Hacker News Reader

Comment by pg_bot | Hacker News Reader

While this is a great step forward for U2F adoption, AWS made the same mistake several other online services have made by only allowing a single key per account. The typical U2F user carries at least two keys. (one on their person and one stored securely for backup) I hope they decide to change this because it will cause a ton of customer support problems in their future.

View on HN

Yes. I won't use U2F on services that don't allow multiple keys because of this. I have two keys in different places so it's easy to use.

How do you handle adding both keys if you store them in different locations?

Right now I do something similar, but I have to keep a list of which accounts I need to add to key 2, and the key is offsite, so I have a several week period during which an account only has one key associated with it.

I have one key permanently plugged in to my desktop at home. I have another on my keychain that I can use at work or if I'm travelling or whatever. This allows quick access to a yubikey anywhere I am. My previous problem (when I owned only 1) was that my keys were always in another room when I was home, and getting up to get them was too annoying when logging in to things. Now I have a backup if either is lost and I'm more-or-less guaranteed to have a yubikey within reach anytime it's needed.

you don't necessarily need two security keys. written down backup codes or an authenticator app are also good second factors.

If you can just fall back to authenticator app by saying "oops don't have yubikey now" then you get no extra security for using a yubikey.

You may consider that the authenticator offers enough security but a Security Key is more convenient. I hate typing 6-digit codes into things, touching the little contact or pressing the button on my Security Keys is much more tolerable.

Now, personally I wouldn't want the phishable Authenticator as fallback, but it's definitely better than SMS for example.

Maybe I'm misunderstanding, but I thought the whole idea of ubikey was that it proves who I am because I have it, no? If I own 4 ubikey, how does the system know whether I'm really me, or if I'm someone whose stolen one of my ubikey?

If you have one Yubikey, how does system know if it’s really you or someone who stole your key?

It is a second factor, so the'll also need to know your password.

You will notice your key missing, then you can disable that key with your backup key. With only a password, it becomes a lot harder to notice someone stole your pw.

Right. That also applies to N number of keys, too.

The different is, if you have 1 U2F key, people who steal your U2F key gain access to one half of the two factors for ALL services you use.

With 4 U2F keys, people who stole 1 of your U2F keys gain that one factor for only the services that you tied to that keys.

U2F is much narrower than full Yubikeys.

The typical U2F user carries at least two keys

Maybe techie personal users have more than one, but I only carry one device (a yubikey) for work, someone at work can reset my MFA if I lose it.

I'd be surprised if "most" people have a backup device/codes.

But that person does have to if you have another key, you can. Fix the situation yourself.

It’s also helpful when you use a key that lives in a machine to not have to remove it. If you lose the machine, use another key to sign in and disavow the lost key.

My company's security policy doesn't allow us to have more than one key.

If I have one key and someone takes it, I know it immediately.

If I have 2 keys and someone steals my spare, then I might not realize it for quite some time.

Yes, but other people at your company have keys and they can reset your key. In many situations when you're using keys yourself, there is not trusted person that can verify your identity in person and reset your key.

Maybe this AWS feature is designed for companies, not individual users.

does your company also disallow having backup keys to your office or company cars? you're supposed to have multiple keys so you're not effed if you lose one.

That’s what the backup codes are for.

I don't have a company car, but my office key is stamped "do not duplicate" and is a commercial keyblank that is not easy to duplicate.

so your company's security/office building security has duplicates readily available and most likely there are multiple master keys in existence, too.

Hence your company policy.

With AWS you are the company, and you should be allowed to set your own policy, and decide things like whether you trust yourself enough to store a backup key in a safe or something similar.

Suggesting Amazon should treat you like some employee of theirs is silly.

This works if you're not the ultimate owner of the account - and if they're working off a single key stored in the office safe I might work.

But for personal accounts, solo founders, travellers etc this is a no-go.

> I'd be surprised if "most" people have a backup device/codes.

Really? I'd expect someone who's paying $50 for a yubikey to spend another $100 to have a backup key, a key for their laptop, and one for their desktop. Add another one for your keychain if you are using it on your phone (if your phone supports it).

When I had 2FA enabled, using Google Authenticator, and had to reset my phone, I was locked out of AWS. No backup codes. No texting. Nothing. Had to send in a ticket and get a callback.

FWIW, Authy does let you store and recover TOTP accounts via password.

And this is also what makes Authy a terrible 2FA tool no one should use ever.

It stores your secrets in plain text on the phone without any secure enclave. If your backup password is sniffed or there is a flaw in Authy or your mobile OS sandboxing fails you are toast.

If your mobile os sandboxing fails, you are toast in any scenario. I think every authenticator app is toast as long as mobile sandbox is comprised.

1Password can store/generate TOTP codes.

And copy them to the clipboard automatically when it detects you'll need it. I'm slowly moving my TOTPs codes over.

