Hacker News Reader

Comment by saagarjha | Hacker News Reader

I would be shocked if they didn’t issue all employees YubiKeys.

A lot of people still have legacy Yubikeys floating around, and these are replayable. What you need now is something like the Google Titan FIDO2 key or one of the Yubikey FIDO2 keys. Transitioning an entire company to these, getting everyone to self-enroll, and then removing the ability to use all the less safe options across the employee base, contractors, etc is not cheap nor easy, and of course requires a massive amount of retraining. It's not as trivial as just buying them, sadly.

What retraining? You install the yubikey by plugging it in, registering it, and using it by tapping it as needed. What is complex?

There was literally no training involved for this during my time at ElGoog. One wiki page covered it adequately.

For someone who claims to have worked in big corporations and accuses others of not having worked in them, you sure are optimistic about the capabilities of the average user. Not every company is Google.

For starters, how do you register the Yubikey? On Okta, this is a multi-step process with at least one non-obvious step, and one easy way to screw it up.

The people who work at Google are not smarter than the people who work at Uber, or any other tech company. Getting people to understand 2FA might take a little bit of work but it's not hard.

WebAuthn (well, U2F, but that's essentially WebAuthn with a slightly different browser API and WebAuthn is backward compatible with U2F only devices) support has been on the YubiKey since the Neo in 2014 [0]. It's basically impossible to have a YubiKey that does not support WebAuthn. You do not need FIDO2 on-key resident credentials to benefit from WebAuthn.

[0] https://www.yubico.com/blog/neo-u2f-key-apps/

They did for a while but it was too expensive. Uber uses OneLogin, who I'm sure is also investigating. We had apps on our phones that received as "is this you trying to log in?" notification. You had to consciously hit "Yes" in order to continue the login flow. It wasn't offline 2FA like Authy or something. There _was_ a much higher standard of security there.

This was _social engineering_, something that even the finest MFA algorithms don't guard against.

I my experience, prepare to be shocked.

And even if they do, they likely have a “backup” for people who never seem to be able to use the Yubikey right.

Reply on news.ycombinator.com