4 ms·

There should be a better solution for 2FA now especially with cryptocurrency all the rage now. Like a small waterproof chip that can be attached to your skin (m

There should be a better solution for 2FA now especially with cryptocurrency all the rage now. Like a small waterproof chip that can be attached to your skin (maybe upper elbow) with an RFID. Why hasn't such a product been invented yet? Currently there is the YubiKey, Ledger, Trezor, which all cost $25-70. Just for a USB that can generate a OTP (I'm oversimplifying but does what they do really cost $50?). Then there is Duo mobile for phones, which may be slightly less secure but is probably better for most cases. But both suffer from the situation where you can lose your key.

encryptluks2 5y ago
2FA isn't inherently insecure, and hardware tokens are not that much better IMO than an encrypted USB drive. I agree $50 is too much for a glorified USB drive with tamper-resistant chips. Prob could achieve near the same thing with some hot glue. I'm on the same page though, the issue with hardware tokens is that they can easily be lost thus causing you potentially to lose access to accounts or make replacing the token on your account way more difficult.
- vorpalhex 5y ago
  You are supposed to have multiple hardware tokens all enrolled so you have backups.. but the hardware tokens are a bit pricey and several implementors have failed to read the spec and only let you enroll a single token.
  - tialaramex 5y ago
    I will ask, as I always do, for a list of these "several implementors" who don't obey the WebAuthn spec. Note that even if dozens of you say "AWS" that's just one bad implementation, not several.
    - nucleardog 5y ago
      I'm assuming you're someone that uses some sort of hardware tokens--if not, ignore this. How do you manage your tokens with WebAuthn? I have several but I've never really used them as much besides a repository for TOTP tokens because I just can't wrap my head around it. So I've got one I leave in my device, another I leave laying around the house as a "backup", and another I'm supposed to keep secure off-site somewhere. I register a new account. What's the process? Register on the one I've got in my device because of course. Then go dig out my backup token and add that to the account. Then... ? Pull out a journal and write down the account I've created, swing by the bank once a week/month/quarter to swap my on-site backup for the off-site, go back through my journal and find every account I've created during that time period and enroll the new backup token? What happens if my house burns down during the week/month/quarter I've registered a new account? Is that account just gone? This is easily mitigated with TOTP--just put the TOTP secret into a separate keepass file. As soon as I've registered it's backed up off-site. I'm very risk averse in this area, so I just can't see a path to using webauthn that makes any sense.
      - tialaramex 5y ago
        > What happens if my house burns down during the week/month/quarter I've registered a new account? Is that account just gone? Well no, the account is still there but you can't access it. I'd be pretty happy with the outcome where a major disaster's most annoying effect is "I lost my HN karma" or "I have to make a new GitHub account, although all my existing code is still available to download". Maybe your house burns down a lot, but most people go decades without that happening, so, it's OK if it sucks pretty badly when it happens. I'm not comfortable losing everything. But most of the entities who have a relationship I need to stay alive after a major disaster are already used to this in other cases. I am not going to be the first account holder at my good bank whose worldly possessions were all destroyed in a house fire. It may take a few days, and a lot of inconvenience, but hey, my house burned down so I think the inconvenience isn't the worst part of the scenario. Even Google promises (vaguely) to make it possible for you to recover access to your account with them, despite using WebAuthn, in the event of such disasters. The government is another example. Ordinarily they'd prefer I used WebAuthn (actually they seem unduly keen on SMS, but I use WebAuthn) but if my house burned down they can see their way to consulting their database of e.g. photographs of me, records of where I live (oh, the place that burned down well that makes sense) and so on instead to confirm my identity manually. Edited to add: You know what, people vary. Maybe you can never be comfortable without setting up TOTP "just in case". Fine. But what I suggest to you is: Don't actually use it. The phishing protection of WebAuthn is effective even if you have TOTP setup so long as you don't let the phishers persuade you to use TOTP. Keep TOTP for when your house has burned down, and all the rest of the time you have that protection. You do lose some other WebAuthn benefits (e.g. bad guys can steal all the other credentials, passwords, TOTP secrets, SMS codes, from e.g. a server break-in, but it doesn't mean anything to steal your WebAuthn credentials because the relying party doesn't have any secret credentials, that's the whole point of the design) but phishing is the #1 win
J5892 5y ago
> Why hasn't such a product been invented yet? The YubiKey Nano is really small. I'm sure a skilled piercer could find a way to get it under your skin.
- InitialBP 5y ago
  The YubiKey's that support NFC are all significantly larger. The Nano does not currently support NFC. Size is a challenge with NFC specifically as I believe larger NFC chips lead to larger area of allowable communication.
  - aledalgrande 5y ago
    You have your elbow close to your laptop anyways... might as well plug in.
tialaramex 5y ago
The FIDO (and at this price you're probably buying FIDO2) authenticators aren't generating an OTP, they're doing public key crypto to prove they're the same key as you enrolled. There have been several open hardware designs in this space, so if you can do a lot better that seems like you should go into business. And since you mentioned phones, a nice modern phone, with a fingerprint reader or similar, is also a Security Key for this purpose anyway. Google even have a prototype for the scenario where your (Android) phone is a valid Security Key, your desktop or laptop with Bluetooth and Chrome can see it nearby, so it lets you authenticate from the phone for desktop web pages.

