6 ms·

Am I the only one who feels lost in all those new security technologies and their various permutations, specifically understanding what's secure, how to back it

Am I the only one who feels lost in all those new security technologies and their various permutations, specifically understanding what's secure, how to back it up etc? We have TOTP, 2nd factor, password managers, security keys, hardware security keys, passkeys, windows hello etc/etc..

Krisjohn 4y ago
It's not just you. Usernames and passwords are easy, if insecure. Type username, type password, done. Get admin to reset password if you forget. Put in password manager if one account is used by a team. Security keys are hard. Needing a physical key around every time you have to log into something is annoying. Backups are hard, because off-site backups can't be done over the Internet. Self-service hardware tokens for services with infamously bad customer service is highly risky. Resetting an account if a key is lost or locked requires physically transferring hardware, which can be hard if someone is traveling, or can cause days of downtime. Team access is basically impossible if an account is secured with a physical key. Authenticators are fine, except if you lose a couple of smartphones too close together, or you need a team to access one account. Password managers that let you securely store the QR code, or actually generate the key put the MFA in the same place as the rest of the credentials, which is not ideal but increasingly necessary for the same reason password managers came into existence in the first place. Windows Hello and FaceID are actually pretty good, although fingerprint-based biometrics can be a little hit and miss. Not that a decent proportion of Windows users have Hello-compatible hardware. Interestingly, two TV shows in just the last few months (The Peripheral and, believe it or not, Mayfair Witches) have had a moment where a phone belonging to a dead or unconscious person was unlocked by showing it their face, so the shortcoming are entering public knowledge. We can "all" agree that passwords are "bad", but we cannot agree on what to replace them with, mostly because the level of computer literacy for most solutions is much higher than just typing in a username and password. I can bang out the stuff above because, as an IT professional, I've experimented with KeePass, Windows Hello and Yubikeys in the last six months, buying my own hardware, to try to find some level of opsec that could be used by our customers. All I've done is highlight the lack of commitment to IT in general and training of all kinds in basically all of our customers.
- hellodanylo 4y ago
  > Authenticators are fine, except if you lose a couple of smartphones too close together, or you need a team to access one account. When you enable TOTP with a service, you can extract the TOTP secret and do all of the above with it -- backup to storage, copy to new devices, distribute to multiple people, etc.
  - Krisjohn 4y ago
    If the service offers something other than a QR code that you did something with other than just adding into a one-way Authenticator, sure. I have a couple of TOTPs trapped on crappy apps because I didn't care at the time and can't easily refresh them. However, now I use apps that parse the QR code and store the config in an exportable way. As we change every damn password in our company LP account, moving it to Bitwarden at the same time, we will implement TOTP MFA wherever we can. If you screenshot the QR code and load it into the accound with the app, all the team with access can use it. It's our next best step. (Once the boss gets the new account sorted.)
    - jve 4y ago
      > other than just adding into a one-way Authenticator, sure. Two-way for tech-savvy: https://news.ycombinator.com/item?id=34441697#34444676 https://news.ycombinator.com/item?id=34441697#34444676
- devman0 4y ago
  FIDO passkeys are supposed to deal with the fiction and provisioning issues you highlight with current fido keys in consumer applications. In enterprise, the status quo is a little more acceptable because generally you have one or a pair of physical keys provisioned to your profile in an IdP that you use across all your apps, and you have a known support structure if your key and backup get lost or fail. In the consumer realm one has to deal with a gajillion different identity authorities so replacing keys or doing recovery because you lost one is a giant pain in the ass. Supposedly passkeys is targeted at that problem. https://fidoalliance.org/passkeys/ https://fidoalliance.org/passkeys/
wslh 4y ago
Yes, handling security keys (custody) is difficult. I think the custody layer is incomplete and we also need more MPC (multi-party computation) features. For example distributing keys along multiple devices and requiring a subset of them to rebuilt it. The problem with the security approaches presented by Apple, Google, et al is that you end up with a single or two dimension of failure: it is easy to forget the key at the end of the chain (e.g. when you travel).
ShredKazoo 4y ago
Let me try and explain some of the terminology (I'm not an expert either so I appreciate corrections from anyone reading). A password manager just helps you store your passwords, and automatically inputs passwords for you. This makes it easier to use a variety of strong passwords. Also the password manager can check for a domain name match before doing its automatic input, which helps provide phishing resistance. "2nd factor" or "multifactor" essentially just means adding on something in addition to passwords. That could be in the form of: * TOTP = "time-based one time password". Use an authenticator app on your phone to input a 6-digit code which changes every 30 seconds or so. * "security keys" / "hardware security keys" -- a dedicated device that allows you to authenticate, e.g. via USB or NFC. Generally considered more secure than TOTP, because the code is more than 6 digits worth of entropy, and also it forces the website requesting the code to authenticate itself before it provides the code (again, helps with phishing resistance). I don't know anything about passkeys or Windows Hello. As for backup, you should be able to transfer all of your TOTPs from one phone to another by scanning a QR code. For hardware security keys, you can buy multiple keys, register all of them, and keep them in different places. Then if you lose one you just use one of the others (and register a replacement to maintain redundancy). For the TOTP, if you're worried about losing your phone, usually when you set up a TOTP you can also copy down some single-use "scratch codes" that can work as a backup if your phone breaks or something like that.
