4 ms·
It seems like you don't understand the main advantage of these types of security tokens. Rogue trigger of a security token isn't really an issue when using the
by CyberRage 6y ago
It seems like you don't understand the main advantage of these types of security tokens.
Rogue trigger of a security token isn't really an issue when using the recommended U2F standard.
U2F uses the domain as part of the challenge-response in U2F so that phishing\spoofing attacks can be defeated.
- suprfsat 6y agoYubikeys can perform many functions; the one in the article is an OTP which can be accidentally pasted into Slack.
- Thorrez 6y agoYes. But the main insecurity isn't accidental pastes, it's being phished. The company the author of this article works for needs to switch to U2F.
- Spivak 6y agoIf the only phishing protection you find meaningful for 2FA tokens is domain matching then any extension-based password manager like Bitwarden will work with far less hassle than needing a physical token or your phone.
- Thorrez 6y agoJust hope your password manager's password doesn't get phished. > or your phone. Using your phone for 2FA doesn't provide any phishing protection that I know of. What realistic attacks is a non-U2F Yubikey protecting against that TOTP (Google Authenticator) won't protect against?