticator Big Bank bought in bulk with Big Bank branding, because they trust it. But, although countermeasures against tracking were incorporated in the FIDO design for attestation, it is unavoidably a potential privacy risk and so Firefox decided to flag it. Sites which try to ask for attestation during registration get a "Fingerprint" icon in newer Firefox versions. Click the fingerprint and opt either to press on anyway or to Anonymise the authentication (essentially pretend your device hasn't got any attestation) on this site. For a site owner: Do not do attestation just because it seems cool and worked in Edge or whatever. If you don't need this sensitive information do not request it. You need to work out a policy, which authenticators are OK and which aren't - if that seems like too much then don't do attestation. If the answer is "actually any authenticator seems good" then don't do attestation. If you allow users to just not have an authenticator (100% of general purpose web sites today) then don't do attestation for those who want one. If you are throwing the data away because you have no idea how to process it don't do attestation.
graton 6y ago
Well the best in my opinion is Yubikey from Yubico. Though not the $20-$25 version which is only U2F, it is still good but not the best. The Yubikeys do more than just U2F, they also support storing 32 TOTP codes, PGP keys, and other things. I like the Nano versions as I can leave them connected to my PC at all times. Recommend an NFC one that you can have on your keyring as it can then be used with your phone. In reality though almost any U2F token is all you need, and they can be purchased for about $20.

Yubico 5c by far. There is also "soft tokens" that are software devices.

If you mostly use a desktop or laptop, purchase two different FIDO authenticators that match the form factor you need. If purchasing a new laptop (or having one purchased for you) and you run Windows or Mac OS consider fingerprint devices that can turn it into a "Platform Authenticator" able to prove that the person with the authorised fingerprint and the machine authorised are together and wish to sign in. If you mostly use a phone, look for a newer iPhone or for select Androids (e.g. Google's "Pixel" series) with fingerprint readers, again these function as a platform authenticator. Unfortunately for the latter case U2F isn't an option. Sites should be migrating to WebAuthn (and please people do not implement U2F instead of WebAuthn in 2020, for the same reason you wouldn't build a new Flash video site, nothing new supports that technology any more, stop it) Today GitLab is U2F only, there is a logical upgrade path to WebAuthn, and they seem to be working through a bunch of patches to land it, but for now it's less compatible with a site with WebAuthn (e.g. GitHub). So that means if you use the site largely or exclusively from a phone hardware tokens do not buy you much yet.

papaf 6y ago
Sites should be migrating to WebAuthn (and please people do not implement U2F instead of WebAuthn in 2020, for the same reason you wouldn't build a new Flash video site, nothing new supports that technology any more, stop it) I think this is terrible advice because WebAuthn isn't supported by Linux browsers and I still want to be able to login to services on the internet.
- tialaramex 6y ago
  Which "Linux browsers" are you thinking of? Firefox only implements WebAuthn, including on Linux, the U2F support in Firefox is essentially a "reverse polyfill" in which the browser pretends it can do U2F but actually is just wiring some commonly used parts of U2F to the WebAuthn implementation to tide you over until your site gets WebAuthn. Chrome on Linux certainly supports WebAuthn although it does have U2F support. I'm sure Lynx can't do WebAuthn, but I'm also 100% sure I don't care.
  - papaf 6y ago
    This site does not work for me with Firefox 79.0 on Linux with a Yubikey 5: https://demo.yubico.com/webauthn https://demo.yubico.com/webauthn Is this a problem with the backend rather the browser? Edit: This site works https://webauthn.io/ https://webauthn.io/ My mistake!
    - tialaramex 6y ago
      The anti-fingerprinting in Firefox will flag that first site you linked. The site is asking your FIDO Authenticator to provide "attestation". In theory this could be useful to require users to pick a high quality authenticator. It might make sense, for example for Big Bank to require customers use an authenticator Big Bank bought in bulk with Big Bank branding, because they trust it. But, although countermeasures against tracking were incorporated in the FIDO design for attestation, it is unavoidably a potential privacy risk and so Firefox decided to flag it. Sites which try to ask for attestation during registration get a "Fingerprint" icon in newer Firefox versions. Click the fingerprint and opt either to press on anyway or to Anonymise the authentication (essentially pretend your device hasn't got any attestation) on this site. For a site owner: Do not do attestation just because it seems cool and worked in Edge or whatever. If you don't need this sensitive information do not request it. You need to work out a policy, which authenticators are OK and which aren't - if that seems like too much then don't do attestation. If the answer is "actually any authenticator seems good" then don't do attestation. If you allow users to just not have an authenticator (100% of general purpose web sites today) then don't do attestation for those who want one. If you are throwing the data away because you have no idea how to process it don't do attestation.

graton 6y ago

Well the best in my opinion is Yubikey from Yubico. Though not the $20-$25 version which is only U2F, it is still good but not the best. The Yubikeys do more than just U2F, they also support storing 32 TOTP codes, PGP keys, and other things. I like the Nano versions as I can leave them connected to my PC at all times. Recommend an NFC one that you can have on your keyring as it can then be used with your phone. In reality though almost any U2F token is all you need, and they can be purchased for about $20.