Comment by drewg123 | Hacker News Reader

Comment by drewg123 | Hacker News Reader

For Google 2FA, I'm pretty sure that it lets you remove the phone number once you've added a 2nd 2FA mechanism. Eg, once you've setup Google Authenticator and a Yubikey. At least that's how it worked when I set it up a while ago.

Given that Ted uses OpenBSD, I'm surprised that he has not mentioned the dumpster fire that is U2F on Chromium for BSD. This bug details the issue: https://bugs.chromium.org/p/chromium/issues/detail?id=451248. The last I checked, (~2 months ago), it was still a problem on FreeBSD. In order to avoid the crashes, I needed to set a user-agent spoofer to Firefox, so that I would not get a u2f prompt (and would instead be prompted for a Google Authenticator code).

That became frustrating enough that I decided to try switching from Chrome to Firefox so that I could use my Yubikey. I had to setup a u2f plugin for firefox to use u2f on FreeBSD. And to even get u2f requests, I had to install a user agent spoofer, and spoof a chrome user agent. Argh! So now I was spoofing Firefox on Chromium, and spoofing Chrome on Firefox. My head was spinning, and (because the spoofer spoofed old agent strings), I was getting nastygrams from corp. sec. for running out of date, insecure browsers.

I finally just threw in the towel, and set up a Linux bhyve VM to run Chrome under linux. The performance sucks, but at least I can finally use my Yubikeys. On the plus side, I can use PCI-passthru to pass in a webcam, and actually do hangouts on my desktop now.

I think the core issue there, is this status update: "Wont Fix: Neither OpenBSD nor FreeBSD are supported platforms for Chromium."

Indeed. And I was hoping that a rundown of 2FA from a BSD guy would mention this bug.

This is on a slight tangent, but it annoys me, so:

Google U2F requires you to use Chrome, i.e. not FF with the add-on (until it's built-in).

It just seems like annoying 'we're the only browser with built-in U2F' gloating, when every other site I've seen (e.g. Github) just tries it, and allows you to fallback on TOTP at your own discretion.

The firefox bug to implement native U2F has been open since 2014 [1].

1 https://bugzilla.mozilla.org/show_bug.cgi?id=1065729

Yes, but I'm using the third-party add-on until it's done - which works everywhere but Google.

You can't have a U2F Key and a Mobile Phone Authentication at the same time with Google.

What makes you think that?

Because I have a u2f key, and you have to disable the phone authentication in google.

I have a U2F key and had to go out of my way to get rid of phone authentication.

I believe you can have whatever auth mechanisms you explicitly allow. You will get prompted to use the key if you enable it, but you can also select alternative authentication methods when prompted for the key.

You can't have a security key as well as the new Prompt method.

https://i.imgur.com/QRdcLii.png

Google Authenticator (which uses TOTP) is not the same as Google Prompt: https://gsuiteupdates.googleblog.com/2016/06/new-settings-fo...

Was anyone talking about Google Prompt? It seems like bb88 was talking about Google Authenticator, and drewg123 was definitely talking about Google Authenticator.

Nope, the phone authentication prompt.

I have this. It even knows that iOS isn't supported and doesn't ask for Yubikey but Google Authenticator code.

Reply on news.ycombinator.com