Comment by KGIII | Hacker News Reader

Comment by KGIII | Hacker News Reader

Parent Full thread

Some sort of 2FA done on a USB device might help. I'm thinking something open and free. The user can just extract, probably programmatically, the software to their own USB device and enter/configure any needed information.

Then, online accounts could query the device and see if there's a key that matches what was made when they setup the account or added 2FA. Each account could have its own key, associated with the owner's master key, and it'd have to match the one on file - something like that.

I imagine it's have to be standardized and easy for site owners to implement. I guess it could also be done at some central location using something like OAuth, though individual sites should be able to add it - and fairly easily, and for just the cost of learning to add it. Maybe make it fairly simply, as easy as LetsEncrypt - or even easier.

Now, in my head, they'd enter their username (no password yet) and that's when the check would be performed. The site would request the token from the USB and the USB would request the token from the site. If the two match whatever criteria the security gurus come up with, they are prompted to enter their password. I suppose there could be additional checks and maybe even periodic poling from either the USB or the site.

Because the phishing site wouldn't have the correct key, it would fail and the user wouldn't even be asked for their password. Ideally, the user wouldn't have t do much more than carry their USB drive with them.

I suppose it should be easy for the owner to clone the USB key. It should also require some sort of master password to even authorize it to hand out keys. I imagine enterprises can lock them down to a key and a workstation, meaning that they can can only work in certain computers and certain computers will only accept one physical key.

I am sure this can be refined and monetized. Selling solutions to businesses and services would be nice. Recovery should be possible but difficult. I'm sure it can be layered with additional features. It should probably be optional, and not mandated by law for the general population and for personal computing - but available for them.

I'm sure there are ways one can think of to get by it but it does seem like it'd be a good place to start. It also doesn't seem like it'd be technologically difficult to accomplish, or even necessarily expensive.

For what it's worth, Google does support 2FA with USB security keys: https://support.google.com/accounts/answer/6103534?hl=en

Personally I wouldn't trust most sites to implement complex auth mechanisms. On balance, I personally feel much more secure by OAuthing with a few big tech companies.

It seems like U2F fits most of your criteria: open and free, standardized and easy to implement, foils phishing, etc. It can't be easily cloned though.

https://en.wikipedia.org/wiki/Universal_2nd_Factor

This is exactly the kind of 2fa that I've envisioned in the past (not being familiar with U2F), with the exception that I think the ideal solution will be a U2F device that doesn't require a power source. A special kind of NFC chip. May already exist (not sure how feasible it is), but I'm not aware if it does.

The Yubikey Neo and at least one other U2F capable device support U2F over both USB (for laptops) and NFC (for use in Chrome on Android). The authenticator is not internally powered.

That looks like a good starting point. Does the site exchange tokens with the USB key, so that the device also confirms the site is who they should be?

My thinking is that the site should have a custom token to exchange with the device and the device should have a custom token to exchange per site.

I'd also love to see it easily replicated and free for the user to put on their own devices. People are going to lose them, in droves. They'd be password protected, of course. I guess you could make them delete their data if there are too many mistaken password attempts, as well as make it destroy the data if used in an unapproved computer - things like that. I figure they can layer different features atop it, depending on how much security is needed.

U2F has a per-site key. The browser acts as an intermediary between the site and USB authenticator.

My simplified understanding is that it works like this:

The first step is registration of the authenticator with the site. The site sends a registration request to the authenticator. The authenticator generates a new key pair. It encrypts the private key with a symmetric key that never changes and never can be extracted from the authenticator. Then it sends a registration response to the site, which includes BOTH the public key and the encrypted private key. The site is responsible for keeping the keys.

Then you are ready to authenticate. The site sends a challenge request to the authenticator which is unique and probably has an expiration time. Inside the challenge is the encrypted private key. The authenticator uses the never changing symmetric key to decrypt the private key, sign the challenge, and return it to the site. Then the site checks the signature against the public key on file.

The key benefit here is that the browser will not allow a site to send a challenge which is not for it's own domain. Which means there is no way a phishing site can MITM the 2FA process. Even if they get a challenge from the real site, the browser won't let them present it to the authenticator to sign. As opposed to TOTP where the OTPs can be easily phished and used within the time window they are valid.

Reply on news.ycombinator.com