Hacker News Reader

Comment by RcouF1uZ4gsC | Hacker News Reader

Phone numbers are pretty ok as a second factor. For a general purpose website I doubt any more than 10% of people will ever get anything like a Yubikey. As for using a TOTP app such as Google Authenticator, I myself have been personally burned when I wiped my phone and forgot to backup the TOTP codes.

Phone numbers combined with SMS are not perfect, but they are something the average user has, something that the average user can recover (if they lose a phone, they can get a new one but still keep the same number). No, they are not perfect, and if you are being targeted, they will not help you, but most people are not targeted, but they do use bad passwords and using phone numbers as the 2nd factor improves security.

View on HN

> For a general purpose website I doubt any more than 10% of people will ever get anything like a Yubikey

I bought a bunch of Yubikeys and tried giving them away like candy to friends and family. I couldn't even give them away; people still weren't interested, including several developers (!).

We'll never be able to save everyone, so my only wish now is that for the people who do care, everybody implements 2FA/WebAuthn properly and uniformly. Even that we're so far away from. Maybe eventually we'll get to some level of herd immunity, where >90% of accounts are 2FA protected, so trying to exploit them is a massive waste of time, and can be detected early.

> I couldn't even give them away; people still weren't interested, including several developers (!).

I'm a developer and I own a couple of Yubikeys that I picked up to play with the concept. I don't actually use them for real authentication, though.

Now, I know that I'm a weirdo, but the reason I don't use them for real is because they're less convenient for me than just using unique, strong passwords.

Also, you can lose a yubikey even more easily than you can lose a phone (because yubikeys are smaller and you typically use them less often).

Don't you people use keys? Stick them on your keychain!

You need multiple yubikeys. The problem is that they don't use some sort of derived key concept to make syncing easy. You need them physically present to add them to new accounts. You can't just lock one away in the safety deposit box. So you'll probably just lose them both if you lose one.

I'm not surprised nobody uses them.

The only practical application I can think of is some sort of central authority configuration like a corporation where yubikeys are given to employees.

I've got one on my keys, and one stuck in the back of my monitor.

sure, somebody could steal it, but I'm bit going to lose it

because printing out some recovery keys is so much hassle, or god forbid you have multiple 2fa methods like two keys and a TOTP authenticator app.

I’m not convinced at all they are good for “normal” people yet. Google’s support is great, especially as securing your email often helps secure password reset links etc, but browser support is sorely lacking even now - you are more or less forced to use Chrome. It’s turned off by default in Firefox and doesn’t work at all in Safari. It does work by default in Edge for the 50 or so users who didn’t just use it to install a third party browser. Mobile browsers are even worse, despite the NFC support on the newer yubikeys.

The technology appears fine, it’s the culture/industry norms that aren’t catching up. Until you can reliably and easily use it most places in most browsers it’s always going to be a niche solution for security geeks.

I do think they have great potential in the workplace though, especially the nfc ones - the same yubikey could be used for both physical door access controls as well as online services like email etc.

I experimented with requiring the yubikey to unlock my MacBook, but the risks are enormous, even with a spare yubikey. Lose the yubikeys and getting your personal data off a FileVault encrypted volume is going to be great fun I imagine...

> I bought a bunch of Yubikeys and tried giving them away like candy to friends and family. I couldn't even give them away; people still weren't interested, including several developers (!).

My problem is what if I lose it. I know there are ways round it, but it's a layer of complexity passwords just _don't_ have. That's enough of a hurdle for me.

While I like my Yubikeys, they definitely aren't more convenient or intuitive for people who aren't accustomed to using multifactor authentication already. The webauthn spec [0] includes support for "biometric authenticators" and "platform authenticators" (e.g. the fingerprint readers with secure enclaves increasingly present on phones and laptops), and I think that has a real chance at improving authentication security across the board. Once Apple, Google, and the like start pushing "touch to login" via webauthn, people will come to expect that sort of convenience. And if all of your devices include these authenticators, adding a new device should be as simple as authenticating on one that hasn't been lost or stolen.

[0]: https://www.w3.org/TR/2019/REC-webauthn-1-20190304/

I save all the seeds for 2FA in a separate keepass db & just rescan it on new phone whenever needed. Also, as last time I got an iPhone, I just made a simple javascript local script to paste that CSV seed data into it & click generated links to auto add those to Google 2FA App, https://davch.gitlab.io/dms/otp.html

Reply on news.ycombinator.com