encryptluks2 5y ago

2FA isn't inherently insecure, and hardware tokens are not that much better IMO than an encrypted USB drive. I agree $50 is too much for a glorified USB drive with tamper-resistant chips. Prob could achieve near the same thing with some hot glue. I'm on the same page though, the issue with hardware tokens is that they can easily be lost thus causing you potentially to lose access to accounts or make replacing the token on your account way more difficult.

vorpalhex 5y ago
You are supposed to have multiple hardware tokens all enrolled so you have backups.. but the hardware tokens are a bit pricey and several implementors have failed to read the spec and only let you enroll a single token.
- tialaramex 5y ago
  I will ask, as I always do, for a list of these "several implementors" who don't obey the WebAuthn spec. Note that even if dozens of you say "AWS" that's just one bad implementation, not several.
  - nucleardog 5y ago
    I'm assuming you're someone that uses some sort of hardware tokens--if not, ignore this. How do you manage your tokens with WebAuthn? I have several but I've never really used them as much besides a repository for TOTP tokens because I just can't wrap my head around it. So I've got one I leave in my device, another I leave laying around the house as a "backup", and another I'm supposed to keep secure off-site somewhere. I register a new account. What's the process? Register on the one I've got in my device because of course. Then go dig out my backup token and add that to the account. Then... ? Pull out a journal and write down the account I've created, swing by the bank once a week/month/quarter to swap my on-site backup for the off-site, go back through my journal and find every account I've created during that time period and enroll the new backup token? What happens if my house burns down during the week/month/quarter I've registered a new account? Is that account just gone? This is easily mitigated with TOTP--just put the TOTP secret into a separate keepass file. As soon as I've registered it's backed up off-site. I'm very risk averse in this area, so I just can't see a path to using webauthn that makes any sense.
    - tialaramex 5y ago
      > What happens if my house burns down during the week/month/quarter I've registered a new account? Is that account just gone? Well no, the account is still there but you can't access it. I'd be pretty happy with the outcome where a major disaster's most annoying effect is "I lost my HN karma" or "I have to make a new GitHub account, although all my existing code is still available to download". Maybe your house burns down a lot, but most people go decades without that happening, so, it's OK if it sucks pretty badly when it happens. I'm not comfortable losing everything. But most of the entities who have a relationship I need to stay alive after a major disaster are already used to this in other cases. I am not going to be the first account holder at my good bank whose worldly possessions were all destroyed in a house fire. It may take a few days, and a lot of inconvenience, but hey, my house burned down so I think the inconvenience isn't the worst part of the scenario. Even Google promises (vaguely) to make it possible for you to recover access to your account with them, despite using WebAuthn, in the event of such disasters. The government is another example. Ordinarily they'd prefer I used WebAuthn (actually they seem unduly keen on SMS, but I use WebAuthn) but if my house burned down they can see their way to consulting their database of e.g. photographs of me, records of where I live (oh, the place that burned down well that makes sense) and so on instead to confirm my identity manually. Edited to add: You know what, people vary. Maybe you can never be comfortable without setting up TOTP "just in case". Fine. But what I suggest to you is: Don't actually use it. The phishing protection of WebAuthn is effective even if you have TOTP setup so long as you don't let the phishers persuade you to use TOTP. Keep TOTP for when your house has burned down, and all the rest of the time you have that protection. You do lose some other WebAuthn benefits (e.g. bad guys can steal all the other credentials, passwords, TOTP secrets, SMS codes, from e.g. a server break-in, but it doesn't mean anything to steal your WebAuthn credentials because the relying party doesn't have any secret credentials, that's the whole point of the design) but phishing is the #1 win

J5892 5y ago

> Why hasn't such a product been invented yet? The YubiKey Nano is really small. I'm sure a skilled piercer could find a way to get it under your skin.

InitialBP 5y ago
The YubiKey's that support NFC are all significantly larger. The Nano does not currently support NFC. Size is a challenge with NFC specifically as I believe larger NFC chips lead to larger area of allowable communication.
- aledalgrande 5y ago
  You have your elbow close to your laptop anyways... might as well plug in.

tialaramex 5y ago

The FIDO (and at this price you're probably buying FIDO2) authenticators aren't generating an OTP, they're doing public key crypto to prove they're the same key as you enrolled. There have been several open hardware designs in this space, so if you can do a lot better that seems like you should go into business. And since you mentioned phones, a nice modern phone, with a fingerprint reader or similar, is also a Security Key for this purpose anyway. Google even have a prototype for the scenario where your (Android) phone is a valid Security Key, your desktop or laptop with Bluetooth and Chrome can see it nearby, so it lets you authenticate from the phone for desktop web pages.