Hacker News Reader

It seems like you don't understand the main advantage of these types of security tokens.

Rogue trigger of a security token isn't really an issue when using the recommended U2F standard.

U2F uses the domain as part of the challenge-response in U2F so that phishing\spoofing attacks can be defeated.

Yubikeys can perform many functions; the one in the article is an OTP which can be accidentally pasted into Slack.

Yes. But the main insecurity isn't accidental pastes, it's being phished. The company the author of this article works for needs to switch to U2F.

If the only phishing protection you find meaningful for 2FA tokens is domain matching then any extension-based password manager like Bitwarden will work with far less hassle than needing a physical token or your phone.

Just hope your password manager's password doesn't get phished.

> or your phone.

Using your phone for 2FA doesn't provide any phishing protection that I know of.

What realistic attacks is a non-U2F Yubikey protecting against that TOTP (Google Authenticator) won't protect against?

Reply on news.ycombinator.com