Hacker News Reader

Comment by wakkaflokka | Hacker News Reader

I'm going to take the plunge into using security keys.

What are the recommended bluetooth and USB-based keys I should be buying?

Why to use security keys: http://fc16.ifca.ai/preproceedings/25_Lang.pdf (updated from my earlier link to the yubico article about that paper: https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys... )

Review of security keys by Adam Langley:

https://www.imperialviolet.org/2017/08/13/securitykeys.html

and testing security keys:

https://www.imperialviolet.org/2017/10/08/securitykeytest.ht...

tl;dr: Yubikeys are $$ but really solid for USB and NFC; the Feitian is probably the best option for Bluetooth but YMMV there. Those are what I personally use.

(Note that Yubico recently announced a problem with their RSA key generation, which they're fixing, but that bug does not affect the security of the device when used as a FIDO authenticator as it is for Google/Github/Dropbox/Vanguard/etc.)

I think the Feitian one is NFC

You're right. The feitan MultiPass (naming win!) Is the Bluetooth one I use: https://www.amazon.com/Feitian-MultiPass-FIDO-Security-Key/d...

According to Yubico, the RSA vulnerability only affects the YubiKey 4 and "all YubiKey 4 products shipped by Yubico after June 6, 2017 (version 4.3.5 or higher) use" a new implementation that is secure from this.

https://www.yubico.com/support/security-advisories/ysa-2017-...

FIDO U2F does not use RSA anyways.

> Why to use security keys: https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys....

I'm just going to point out that this article is written by Yubico, who undoubtedly wants to sell you a device.

Sorry - I linked it because it's a slightly less technical intro to the underlying paper by Google: http://fc16.ifca.ai/preproceedings/25_Lang.pdf

Probably should have linked that directly. I've updated my comment to link to the paper instead of the article. Thanks!

"Google says it supports any keys approved by the FIDO Alliance, a group that manages identity and authentication protocols." -- from the article.

This includes USB and Bluetooth LE devices. I'm still getting up to speed on technology, but prefer very near-field chips with a range of < 10cm (4 in), and if possible, < 1cm. Making unintentional / accidental detections, or snooping, as difficult as possible would be a bonus.

(It's possible that interactive timing might be a mechanism: a nanosecond-scale time resolution works out to about 10 cm.)

> It's possible that interactive timing might be a mechanism: a nanosecond-scale time resolution works out to about 10 cm.

Unfortunately that requires different radio hardware. Look up Ultra Wide Band.

One of my operating assumptions is that extant systems really aren't suficient. That's going to require some changes and establishment of novel standards. And that means that organisations having sufficient heft to promote and establish such standards need to be involved. As much as I don't trust the current Four Horsemen of the Apocalypse: Google, Amazon, Facebook, and Apple (and the various horse-pages: Microsoft, Oracle, IBM, etc.), they're almost certainly going to be involved. The US government, EU, and possibly interests in China, also.

And if you're thinking "but China?!!", remember that they've got their interests in secrets too, and might see a need for a secure and trusted system.

I have a Yubico FIDO U2F. It works with tons of sites and services but I usually opt to using 2FA one-time codes since it's quicker (I can pull up the Authy client on my desktop or phone). My key doesn't always work in every computer I have. It works out of the box in Linux but Windows needs to download drivers and the time that takes is more than just doing a one-time code. It is helpful to have, I only need either my keychain or my phone to get into my most important sites and services.

I've been using a (cheap $6) U2F token for a couple years now, but only on desktop, didn't want to spend the money on a NFC one. I'm thinking the feitian ePass one for $16.99 that has both NFC and USB would be good, at least until all computers switch to USB-c only.

Of course if you also want RSA key management on top of it your going to spend more money....

I have the Feitian ePASS FIDO you are talking about. Works great.

Are there any websites where it doesn't work? Looks like in the comments on Amazon this doesn't work for LastPass. I was looking at getting it instead of a Yubikey. I got their bluetooth/nfc key that Google recommends, but I don't have a bluetooth card on my desktop.

It has worked flawlessly everywhere I have tried it (github, Google, Facebook, Dropbox, Fastmail). I don't use lastpass so don't know about that.

Not very helpful, I know..

Lastpass says on their FAQ that they wont support Fido U2f until all major browsers do, but that is on them not the key manufacture.

https://lastpass.com/support.php?cmd=showfaq&id=8126

To piggyback, I recently bought a couple NFC devices, Feitian ePass FIDO and a Fidesmo Yubikey NEO. I have searched around for information on developing and transferring apps to these devices, but thus far have been unsuccessful. Seems most of the resources are several years old, gpshell appears abandoned and won't compile properly on Ubuntu 16. Any pointers appreciated! I'd love to have PGP support on the Feitian.

Yubikey are probably one of the most available, and most active in fixing bugs as they come up.

Reply on news.ycombinator.com