- jhogervorst 4y ago
  > For hardware security keys, you can buy multiple keys, register all of them, and keep them in different places. Then if you lose one you just use one of the others (and register a replacement to maintain redundancy). Do I need to have all keys in my physical possession to register them with a new account? I could imagine having some backup keys in different places, but if I need to collect them every time I want to register them for some new account or service, it sounds like a lot of trouble. (And if the process is too much trouble, the result would be that: (1) I don't use the hardware keys for those accounts, which is less secure; (2) I only register my primary key that I keep nearby, which is dangerous if it would get lost or broken; or (3) my backup keys end up at the same place as the primary one, due to forgetting or being too lazy to put them back, which is also dangerous…)
mihaaly 4y ago
I feel more like restricted. I made the effort to look into security solutions for my important accounts (password only is not that!) and chose a security key solutions but the various providers have very uneven support for that - for example Apple was one notable case. Several forcing you to use phone number based solution (including banks) if you opt for secure ways but that is inadequate and risky on a whole different way for my case. Unacceptable. It is the strong password case all over again: I took the effort to build up a layered approach seting up memorable but strong password categories for the different categories of accounts I have just to be rejected by the odd ones: you are not allowed to use that character! And sometimes: your password must be shorter! Forcing me to their ways, hugely reducing security. Not enough choice.
zahllos 4y ago
I'm not, but I do crypto (as in PKI, smartcards) stuff, so let me try to explain some of the thinking behind hardware keys. The idea of a second factor is that "something you have" is hard for an attacker to also have, however, proof of having something usually means "proof that you know some secret" and that secret itself can often be copied. The lazy "proof you have" something is SMS auth, i.e. proof you control a phone number. However this isn't great, since in some jurisdictions ringing your mobile provider is enough to get control over that number. TOTP then says: let's assume you have some secret seed and I also know it. If I take a hash of it (HOTP) and include some time information I have a code valid for a small window that is hard to steal. The benefit is that everywhere this secret exists you can have an authenticator. The downside is that this is rarely a separate device to your computer. You also are going to enter your code into a website... and that might not be the right website, allowing capture of the code via phishing. The standard for legal, qualified digital signatures in the EU is to have non-extractable keys generated on hardware devices and never backed up. Why? Well, if you lose the hardware token (or it is damaged) you don't lose access to encrypted data, just the ability to sign documents. At this point you have an annoying dance to do to be issued a new token, but allowing backup of the signing key means signatures may be repudiated (because someone else could have stolen the backup). The same goal applies to U2F / FIDO certified security keys. U2F generates a unique key-pair per authentication target and that private key never leaves the authenticator. This gives you two things: 1) a binding between your target service and your device. Phishing becomes a lot more difficult unless you can present the right challenge-response to the authenticator, and 2) an authenticator you physically need to have present, but don't need a pin or awkward copy-paste of a code to use. You aren't using this key for encryption, but for authentication, so, the backup strategy is: have multiple keys. If you lose one, you can delete that entry from respective accounts. Password managers exist because some websites are password-only and even if not, you can't always trust they employed argon2id as a password hash. It also saves you having to remember multiple passwords. Your password database is something you will need to keep backed up. Personally I keep printed recovery codes of really important accounts, spare registered security keys, and a disk with my password database on in a safe place.
fatnoah 4y ago
My family is adept at forgetting passwords and losing physical devices. Keeping track of air pods is a complete nightmare. I can't even imagine adding extra physical devices where I'd have to manage the backups and constantly purchase new ones. Having gone through the hell of dealing with recovering iCloud accounts while not having a bunch of spare Apple devices laying around, I refuse to go beyond SMS for 2FA. Yes, it's certainly less secure, but it's something I can manage and control outside of the Apple ecosystem.
alwillis 4y ago
It may help to understand who this feature is for: This feature is designed for users who, often due to their public profile, face concerted threats to their online accounts, such as celebrities, journalists, and members of government [1]. [1]: https://www.apple.com/newsroom/2022/12/apple-advances-user-security-with-powerful-new-data-protections/ https://www.apple.com/newsroom/2022/12/apple-advances-user-s...
mk89 4y ago
No, and I think that TOTP is sufficient for 99% of cases, but hey that hardware key really makes the difference between a geek and someone else :) plus, there seems to be a recession going on, get out and throw another 2*40 $ to yubico now! :)

