4 ms·

2FA isn't inherently insecure, and hardware tokens are not that much better IMO than an encrypted USB drive. I agree $50 is too much for a glorified USB drive w

2FA isn't inherently insecure, and hardware tokens are not that much better IMO than an encrypted USB drive. I agree $50 is too much for a glorified USB drive with tamper-resistant chips. Prob could achieve near the same thing with some hot glue. I'm on the same page though, the issue with hardware tokens is that they can easily be lost thus causing you potentially to lose access to accounts or make replacing the token on your account way more difficult.

vorpalhex 5y ago
You are supposed to have multiple hardware tokens all enrolled so you have backups.. but the hardware tokens are a bit pricey and several implementors have failed to read the spec and only let you enroll a single token.
- tialaramex 5y ago
  I will ask, as I always do, for a list of these "several implementors" who don't obey the WebAuthn spec. Note that even if dozens of you say "AWS" that's just one bad implementation, not several.
  - nucleardog 5y ago
    I'm assuming you're someone that uses some sort of hardware tokens--if not, ignore this. How do you manage your tokens with WebAuthn? I have several but I've never really used them as much besides a repository for TOTP tokens because I just can't wrap my head around it. So I've got one I leave in my device, another I leave laying around the house as a "backup", and another I'm supposed to keep secure off-site somewhere. I register a new account. What's the process? Register on the one I've got in my device because of course. Then go dig out my backup token and add that to the account. Then... ? Pull out a journal and write down the account I've created, swing by the bank once a week/month/quarter to swap my on-site backup for the off-site, go back through my journal and find every account I've created during that time period and enroll the new backup token? What happens if my house burns down during the week/month/quarter I've registered a new account? Is that account just gone? This is easily mitigated with TOTP--just put the TOTP secret into a separate keepass file. As soon as I've registered it's backed up off-site. I'm very risk averse in this area, so I just can't see a path to using webauthn that makes any sense.
    - tialaramex 5y ago
      > What happens if my house burns down during the week/month/quarter I've registered a new account? Is that account just gone? Well no, the account is still there but you can't access it. I'd be pretty happy with the outcome where a major disaster's most annoying effect is "I lost my HN karma" or "I have to make a new GitHub account, although all my existing code is still available to download". Maybe your house burns down a lot, but most people go decades without that happening, so, it's OK if it sucks pretty badly when it happens. I'm not comfortable losing everything. But most of the entities who have a relationship I need to stay alive after a major disaster are already used to this in other cases. I am not going to be the first account holder at my good bank whose worldly possessions were all destroyed in a house fire. It may take a few days, and a lot of inconvenience, but hey, my house burned down so I think the inconvenience isn't the worst part of the scenario. Even Google promises (vaguely) to make it possible for you to recover access to your account with them, despite using WebAuthn, in the event of such disasters. The government is another example. Ordinarily they'd prefer I used WebAuthn (actually they seem unduly keen on SMS, but I use WebAuthn) but if my house burned down they can see their way to consulting their database of e.g. photographs of me, records of where I live (oh, the place that burned down well that makes sense) and so on instead to confirm my identity manually. Edited to add: You know what, people vary. Maybe you can never be comfortable without setting up TOTP "just in case". Fine. But what I suggest to you is: Don't actually use it. The phishing protection of WebAuthn is effective even if you have TOTP setup so long as you don't let the phishers persuade you to use TOTP. Keep TOTP for when your house has burned down, and all the rest of the time you have that protection. You do lose some other WebAuthn benefits (e.g. bad guys can steal all the other credentials, passwords, TOTP secrets, SMS codes, from e.g. a server break-in, but it doesn't mean anything to steal your WebAuthn credentials because the relying party doesn't have any secret credentials, that's the whole point of the design) but phishing is the #1 win
    - encryptluks2 5y ago
      This is my opinion as well. TOTP info can be encrypted, many programs offer phishing protection for TOTP tokens. I just don't see the value of hardware tokens where the hardware token can be compromised, and the credentials to access them can be as well.

vorpalhex 5y ago

You are supposed to have multiple hardware tokens all enrolled so you have backups.. but the hardware tokens are a bit pricey and several implementors have failed to read the spec and only let you enroll a single token.

tialaramex 5y ago
I will ask, as I always do, for a list of these "several implementors" who don't obey the WebAuthn spec. Note that even if dozens of you say "AWS" that's just one bad implementation, not several.
- nucleardog 5y ago
  I'm assuming you're someone that uses some sort of hardware tokens--if not, ignore this. How do you manage your tokens with WebAuthn? I have several but I've never really used them as much besides a repository for TOTP tokens because I just can't wrap my head around it. So I've got one I leave in my device, another I leave laying around the house as a "backup", and another I'm supposed to keep secure off-site somewhere. I register a new account. What's the process? Register on the one I've got in my device because of course. Then go dig out my backup token and add that to the account. Then... ? Pull out a journal and write down the account I've created, swing by the bank once a week/month/quarter to swap my on-site backup for the off-site, go back through my journal and find every account I've created during that time period and enroll the new backup token? What happens if my house burns down during the week/month/quarter I've registered a new account? Is that account just gone? This is easily mitigated with TOTP--just put the TOTP secret into a separate keepass file. As soon as I've registered it's backed up off-site. I'm very risk averse in this area, so I just can't see a path to using webauthn that makes any sense.
  - tialaramex 5y ago
    > What happens if my house burns down during the week/month/quarter I've registered a new account? Is that account just gone? Well no, the account is still there but you can't access it. I'd be pretty happy with the outcome where a major disaster's most annoying effect is "I lost my HN karma" or "I have to make a new GitHub account, although all my existing code is still available to download". Maybe your house burns down a lot, but most people go decades without that happening, so, it's OK if it sucks pretty badly when it happens. I'm not comfortable losing everything. But most of the entities who have a relationship I need to stay alive after a major disaster are already used to this in other cases. I am not going to be the first account holder at my good bank whose worldly possessions were all destroyed in a house fire. It may take a few days, and a lot of inconvenience, but hey, my house burned down so I think the inconvenience isn't the worst part of the scenario. Even Google promises (vaguely) to make it possible for you to recover access to your account with them, despite using WebAuthn, in the event of such disasters. The government is another example. Ordinarily they'd prefer I used WebAuthn (actually they seem unduly keen on SMS, but I use WebAuthn) but if my house burned down they can see their way to consulting their database of e.g. photographs of me, records of where I live (oh, the place that burned down well that makes sense) and so on instead to confirm my identity manually. Edited to add: You know what, people vary. Maybe you can never be comfortable without setting up TOTP "just in case". Fine. But what I suggest to you is: Don't actually use it. The phishing protection of WebAuthn is effective even if you have TOTP setup so long as you don't let the phishers persuade you to use TOTP. Keep TOTP for when your house has burned down, and all the rest of the time you have that protection. You do lose some other WebAuthn benefits (e.g. bad guys can steal all the other credentials, passwords, TOTP secrets, SMS codes, from e.g. a server break-in, but it doesn't mean anything to steal your WebAuthn credentials because the relying party doesn't have any secret credentials, that's the whole point of the design) but phishing is the #1 win
  - encryptluks2 5y ago
    This is my opinion as well. TOTP info can be encrypted, many programs offer phishing protection for TOTP tokens. I just don't see the value of hardware tokens where the hardware token can be compromised, and the credentials to access them can be as well.