Hacker News Reader

Comment by scrrr | Hacker News Reader

Isn't this the same as a code app like Authy? Why carry the extra dongle?

While both handle two factor authentication, Authy only assists with time based one time passwords (TOTP) which still leaves the end user open to phishing. These security keys are meant to be used with universal second factor (U2F) which prevents phishing entirely.

https://en.wikipedia.org/wiki/Time-based_One-time_Password_a...

https://en.wikipedia.org/wiki/Universal_2nd_Factor

Similar use case (2FA), but different implementation.

Instead of typing in a code, you press a button. It also protects against phishing by validating the URL of the site you're authenticating on (with a code-based 2FA you can still enter your code on a phishing site, which then forwards it to the real one).

Good reasons, thanks!

There are apps that also validate the source and can automatically sign you in (or require a button press), e.g. https://www.kryptco.com

Seems like it might be useful, but haven't had the time to try it out yet.

AIUI Krypton is basically doing the same thing as these FIDO2 Security Keys, but their software substitutes an app on your Phone for the Security Key. So a web site offering WebAuthn can't tell the difference (unless you allow it to interrogate the "Security Key" to ask who made it, which you probably shouldn't)

I personally would rather have Security Keys, but a solution like Krypton is definitely easier for a lot of users and obviously the price differential is hard to argue with.

An app has a much larger attack surface (for instance from malware on the phone). TOTP has to use short easy to enter codes (six digit numbers), Titan is doing a full handshake using modern cryptography with sensable key lengths. In many use cases pushing the button on the key is quicker/easier then using the app.

Reply on news.ycombinator.com