Hacker News Reader

Comment by IgorPartola | Hacker News Reader

Until these things work well with phones, I can't buy into them. I have a U2F key that I use as a shortcut for accessing things like Google's services. But I am sticking to always using either Google Authenticator or SMS, if it's available, as a primary option. When I am looking at a website in bed on my phone, and my YubiKey is in my laptop downstairs, I can't say I am happy that I can't access my account.

I think the form factor for these things is just wrong. I don't always have my keys with me. I do have my phone much more frequently. Even more frequently I have things like my Pebble. Maybe some kind of NFC interface with a wrist watch would be a better alternative.

View on HN

I use the Yubikey Neo with my phone via NFC to unlock my master password database which I use KeePass for. I wear my Yubikey on my necklace, tucked under my shirt and never remove it (it's waterproof, I shower with it.) I type my master password and just tap my phone to my chest to unlock.

On Android, the Google Authenticator app handles U2F via NFC. Sadly not possible on iOS.

For the web, yes, but I don't know any native apps that use it. I still need an app password for gmail, for example.

Huh? All Google native apps use Android's account syncing, which definitely supports using Authenticator for U2F. I'm confident it's also possible to implement it on other apps, although it's a matter of those app developers doing so.

Whats the point of having two factors at all if you are getting an SMS or using a TOTP token that is stored on the phone itself.

The phone does not force re-entry of this stuff so often that it would bother me.

When I am on my laptop, I absolutely love the Usability. Its much better then SMS or TOTP.

They have a NFC yubikey available, and most new phones work with USB-C (which this one has)

I can confirm that the NFC support works (yubikey neo with a nexus 5x) - but very few applications and sites support it.

I use the NFC Yubikey to store a PGP key, which can then be used with pass [1] + GPG on the desktop, and Password Store + OpenKeychain on Android. Works nicely. And if you choose to also keep the PGP key on the desktop, you don't need to carry the Yubikey.

[1] https://www.passwordstore.org

I use this setup, it's fantastic.

Do you know if it will work with a 5X running Copperhead OS (no gapps)? Ie. is the apk available?

It's on F-Droid, so probably: https://f-droid.org/repository/browse/?fdfilter=yubico&fdid=...

Oh, great! Thanks.

it worked for everything i was using it with. but same problem as the OP mentioned, i dont always have my keys on me so it just became annoying after a while having to the thing first

U2F and HOTP (Google Authenticator style 2FA) are not mutually exclusive.

I have both enabled on the sites that support both.

I use U2F when I have the key near me, and use HOTP on my phone otherwise (like you, my phone is typically closer to me than my U2F key).

A common response at this point goes "But then doesn't introducing HOTP remove the security benefits of U2F?" No. One of the main benefits of U2F is that it is phish-proof: the U2F key cryptographically authenticates the server, rather than the user eyeballing the address bar, which is how server "authentication" works with HOTP.

They do work with phones. I have an iPhone with a Lightning-Camera (USB) adapter and use it all the time.

Unfortunately, not for U2F though

Both the static and OTP modes of Yubikey work for me through this adapter.

I think I'm not understanding the problem. I have cloned keys (for backup + two locations), with Yubico Authenticator. Is the problem NFC on iOS or that you don't want to clone your keys?

My problem is that while I can reasonably guarantee that my YubiKey will be near my laptop when I use it, I generally can't guarantee that my YubiKey will be near my phone or tablets when I use them. I also don't really want to keep plugging in a physical key into my phone every time I want to log into, say, American Airlines to check the status of my flight, or into PapaJohns.com every time I want to order a pizza.

NFC makes this a little easier, but I still usually don't keep my keychain (that is my physical keychain with my house and car key) on my nightstand, while I do keep my phone there.

tl;dr: Laptop + 2nd Factor = YubiKey. That's OK and it works.

Phone/tablet + 2nd Factor = ???

Makes sense. Thanks. It seems as if what I would consider "natural usage" is a bit different than yours. I don't use my phone to access anything critical -- the attack surface is too big and changes too rapidly (sometimes outside of my control) for me to keep track of -- and I wouldn't worry about safety when checking a flight.

I consider most things critical. I treat my dating profile or my HN credentials the same way I treat me main email account's credentials.

Why would you need two factor auth on a phone? Most phones have fingerprint sensor built in. And you can set up a super secure password that needs to be entered on boot.

Now that I think of it, why is 2fa needed in a laptop with a fingerprint sensor?

How do you clone a YubiKey? I thought the whole point of having a hardware token in the first place was that it's _not_ easily copied?

> How do you clone a YubiKey?

It's a one-time write of a seed at device set-up time. It's not an exact clone, but will give the same response to certain challenges.

https://www.yubico.com/support/knowledge-base/categories/art...

https://www.yubico.com/products/services-software/personaliz...

> I thought the whole point of having a hardware token in the first place was that it's _not_ easily copied?

The process generally requires the person personalizing the key to intend to make two (or more) from the beginning of the process. Otherwise, the secret bits that must be entered into the other device to allow one's 2nd Yubikey to generate the same responses to the same challenges will be lost...

Screw it, let's all get chips embedded in our fingers.

Reply on news.ycombinator.com