3 ms·

We have all been using physical keys for our homes and cars our whole lives. Physical U2F keys for digital authentication are basically the same level of conve

by krupan 3y ago

We have all been using physical keys for our homes and cars our whole lives. Physical U2F keys for digital authentication are basically the same level of convenience and actually very very secure: no shared secrets, not copyable, not forgeable, not vulnerable to phishing, etc. I don’t know why we haven’t all jumped on this solution to digital authentication

pphysch 3y ago
Theoretically it's a good solution, but practically it's an enormous task to migrate all existing digital infrastructure into a new hardware security paradigm.
sigwinch28 3y ago
I can get any proficient locksmith to open my front door with valid photo ID. In a pinch I can get in using a brick, a window, and a good throw. The police might turn up or they might not. With 2FA, a lot of times I’m going to go through endless technical support, or I will be told it’s simply “not possible” for me to regain access to my accounts. There’s a third tier here, which is 2FA at work. If I lose a 2FA token I can usually get the IT or security team to let me back into the system because they’re physically present and know who I am.
kevincox 3y ago
I have like 2 or 3 physical keys. I have accounts on hundreds of websites. Sure, you can use the same key on every website but you better not lose it. So now you need to register multiple keys on every website. Also if you lose one you need to go back to every single site and add your replacement. (I hope you remember every site you have signed into.) So "not copyable" is actually a huge downside for convenience. Such a downside that even though I have a collection of U2F keys I only use them in a handful of accounts. The maintenance cost is just far too high. To resolve this you would probably need something like cross-signing. So I can say "I know that you only trust key A, but I lost it a few years ago. However I have an attestation from key A saying that key B is mine as well. Here is a signature from key B". However this is effectively equivalent to copying keys. So it basically defeats that point.
abdullahkhalids 3y ago
Well for one, security keys have arbitrary limits. The latest yubikey can store up to 25 FIDO2 credentials for password-free logins, two OTP credentials, 32 OATH credentials for one-time passwords (when paired with the Yubico Authenticator), and an unlimited number of U2F credentials [1]. [1] https://support.yubico.com/hc/en-us/articles/360016649339-YubiKey-5C-NFC https://support.yubico.com/hc/en-us/articles/360016649339-Yu...

by krupan 3y ago

pphysch 3y ago

Theoretically it's a good solution, but practically it's an enormous task to migrate all existing digital infrastructure into a new hardware security paradigm.

sigwinch28 3y ago

I can get any proficient locksmith to open my front door with valid photo ID. In a pinch I can get in using a brick, a window, and a good throw. The police might turn up or they might not. With 2FA, a lot of times I’m going to go through endless technical support, or I will be told it’s simply “not possible” for me to regain access to my accounts. There’s a third tier here, which is 2FA at work. If I lose a 2FA token I can usually get the IT or security team to let me back into the system because they’re physically present and know who I am.

kevincox 3y ago

I have like 2 or 3 physical keys. I have accounts on hundreds of websites. Sure, you can use the same key on every website but you better not lose it. So now you need to register multiple keys on every website. Also if you lose one you need to go back to every single site and add your replacement. (I hope you remember every site you have signed into.) So "not copyable" is actually a huge downside for convenience. Such a downside that even though I have a collection of U2F keys I only use them in a handful of accounts. The maintenance cost is just far too high. To resolve this you would probably need something like cross-signing. So I can say "I know that you only trust key A, but I lost it a few years ago. However I have an attestation from key A saying that key B is mine as well. Here is a signature from key B". However this is effectively equivalent to copying keys. So it basically defeats that point.

abdullahkhalids 3y ago

Well for one, security keys have arbitrary limits. The latest yubikey can store up to 25 FIDO2 credentials for password-free logins, two OTP credentials, 32 OATH credentials for one-time passwords (when paired with the Yubico Authenticator), and an unlimited number of U2F credentials [1]. [1] https://support.yubico.com/hc/en-us/articles/360016649339-YubiKey-5C-NFC https://support.yubico.com/hc/en-us/articles/360016649339-Yu...