Krisjohn 4y ago

It's not just you. Usernames and passwords are easy, if insecure. Type username, type password, done. Get admin to reset password if you forget. Put in password manager if one account is used by a team. Security keys are hard. Needing a physical key around every time you have to log into something is annoying. Backups are hard, because off-site backups can't be done over the Internet. Self-service hardware tokens for services with infamously bad customer service is highly risky. Resetting an account if a key is lost or locked requires physically transferring hardware, which can be hard if someone is traveling, or can cause days of downtime. Team access is basically impossible if an account is secured with a physical key. Authenticators are fine, except if you lose a couple of smartphones too close together, or you need a team to access one account. Password managers that let you securely store the QR code, or actually generate the key put the MFA in the same place as the rest of the credentials, which is not ideal but increasingly necessary for the same reason password managers came into existence in the first place. Windows Hello and FaceID are actually pretty good, although fingerprint-based biometrics can be a little hit and miss. Not that a decent proportion of Windows users have Hello-compatible hardware. Interestingly, two TV shows in just the last few months (The Peripheral and, believe it or not, Mayfair Witches) have had a moment where a phone belonging to a dead or unconscious person was unlocked by showing it their face, so the shortcoming are entering public knowledge. We can "all" agree that passwords are "bad", but we cannot agree on what to replace them with, mostly because the level of computer literacy for most solutions is much higher than just typing in a username and password. I can bang out the stuff above because, as an IT professional, I've experimented with KeePass, Windows Hello and Yubikeys in the last six months, buying my own hardware, to try to find some level of opsec that could be used by our customers. All I've done is highlight the lack of commitment to IT in general and training of all kinds in basically all of our customers.

hellodanylo 4y ago
> Authenticators are fine, except if you lose a couple of smartphones too close together, or you need a team to access one account. When you enable TOTP with a service, you can extract the TOTP secret and do all of the above with it -- backup to storage, copy to new devices, distribute to multiple people, etc.
- Krisjohn 4y ago
  If the service offers something other than a QR code that you did something with other than just adding into a one-way Authenticator, sure. I have a couple of TOTPs trapped on crappy apps because I didn't care at the time and can't easily refresh them. However, now I use apps that parse the QR code and store the config in an exportable way. As we change every damn password in our company LP account, moving it to Bitwarden at the same time, we will implement TOTP MFA wherever we can. If you screenshot the QR code and load it into the accound with the app, all the team with access can use it. It's our next best step. (Once the boss gets the new account sorted.)
  - jve 4y ago
    > other than just adding into a one-way Authenticator, sure. Two-way for tech-savvy: https://news.ycombinator.com/item?id=34441697#34444676 https://news.ycombinator.com/item?id=34441697#34444676
devman0 4y ago
FIDO passkeys are supposed to deal with the fiction and provisioning issues you highlight with current fido keys in consumer applications. In enterprise, the status quo is a little more acceptable because generally you have one or a pair of physical keys provisioned to your profile in an IdP that you use across all your apps, and you have a known support structure if your key and backup get lost or fail. In the consumer realm one has to deal with a gajillion different identity authorities so replacing keys or doing recovery because you lost one is a giant pain in the ass. Supposedly passkeys is targeted at that problem. https://fidoalliance.org/passkeys/ https://fidoalliance.org/passkeys/

wslh 4y ago

Yes, handling security keys (custody) is difficult. I think the custody layer is incomplete and we also need more MPC (multi-party computation) features. For example distributing keys along multiple devices and requiring a subset of them to rebuilt it. The problem with the security approaches presented by Apple, Google, et al is that you end up with a single or two dimension of failure: it is easy to forget the key at the end of the chain (e.g. when you travel).

ShredKazoo 4y ago

Let me try and explain some of the terminology (I'm not an expert either so I appreciate corrections from anyone reading). A password manager just helps you store your passwords, and automatically inputs passwords for you. This makes it easier to use a variety of strong passwords. Also the password manager can check for a domain name match before doing its automatic input, which helps provide phishing resistance. "2nd factor" or "multifactor" essentially just means adding on something in addition to passwords. That could be in the form of: * TOTP = "time-based one time password". Use an authenticator app on your phone to input a 6-digit code which changes every 30 seconds or so. * "security keys" / "hardware security keys" -- a dedicated device that allows you to authenticate, e.g. via USB or NFC. Generally considered more secure than TOTP, because the code is more than 6 digits worth of entropy, and also it forces the website requesting the code to authenticate itself before it provides the code (again, helps with phishing resistance). I don't know anything about passkeys or Windows Hello. As for backup, you should be able to transfer all of your TOTPs from one phone to another by scanning a QR code. For hardware security keys, you can buy multiple keys, register all of them, and keep them in different places. Then if you lose one you just use one of the others (and register a replacement to maintain redundancy). For the TOTP, if you're worried about losing your phone, usually when you set up a TOTP you can also copy down some single-use "scratch codes" that can work as a backup if your phone breaks or something like that.

