Surely other people are in the situation of:
- iPhone, iPad
- Macbook with only USB-C ports
- Windows/Linux workstation with only USB-A ports
Is there currently a non-cumbersome solution that will work on all of these?
It's cumbersome, but less so than when we were plugging and unplugging our one hardware USB-A OTP token into everything (and using a desktop web browser to generate OTPs for the phones).
If you do end up getting a security key, I recommend getting at least two. If one fails, you'll want the other one as a backup so that you can get back into your accounts.
I went with the Neo, because it supports all of my current devices, and for USB-C future testing, I tested it on my phone with an USB A-C adapter and it worked there as well. I'm a Linux/Android user without any Apple devices, though, so YMMV.
EDIT: Should also mention that I received a free basic Yubikey as a gift for subscribing to Ars Technica about a year ago. USB-to-MicroUSB and USB-to-C adapters worked on that for all of my devices, as well. I feel pretty confident switching to Yubikeys now that I have two and can keep the newish one on my keychain at all times, with the basic one in a secure place at home.
I don't think that's possible right now. Until they come up with a solution to "I've lost my 2fa token" that isn't as painful as losing you wallet there will be new designs coming out. (Actually, it's more painful. You only have a few cards in your wallet, while your 2fa token may be recognised by 100's of sites.)
This isn't a criticism of FIDO2/WebAuthn. I am impressed by how each iteration solves a new part of the problem, and FIDO2 was definitely a step forward, fixing rough edges in FIDO. But we aren't there yet. We need a FIDO3 and possibly 4, 5 and 6.
Similarly, my laptop has an SD card reader and Ethernet port. My laptop and phone have 3.5mm jacks. All my small devices use micro-USB.
No dongles or adapters makes for seamless usage. I guess the only 'adapter' is keeping a micro-USB -> USB-A cable around.
I think the NFC ones are shipping after they worked out some kinks.
Details are available at https://security.googleblog.com/2019/05/titan-keys-update.ht...
By the way: I recommend getting the larger keys, not the nanos. These nanos look cute, but especially the newer ones are intended to be fixed to one device permanently, which in my opinion is both inconvenient and not the intended usage.
I wonder if iPad apps will start supporting Yubikeys — especially with the new iPad pros and their USB-C port it seems natural.
Ideally, I'd love to see Blink integrate ssh-agent, gpg-agent and its card support, which would let me use my existing (excellent) setup for using GPG keys stored on a Yubikey for ssh (see https://github.com/drduh/YubiKey-Guide for a great writeup of this approach).
Or you can make your own :)
iPhone/iPad is currently not solved, hopefully with iOS 13 we'll see positive news.
PAKEs provide defense against both credential stuffing, (some types of) phishing/MITM, CA trust etc without UX cost (a security solution that "Just works" for users with security apathy. U2F defends against compromised user space (PAKEs would fail to protect against a key logger) and require more onerous exfiltration (either physical theft of the device or biasing the U2F keys/functions)
Wiki's:
https://en.wikipedia.org/wiki/Password-authenticated_key_agr...
https://cryptowiki.net/index.php?title=Password-authenticate...
Blogs:
https://blog.cryptographyengineering.com/2018/10/19/lets-tal...
[1]: https://www.yubico.com/wp-content/uploads/2018/09/yk5-diagra...
https://solokeys.com/collections/preorder/products/copy-of-s...
That's backwards. TOTP is vulnerable to phishing attacks, which are the primary threat model. Far better to use U2F for daily use, and then keep a printout of the TOTP QR code in a safe at home as a backup.
Bitwarden has been fantastic, I highly recommend it.
Bitwarden is free as in a beer and free as in speech. Only if you want the 2FA features you need a subscription.
Then Bitwarden costs 10 USD per year. That's approx as much as 1Password asks for 3 months. Ie. Bitwarden is almost 4 times as cheap.
For that price you get a very good program with an open source frontend, and an open source backend (third party, in Ruby).
