5 ms·

Incidentally, this is why SMS MFA is so popular with users despite its security vulnerabilities. Generally, unless you are targeted by someone with a sim swap,

Incidentally, this is why SMS MFA is so popular with users despite its security vulnerabilities. Generally, unless you are targeted by someone with a sim swap, it is good enough. Most people won't be targeted, but do have a good chance of something going wrong that makes them lose their MFA key.

SoftTalker 2y ago
Yep. It's simple, and almost everyone understands it. Like passwords themselves. Also the reason more secure approaches such as YubiKeys have never taken off in the general public -- they are just cumbersome and confusing.
- leftbehind 2y ago
  We haven't had any issue getting all of our staff -- nontechnical users alike -- on yubikeys. As part of education we skip the PKI portion and just point out that it is "like your physical house key. You plug it in and touch it to turn the key to unlock"
  - SoftTalker 2y ago
    Yes, and our staff uses ssh keys (generally but not always without issue) and a commercial MFA app. It's one thing to get this stuff used in a controlled environemnt where you have a help desk or administrators who can do a lot of the setup. You just hand the employee their YubiKey or smart card and say "use this." Trying to imagine your grandmother setting it up herself to be able to log in to her Facebook is another matter, and why these things have never worked for the general public.
  - close04 2y ago
    You probably use certificates and a company PKI to manage them. No need to stress if one is lost or locked, just revoke and whip up a new certificate. At home Yubikey is probably synonymous to FIDO not PIV/PKI. No whipping up a new one if you lose it. You better have 3 of them enrolled at any time, and have at least one stored off site.
    - leftbehind 2y ago
      We enroll them as standard fido/webauthn - I hate the other modes. I agree it requires significantly more work when you can't just call the locksmith for a new one -- IT -- if you lose one on your personal account you can only go get the spare key hidden under the doormat, a printed code in your safe, or lose the account.
  - Groxx 2y ago
    For business use, handing out yubikeys is completely reasonable - if they're lost or broken, the company is the authority and they can (and do) just re-issue a new one and work goes on with only a temporary interruption. They're easy to explain, fast to use, provide practical security, and are simple to recover in case of total failure. For personal use, that equation is wildly different. Google isn't going to let you attach a brand new key, you've just lost your account forever because it rained.
- JackSlateur 2y ago
  Most importantly: yubikeys must be bought
  - alistairSH 2y ago
    And carried around.
peanut-walrus 2y ago
Honestly, the only way I see forward is FIDO with dirt cheap NFC cards as keys. Need to log in to somewhere? Get the card from your wallet and touch it to your phone/laptop. It has to be cheap enough that for any company with paying customers it makes more sense to physically mail them a card if they don't already have one than to support any alternative auth methods. Most services won't even need a second layer of auth, if someone steals your wallet - do they really care about your reddit account?
immibis 2y ago
I've tried enabling it two times. The first time my phone permanently broke immediately after enabling it. The second time it was stolen. Now I just rely on randomly generated passwords.

SoftTalker 2y ago

Yep. It's simple, and almost everyone understands it. Like passwords themselves. Also the reason more secure approaches such as YubiKeys have never taken off in the general public -- they are just cumbersome and confusing.

leftbehind 2y ago
We haven't had any issue getting all of our staff -- nontechnical users alike -- on yubikeys. As part of education we skip the PKI portion and just point out that it is "like your physical house key. You plug it in and touch it to turn the key to unlock"
- SoftTalker 2y ago
  Yes, and our staff uses ssh keys (generally but not always without issue) and a commercial MFA app. It's one thing to get this stuff used in a controlled environemnt where you have a help desk or administrators who can do a lot of the setup. You just hand the employee their YubiKey or smart card and say "use this." Trying to imagine your grandmother setting it up herself to be able to log in to her Facebook is another matter, and why these things have never worked for the general public.
- close04 2y ago
  You probably use certificates and a company PKI to manage them. No need to stress if one is lost or locked, just revoke and whip up a new certificate. At home Yubikey is probably synonymous to FIDO not PIV/PKI. No whipping up a new one if you lose it. You better have 3 of them enrolled at any time, and have at least one stored off site.
  - leftbehind 2y ago
    We enroll them as standard fido/webauthn - I hate the other modes. I agree it requires significantly more work when you can't just call the locksmith for a new one -- IT -- if you lose one on your personal account you can only go get the spare key hidden under the doormat, a printed code in your safe, or lose the account.
- Groxx 2y ago
  For business use, handing out yubikeys is completely reasonable - if they're lost or broken, the company is the authority and they can (and do) just re-issue a new one and work goes on with only a temporary interruption. They're easy to explain, fast to use, provide practical security, and are simple to recover in case of total failure. For personal use, that equation is wildly different. Google isn't going to let you attach a brand new key, you've just lost your account forever because it rained.
JackSlateur 2y ago
Most importantly: yubikeys must be bought
- alistairSH 2y ago
  And carried around.

peanut-walrus 2y ago

Honestly, the only way I see forward is FIDO with dirt cheap NFC cards as keys. Need to log in to somewhere? Get the card from your wallet and touch it to your phone/laptop. It has to be cheap enough that for any company with paying customers it makes more sense to physically mail them a card if they don't already have one than to support any alternative auth methods. Most services won't even need a second layer of auth, if someone steals your wallet - do they really care about your reddit account?

immibis 2y ago

I've tried enabling it two times. The first time my phone permanently broke immediately after enabling it. The second time it was stolen. Now I just rely on randomly generated passwords.