Hacker News Reader

Comment by sdan | Hacker News Reader

This is exactly why I’m only faithful to FIDO U2F keys. Got a couple and ensure they’re safe. No one’s hacking my accounts unless they crack both my passwords and rob me physically... which at this point doesn’t seem like it’s going to happen.

View on HN

“Hello thanks for calling. I understand you want to reset your password. To verify it’s really you may I have your cryptographically impregnable super token? Oh it’s lost, I see, how about can you verify your billing zip? Splendid you’re all reset.”

I think he's saying that the private keys to his crypto never leave physical hardware. There is no phone number to call if he loses them, but on the other hand what you are describing is impossible.

The joke is a thief will get ahold a live person and still be easily able to social engineer account access, despite best efforts to lock it down with technology.

That’s not how private keys work...

But it is how authentication works in the real world.

Suppose we take Coinbase (I don't use it, but I've heard SIM swapping is done regularly with Coinbase):

Suppose you lose all your physical keys: I don't think you can social engineer hack Coinbase (pretty sure most companies won't allow people to just give away your password/send a reset email to some other email).

Or suppose you get them to send me an email to reset my password. But my email also has FIDO u2f! And I know as a fact you can't social hack my email provider.

Try it. Most companies don’t mind.

The Google Authenticator app on iOS doesn’t backup its keys so it’s pretty common for people to lose access to that kind of keys.

I don't think you completely understand the concept behind the Google Authenticator App, i.e. the standard it implements.

Which keys is it supposed to backup?

Everything else you said is sadly true.

You would expect that if you restore the full backup of your iOS device to a new one, because you lost it for instance, that on the new device you could open the Authenticator app and see the same keys as you had on your old device. That is not the case though.

Under the hood Google Authenticator uses keys to generate the codes you see on screen and these keys are not backed up.

It’s a difficult decision of course. If you back them up in iCloud Apple and people who hack your Apple account have access. If you don’t the keys are lost if the device breaks or is lost and you need a workaround.

I think they do backup if you do an offline (e.g. iTunes) full backup and restore on the same device, which of course is never what people do.

No, I know because that’s what I do and I had this fail on me when I migrated to a new phone. I switched to a different app that does backup keys when you use an encrypted iTunes backup.

Edit: oh you wanted to restore on the same device. Well that might work but it doesn’t help when migrating or if your phone is not available.

That's why I use Authy (able to have backup keys).

What happens if the keys get lost or destroyed? It seems like a never ending problem.

Get 2 keys, keep one in a safe place. Add both to your important accounts.

Then also setup TOTP, so if you lose both keys and have a working cell phone with the app installed you can still login.

That's if important accounts allow you to do that. For example AWS only allow one MFA key

I have one at work/keep on my computer and one at home.

Some websites allow TOTP which is still safer than SMS, but if I lose one, I'll get another one while I use the 2nd.

> I have one at work

This seems really easy to steal.

> one at home

Most people I know have been burgled too.

Keep two or three, put one in a bank or a safe at home. That should be enough redundancy for most people. As long as you can still get in to revoke/enroll stuff you should be okay.

It’s not so much a problem as it is a balance of security, redundancy, and effort. You decide where you want to be on that balance of considerations.

> Keep two or three, put one in a bank or a safe at home. That should be enough redundancy for most people.

Yeah, good luck.

I don't know of any system that lets me enroll 3 security keys for an account.

Doesn't Google let you set an arbitrary amount?

Yes, as does Github and Facebook. I forget whether AWS does.

Safe deposit boxes aren’t safe: https://www.google.com/amp/s/www.nytimes.com/2019/07/19/busi...

Reply on news.ycombinator.com