And Lastpass, after they were acquired by LogMeIn, has the balls to go from 12 USD/year to 24 USD/year. Without any additional features whatsoever a 100% price increase? That's why I went shopping. And I ended up at Bitwarden.
Our apps do not currently support U2F/WebAuthn when signing in, so they'll default back to TOTP based until we implement support for U2F. We aren't making any promises as to when this will arrive but at least two of our apps now have some form of support for it internally. It's far from complete and not ready for users but it is being worked on.
Note that U2F in this case is only about authentication, not decryption of data. This is why it's only used on initial setup of your account on a new device. The cryptography side for unlocking 1Password is entirely independent of U2F/MFA.
Hope that helps but let me know if you have any questions.
Kyle
1Password
> Last year we added two-factor authentication to provide another layer of protection for your 1Password account. When this is enabled, you are prompted to enter your second factor any time you sign in from a new device.
If you read it carefully, you'll have the answer to your question.
Thus far it's just Dropbox and Gitlab that I use it for, since they're among the few services that allow multiple 2FA methods to be used at the same time.
They have all worked with Yubico U2F keys and with the Google Titan keys. Pretty convenient way to have two factor authentication. I like the Yubikey 5 Nano as you can leave it plugged into a port in your laptop all the time.
I've run into a number of services that only allow a single U2F key (it's been a while, so I don't remember the exact ones). Even if they do support multiple U2F keys, how do you handle enrolling both? I keep my backup key offsite, so ideally I could enroll it without physically possessing the device. If I have both in my possession at all times (or even sometimes), I'm at risk of losing both of them.
AWS and Twitter are two services which only allow a single U2F device.
It's as simple as clicking the button to add another, and walking through the steps. Just be sure to name them in such a way that you can tell them apart. I typically use the identifier on the key itself. It's usually printed somewhere opposite the USB contacts.
Kyle
1Password
I keep keys in separate locations for safety, but that makes adding all keys to a new account a big pain.
This hasn't been a big problem yet because there are so few services that support the keys, but I wonder how people would manage it if it became widespread.
edit: I guess the thread is referring to multiple fallbacks that aren't U2F, but even still, if you're relying solely on U2F it's good practice to have more than one key lest you lose it and get locked out.
I've always had it drilled into me that doing crypto yourself is fraught with peril. It seems that doing hardware would be doubly dangerous. I'd want more verification that the implementation is correct and "strong".
What you might want to look at is things like hardware hardening or side channels. (Whether or not you consider this a matter of "correctness" can be argued, but here I would consider correct = implements correct algorithm.)
I think attacks against U2F devices are fairly difficult because you can't really use them as any kind of oracle, just due to the way the user interface works. But I am not a crypto expert, I just know how U2F works.
https://www.yubico.com/products/yubikey-fips/
These are validated by NIST (National Institute of Standards):
https://csrc.nist.gov/Projects/Cryptographic-Module-Validati...
Note that most keys are level-1 certified, i.e. against online attacks. Physical attacks are generally not much important, because if an attacker has access to your key, he can simply use it. (unless you went through the additional hassle to set a pin, but very few people do it.)
When you launch you'll be prompted to purchase. On the screens near the bottom there is a line of text about purchasing a license, go that route instead of signing up for the 1Password.com service.
Kyle
1Password
Where can I see product info about the licensed version? Can you provide a link?
"So while it works great as your second factor in those browsers, for now you’ll still need an authenticator app set up to use with the 1Password desktop and mobile apps (and any unsupported browsers)"
Adding 2FA to it is great but I think the best security is likely still just to sync and use local apps for this data, to avoid being exposed to any JavaScript vulnerabilities or if 1password.com were ever hacked.
I have a "vault" (1password's term for an encrypted file containing passwords and related info) that's sync'd across devices through dropbox (and accessed through a locally installed app), which I think is what you're suggesting.
Anyway, I think there's no particular need to access passwords through the site.
I'd definitely feel uncomfortable typing my 1password vault password into a web page or anything else besides the apps.