Storing password + TOTP together does leave you vulnerable if your vault is stolen/broken into, but I've gone all-in on storing them in 1Password because that's a trade off I'm willing to make.

Not me. I had the TOTP factors in my password manager for a while, and boy was it nice, but eventually I decided that was a risk I wasn't willing to take. I feel safer knowing that they have to beak into at least two different apps.

I use Authy to manage my 2FA codes, but I rarely ever use the desktop app. I stick to my phone to keep a physical separation between my logins and my 2FA app.

I also started storing my backup codes as a base64 encoded gpg password encrypted text file in my password manager. If I ever lose my 2FA codes I can still get into my accounts in a emergency while also protecting myself from a password manager hack.

It's annoying, but as I said, I'm not willing to take the risk.

> It's annoying, but as I said, I'm not willing to take the risk.

Convenience is the enemy of security. I think you're making a good choice though. It's a minor inconvenience for increased security and peace of mind.

I used to do this. Then I realized I stored the backup codes in 1Password anyways which are as good as using a TOTP. So instead of investing in another safe place to store the backup codes I decided just to go all in with TOTP in 1Password.

If my 1Password vault is breached, I am pretty much in a world of trouble as it is.

Just don't store your email password in your vault. You could probably quickly regain control of most online services if you retain control of the email you used to sign up.

Exactly right! I keep my PayPal and primary, recovery email password outside of the vault. I can recover accounts and keep money safe(r) that way.

I have to remember three passwords (oh no!) and feel safer for it. It could all be in my head, though.

It's a tough call to make, isn't it? I just figured if they get into 1Password, I'm probably dealing with someone highly sophisticated and didn't stand a chance to begin with. I don't know yet. I might stick keeping them on some physical device.

There’s zero authentication on the Google Authenticator app and it loses all it’s data every phone upgrade. That’s basically what everyone uses.

If someone gets into your 1Password it’s all over anyway.

That said, I pay for the standalone app and store my vault myself. I have no actual reason not to trust AgileBits hosting it, but they must be a huge target and I’m not taking my chances.

Any tips or tricks to hosting your own vault(s)? Is it simple enough?

This plus the iOS 12 auto fill integration are like the greatest things ever.

I used to be a Keychain + Authy user but moved everything to 1Password.

Are you sure about that? My AWS 2FA authenticator code has been out of sync for a while and they offer multiple options to get around it. I've been receiving SMS codes easily, in fact I just did this a couple days ago. IIRC they also offered to call me. Did you flip some bit somewhere to disallow this? Do you have a phone number set up?

Yep, it was a couple years ago. They ask questions, then disabled 2FA so I could just get in with a password, and re-enable 2FA. No options around it. So possibly they've improved the process since then.

Can confirm it’s still similar. Went through the same process 2 months ago.

Use the Yubico Authenticator app. The main difference is the (secured) storaged of the shared secret. With Google Authenticator, your keys are stored on the phone.

With Yubico's authenticator, you store the secrets ontp your Yubikey. This means you can reset your phone and still be able to use the same TOTP shared secrets. Or if that matters, ask a friend to install the app and use your Yubikeys to get the TOTP.

Workaround: a separate IAM user for each machine you leave your Yubikey Nano inserted into.

fwiw, one way to do this with aws is to create two IAM users in the same groups and have a yubikey associated with each one.

You now have a backup login, it just has a different username too.

AWS often releases features very early, to satisfy the first tranches of early adopters before rounding out the feature with feedback from these passionate users.

AWS EKS is a good example for anyone who has had a play already.

What's the latest with EKS? What's missing still?

Nearly everything. Old k8s version. No upgrade possible. Odd deployment process (not fully automated). Support is unable to help in a timely manner. First deployed cluster was directly broken (no DNS resolution).

We eyed on switching from kops to EKS. But immediately stepped down after experiencing so many issues.

There is ECS, works for me.

And now Fargate.

Yikes! This is a non-starter for me. I have 4 keys (3 stored in safe places - yes this is inconvenient when setting up a new account, but this is the trade-off for security). What a strange decision.

Is there some workaround for this? Could I create a second and third accounts(that share their resources) to add other u2f keys?

There are a few others who only allow one key....

Why?!?! :(

LastPass for example

LastPass doesn't support U2F at all. They only support the Yubikeys in the less-secure one-time-password mode.

Lastpass 2FA is just used for account management and sync anyway. It has no role in the secret crypto. If your attacker phishes the master password your synced passwords are all compromised.

Wouldn't they also need access to a device that already synced your passwords? That essentially switches your computer to be the second factor, albeit one that's more easily compromised with malware. And if they already have malware on your computer, you're probably hosed anyway since the passwords have to be decrypted at some point.

If all they managed to do was trick me into entering my master password on a dummy login page, the sort of phish that U2F is designed to protect against, U2F would still keep me protected while OTP wouldn't.

Reply on news.ycombinator.com