3 ms·

Are there any downsides to security keys as 2FA? Are they using a single standard that shouldn't accidentally change or be deprecated for some reason? Is it pos

by butz 4y ago

Are there any downsides to security keys as 2FA? Are they using a single standard that shouldn't accidentally change or be deprecated for some reason? Is it possible to use them on mobile devices? Are there any risks they might break? Any issues with Linux support? Which particular security key would you recommend and why?

otachack 4y ago
Not that I know of, but you should definitely at least enable a second form of 2FA like the recovery codes OR a second security key, then print/write/store the file/key somewhere. If you lose your primary, then you can use that secondary. Never just have 1 form of 2FA without a fallback.
mzs 4y ago
I don't have a cellphone or usb dongle and don't want them.
- waynesonfire 4y ago
  you can get a tiny one and keep it plugged into your laptop
  - mzs 4y ago
    Okay so which one do I buy and how do I use it with ssh. The documentation is not specific.
    - waynesonfire 4y ago
      yubikey 5 nano, get two. i use it w/ ssh. took a little googling to integrate the gpg authentications key w/ ssh. instead of using ssh-agent, you'd use gpg-agent to manage the keys. there are other integrations, for example, i can also unlock my mac w/ the yubikey.
      - newjersey 4y ago
        On gnome on fedora at least, I can have my gpg automatically unlock when I login to the desktop. I already have two steps on GitHub with the authy app but I don't get it. Why is it not good enough to send an email with a code when signing in without a cookie for people who don't want to opt in to two steps? The way I see it my authy is a vulnerability because if someone were to guess my authy phone number, they could technically grab all of my TOTP. I don't get this spoon feeding. I mean I would sign up to two steps where I can but something doesn't feel right about the lack of choice.
        waynesonfire 4y ago
        i hate checking email or looking at my phone for two step auth. either choice requires me to access another system. It requires far fewer steps to just tap the button on the side of the yubikey.
      - mzs 4y ago
        It's pricey but looks like it won't be too warty, thanks. https://forums.freebsd.org/threads/yubikey-5-nfc-not-working-with-yubioath-desktop-py-yubikey-manager-and-py-yubikey-manage-qt.78025/ https://forums.freebsd.org/threads/yubikey-5-nfc-not-working...
    - newjersey 4y ago
      > Okay so which one do I buy and how do I use it with ssh. The documentation is not specific. Oh crap, I was thinking this doesn't affect me because I already have two factors authentication but yes if I need to fish out my phone every time I need to git something (I use sash, not tokens) that requires authentication, I will definitely minimize what I do on GitHub.
    - saltcured 4y ago
      The github.com documentation pages I read on this topic yesterday said the MFA requirement was for web sign-on and https GIT repo URLs. It explicitly said that SSH-based git repo access would not be affected. Has anyone seen contradictory statements published by github? Edit to add: I mean SSH git access using a keypair registered with your account. (I don't know if there is some legacy option to use SSH with passwords, which I imagine would be discontinued if not already.)
- jrochkind1 4y ago
  As far as complying with 2FA requirements without these, if TOTP is an option, one way is to use Authy with desktop client. It's free. How secure it is I can't really say. But it will allow you to access services requiring TOTP without a cellphone or usb dongle. https://authy.com/blog/introducing-authy-for-your-personal-computer/ https://authy.com/blog/introducing-authy-for-your-personal-c...
  - eulers_secret 4y ago
    If you're as crazy as I am, it looks like oauthtool+gnupg2 can do TOTP via the command-line on Linux as well. I think it's just another function that my homeserver will take over (or maybe a container). At least I can easily integrate this new info into my backup system, unlike apps on my phone...
    - jrochkind1 4y ago
      There is also an Authy linux app, but, sure, open source command-line sounds great.
manquer 4y ago
I have used various products from yubikey they work well on both Linux and Mac and you can also store gpg keys on them for commit signing and so on Install experience is not the best , but drivers work well
sdfgdfgbsdfg 4y ago
For security keys implementing FIDO (which sometimes you can see referred to as WebAuthn, although that is partially inaccurate), there is currently no good way of backing up the key. If you lose it, then you'll need to recover your account with every service you had it registed it with, meaning that you'll need at least an additional factor on each service that's most likely not as secure as a FIDO key, unless you're registering two keys for every service which is very cumbersome and still makes you re register a lost key with each service. There are proposals to address this either by chaining trust between security keys or by sharing "passkeys" (a webauthn credential). see https://news.ycombinator.com/item?id=31272867 https://news.ycombinator.com/item?id=31272867 Only apple implements it today as far as I know so there's no good way to recover from a lost or damaged key if you're not exclusively in the apple ecosystem

by butz 4y ago

otachack 4y ago

Not that I know of, but you should definitely at least enable a second form of 2FA like the recovery codes OR a second security key, then print/write/store the file/key somewhere. If you lose your primary, then you can use that secondary. Never just have 1 form of 2FA without a fallback.

