5 ms·

I think Yubikey (and similar physical solutions) will eventually gain popularity. Carrying a key is pretty much a standard practice across the globe and benefit

I think Yubikey (and similar physical solutions) will eventually gain popularity. Carrying a key is pretty much a standard practice across the globe and benefit is more than negligible because it forces physical attack versus remote/virtual.

cxr 6y ago
Instead of a hardware authenticator to be carried on a keyring, they should be put into rings, i.e., the things meant to be worn on your fingers, i.e., the things that most people use for providing input to their computing devices, whether they sit on a desk or are held in one's hands.
- hehehaha 6y ago
  This is actually brilliant.
- tilsammans 6y ago
  I had one twenty years ago, a Java Ring. Apparently they are still being made today.
MrStonedOne 6y ago
Until keys become cloneable they will never gain popularity. Nobody wants to re-setup every site ever because they lost their laptop that they kept it plugged into, so they won't. either this means using their backup until they lose it without even revoking the original and then swearing off the entire concept while telling all their friends to do the same, or just not using hardware tokens after the first lost of keys. Also the "back up code" they will also get, guess where thats going! save as -> downloads or print2pdf -> downloads. When it comes to personal account security by end users, hardware tokens will never take off, and this is why they get so much hate. There is a real problem here that really needs to be really solved, wrt to end users and phishing/hack resistant credentials, and as long as we legitimize the lie that yubikey solves it, we gimp progress towards actually solving it.
- hehehaha 6y ago
  I am not understanding your concern. You definitely don’t want the keys to be “cloneable”. You need at least two keys, sure, but I don’t see that as an inconvenience. And you should be using a password manager (with passwords cycled on a periodic basis) that is bound to your physical key.
- rstuart4133 6y ago
  I don't think cloneable is a good idea. If some 3rd party clones your token and uses it to commit a crime there is no way to prove that happened. There are other solutions. Being able to make one key a proxy for another is one. That allows you to keep your master identity in a bank vault, and then use it to "sign" the one you keep on you during the day. Should you lose your daily driver, just sign another one. This still suffers from the "one true name" problem though - if someone steals that bank vault ID, you're gone. Another approach is servers allowing a client to register multiple ID's, and later delete them. Since there are multiple ID's, there isn't one true name any more. If one is lost you cancel it, and replace it with another. The approach is already built into the FIDO2 protocol, so they've already thought about your concerns and solved them, and IMHO solved them in a better way than you propose. A more robust approach still would be a combination of the idea above: FIDO2 multiple ID's solution, plus proxies. One key could then provide multiple ID's to every server you log into, signed by different masters that are stored in different places. Keys can't be copied, but a lost key can be replaced by signing it with the master. A compromised master can be have all it's ID's dropped by logging in with an ID proxying other master. You could think of it as RAID for 2FA's.
  - MrStonedOne 6y ago
    > Being able to make one key a proxy for another is one. That allows you to keep your master identity in a bank vault, and then use it to "sign" the one you keep on you during the day. Yes, clonable tokens. Exactly. When people ask for clonable tokens. This is an acceptable solution. (But skip the bank vault. This is for avg Joe, not Jeff bezos. The closest safe will do)
RajBhai 6y ago
I've long thought that U2F should be incorporated into phones, since everyone has one of those. Even not well off people in third world countries. In order for U2F to proliferate, everyone should have access to it. A $10 FIDO key probably won't be given a consideration if they think a free password is good enough.
- tialaramex 6y ago
  WebAuthn is the modern replacement for U2F. Do not deploy greenfield U2F, it's a legacy technology only. A modern iPhone or high-end Android phone already does WebAuthn secured with your fingerprint or (on some iPhone models) facial recognition, like your lock screen or contactless payments.

cxr 6y ago

Instead of a hardware authenticator to be carried on a keyring, they should be put into rings, i.e., the things meant to be worn on your fingers, i.e., the things that most people use for providing input to their computing devices, whether they sit on a desk or are held in one's hands.

hehehaha 6y ago
This is actually brilliant.
tilsammans 6y ago
I had one twenty years ago, a Java Ring. Apparently they are still being made today.

MrStonedOne 6y ago

Until keys become cloneable they will never gain popularity. Nobody wants to re-setup every site ever because they lost their laptop that they kept it plugged into, so they won't. either this means using their backup until they lose it without even revoking the original and then swearing off the entire concept while telling all their friends to do the same, or just not using hardware tokens after the first lost of keys. Also the "back up code" they will also get, guess where thats going! save as -> downloads or print2pdf -> downloads. When it comes to personal account security by end users, hardware tokens will never take off, and this is why they get so much hate. There is a real problem here that really needs to be really solved, wrt to end users and phishing/hack resistant credentials, and as long as we legitimize the lie that yubikey solves it, we gimp progress towards actually solving it.

hehehaha 6y ago
I am not understanding your concern. You definitely don’t want the keys to be “cloneable”. You need at least two keys, sure, but I don’t see that as an inconvenience. And you should be using a password manager (with passwords cycled on a periodic basis) that is bound to your physical key.
rstuart4133 6y ago
I don't think cloneable is a good idea. If some 3rd party clones your token and uses it to commit a crime there is no way to prove that happened. There are other solutions. Being able to make one key a proxy for another is one. That allows you to keep your master identity in a bank vault, and then use it to "sign" the one you keep on you during the day. Should you lose your daily driver, just sign another one. This still suffers from the "one true name" problem though - if someone steals that bank vault ID, you're gone. Another approach is servers allowing a client to register multiple ID's, and later delete them. Since there are multiple ID's, there isn't one true name any more. If one is lost you cancel it, and replace it with another. The approach is already built into the FIDO2 protocol, so they've already thought about your concerns and solved them, and IMHO solved them in a better way than you propose. A more robust approach still would be a combination of the idea above: FIDO2 multiple ID's solution, plus proxies. One key could then provide multiple ID's to every server you log into, signed by different masters that are stored in different places. Keys can't be copied, but a lost key can be replaced by signing it with the master. A compromised master can be have all it's ID's dropped by logging in with an ID proxying other master. You could think of it as RAID for 2FA's.
- MrStonedOne 6y ago
  > Being able to make one key a proxy for another is one. That allows you to keep your master identity in a bank vault, and then use it to "sign" the one you keep on you during the day. Yes, clonable tokens. Exactly. When people ask for clonable tokens. This is an acceptable solution. (But skip the bank vault. This is for avg Joe, not Jeff bezos. The closest safe will do)

RajBhai 6y ago

I've long thought that U2F should be incorporated into phones, since everyone has one of those. Even not well off people in third world countries. In order for U2F to proliferate, everyone should have access to it. A $10 FIDO key probably won't be given a consideration if they think a free password is good enough.

tialaramex 6y ago
WebAuthn is the modern replacement for U2F. Do not deploy greenfield U2F, it's a legacy technology only. A modern iPhone or high-end Android phone already does WebAuthn secured with your fingerprint or (on some iPhone models) facial recognition, like your lock screen or contactless payments.