jhogervorst 4y ago
> For hardware security keys, you can buy multiple keys, register all of them, and keep them in different places. Then if you lose one you just use one of the others (and register a replacement to maintain redundancy). Do I need to have all keys in my physical possession to register them with a new account? I could imagine having some backup keys in different places, but if I need to collect them every time I want to register them for some new account or service, it sounds like a lot of trouble. (And if the process is too much trouble, the result would be that: (1) I don't use the hardware keys for those accounts, which is less secure; (2) I only register my primary key that I keep nearby, which is dangerous if it would get lost or broken; or (3) my backup keys end up at the same place as the primary one, due to forgetting or being too lazy to put them back, which is also dangerous…)

mihaaly 4y ago

I feel more like restricted. I made the effort to look into security solutions for my important accounts (password only is not that!) and chose a security key solutions but the various providers have very uneven support for that - for example Apple was one notable case. Several forcing you to use phone number based solution (including banks) if you opt for secure ways but that is inadequate and risky on a whole different way for my case. Unacceptable. It is the strong password case all over again: I took the effort to build up a layered approach seting up memorable but strong password categories for the different categories of accounts I have just to be rejected by the odd ones: you are not allowed to use that character! And sometimes: your password must be shorter! Forcing me to their ways, hugely reducing security. Not enough choice.

zahllos 4y ago

I'm not, but I do crypto (as in PKI, smartcards) stuff, so let me try to explain some of the thinking behind hardware keys. The idea of a second factor is that "something you have" is hard for an attacker to also have, however, proof of having something usually means "proof that you know some secret" and that secret itself can often be copied. The lazy "proof you have" something is SMS auth, i.e. proof you control a phone number. However this isn't great, since in some jurisdictions ringing your mobile provider is enough to get control over that number. TOTP then says: let's assume you have some secret seed and I also know it. If I take a hash of it (HOTP) and include some time information I have a code valid for a small window that is hard to steal. The benefit is that everywhere this secret exists you can have an authenticator. The downside is that this is rarely a separate device to your computer. You also are going to enter your code into a website... and that might not be the right website, allowing capture of the code via phishing. The standard for legal, qualified digital signatures in the EU is to have non-extractable keys generated on hardware devices and never backed up. Why? Well, if you lose the hardware token (or it is damaged) you don't lose access to encrypted data, just the ability to sign documents. At this point you have an annoying dance to do to be issued a new token, but allowing backup of the signing key means signatures may be repudiated (because someone else could have stolen the backup). The same goal applies to U2F / FIDO certified security keys. U2F generates a unique key-pair per authentication target and that private key never leaves the authenticator. This gives you two things: 1) a binding between your target service and your device. Phishing becomes a lot more difficult unless you can present the right challenge-response to the authenticator, and 2) an authenticator you physically need to have present, but don't need a pin or awkward copy-paste of a code to use. You aren't using this key for encryption, but for authentication, so, the backup strategy is: have multiple keys. If you lose one, you can delete that entry from respective accounts. Password managers exist because some websites are password-only and even if not, you can't always trust they employed argon2id as a password hash. It also saves you having to remember multiple passwords. Your password database is something you will need to keep backed up. Personally I keep printed recovery codes of really important accounts, spare registered security keys, and a disk with my password database on in a safe place.

fatnoah 4y ago

My family is adept at forgetting passwords and losing physical devices. Keeping track of air pods is a complete nightmare. I can't even imagine adding extra physical devices where I'd have to manage the backups and constantly purchase new ones. Having gone through the hell of dealing with recovering iCloud accounts while not having a bunch of spare Apple devices laying around, I refuse to go beyond SMS for 2FA. Yes, it's certainly less secure, but it's something I can manage and control outside of the Apple ecosystem.

alwillis 4y ago

It may help to understand who this feature is for: This feature is designed for users who, often due to their public profile, face concerted threats to their online accounts, such as celebrities, journalists, and members of government [1]. [1]: https://www.apple.com/newsroom/2022/12/apple-advances-user-security-with-powerful-new-data-protections/ https://www.apple.com/newsroom/2022/12/apple-advances-user-s...

mk89 4y ago

No, and I think that TOTP is sufficient for 99% of cases, but hey that hardware key really makes the difference between a geek and someone else :) plus, there seems to be a recession going on, get out and throw another 2*40 $ to yubico now! :)