mzs 4y ago

I don't have a cellphone or usb dongle and don't want them.

waynesonfire 4y ago
you can get a tiny one and keep it plugged into your laptop
- mzs 4y ago
  Okay so which one do I buy and how do I use it with ssh. The documentation is not specific.
  - waynesonfire 4y ago
    yubikey 5 nano, get two. i use it w/ ssh. took a little googling to integrate the gpg authentications key w/ ssh. instead of using ssh-agent, you'd use gpg-agent to manage the keys. there are other integrations, for example, i can also unlock my mac w/ the yubikey.
    - newjersey 4y ago
      On gnome on fedora at least, I can have my gpg automatically unlock when I login to the desktop. I already have two steps on GitHub with the authy app but I don't get it. Why is it not good enough to send an email with a code when signing in without a cookie for people who don't want to opt in to two steps? The way I see it my authy is a vulnerability because if someone were to guess my authy phone number, they could technically grab all of my TOTP. I don't get this spoon feeding. I mean I would sign up to two steps where I can but something doesn't feel right about the lack of choice.
      - waynesonfire 4y ago
        i hate checking email or looking at my phone for two step auth. either choice requires me to access another system. It requires far fewer steps to just tap the button on the side of the yubikey.
    - mzs 4y ago
      It's pricey but looks like it won't be too warty, thanks. https://forums.freebsd.org/threads/yubikey-5-nfc-not-working-with-yubioath-desktop-py-yubikey-manager-and-py-yubikey-manage-qt.78025/ https://forums.freebsd.org/threads/yubikey-5-nfc-not-working...
  - newjersey 4y ago
    > Okay so which one do I buy and how do I use it with ssh. The documentation is not specific. Oh crap, I was thinking this doesn't affect me because I already have two factors authentication but yes if I need to fish out my phone every time I need to git something (I use sash, not tokens) that requires authentication, I will definitely minimize what I do on GitHub.
  - saltcured 4y ago
    The github.com documentation pages I read on this topic yesterday said the MFA requirement was for web sign-on and https GIT repo URLs. It explicitly said that SSH-based git repo access would not be affected. Has anyone seen contradictory statements published by github? Edit to add: I mean SSH git access using a keypair registered with your account. (I don't know if there is some legacy option to use SSH with passwords, which I imagine would be discontinued if not already.)
jrochkind1 4y ago
As far as complying with 2FA requirements without these, if TOTP is an option, one way is to use Authy with desktop client. It's free. How secure it is I can't really say. But it will allow you to access services requiring TOTP without a cellphone or usb dongle. https://authy.com/blog/introducing-authy-for-your-personal-computer/ https://authy.com/blog/introducing-authy-for-your-personal-c...
- eulers_secret 4y ago
  If you're as crazy as I am, it looks like oauthtool+gnupg2 can do TOTP via the command-line on Linux as well. I think it's just another function that my homeserver will take over (or maybe a container). At least I can easily integrate this new info into my backup system, unlike apps on my phone...
  - jrochkind1 4y ago
    There is also an Authy linux app, but, sure, open source command-line sounds great.

manquer 4y ago

I have used various products from yubikey they work well on both Linux and Mac and you can also store gpg keys on them for commit signing and so on Install experience is not the best , but drivers work well

sdfgdfgbsdfg 4y ago

For security keys implementing FIDO (which sometimes you can see referred to as WebAuthn, although that is partially inaccurate), there is currently no good way of backing up the key. If you lose it, then you'll need to recover your account with every service you had it registed it with, meaning that you'll need at least an additional factor on each service that's most likely not as secure as a FIDO key, unless you're registering two keys for every service which is very cumbersome and still makes you re register a lost key with each service. There are proposals to address this either by chaining trust between security keys or by sharing "passkeys" (a webauthn credential). see https://news.ycombinator.com/item?id=31272867 https://news.ycombinator.com/item?id=31272867 Only apple implements it today as far as I know so there's no good way to recover from a lost or damaged key if you're not exclusively in the apple ecosystem