But USB/IP seems very insecure!
I can see this being very useful for accounts which are effectively throwaway, but they still force you to 2FA. The same is true of TOTP generators.
It‘s always based on the
1) something you know,
2) something you have,
3) something you are
categorisation. Multiple use of a single category still counts as one factor.
Of course if you are like me and keep your TOTP secret in your password manager than it is basically the same factor as a password.
the categorization makes some minimal sense, but basically any additional not-identical "factor" is additional security (though there's obviously a diminishing return because of the complexity-vs-security trade off).
This effectively reduces the 2nd factor to the first, and indeed produces the diminishing return. It's sufficient to hack one system using one method and you compromise both defenses.
The point behind 2nd factor is to provide a second, *independent* layer of protection that would need to be compromised using an entirely different attack.
In the case of the FIDO2 dongles including the Yubikeys the secret isn't even stored on your system, but on the device itself that doesn't even disclose it to your connected system.
But yes, recently I have seen people use password managers that really do both in one single piece of software (a browser extension).
I have a few U2F hardware devices, they are convenient when set up and plugged in, rather inconvenient otherwise :/
Adversary can intercept your login in MITM style, authorize themselves on other machine, just using your machine as proxy, and website you tried to login to would just display error "can't authenticate, try again".
And thangs to fact that key lacks display, attacker can event authenticate to different site, than you are authenticating now.
Trezor is way better device here:
> Phishing protection with on-screen verification. Trezor always displays the URL of the website the user wants to log in to, and what exactly is going to be authorized; therefore it is possible to verify that what was sent to the device is what is expected.
https://wiki.trezor.io/U2F https://wiki.trezor.io/FIDO2
And it supports U2F and FIDO2 (FIDO2 requires more expensive, newer model).
P.S. storing locally in TPM is bit more secure, but still exploitable in case of local privileged code execution.
Or do you mean that this leaves the secrets vulnerable to spyware and stuff? Cause in that case as the other comment says, one could use the TPM.
Which means the something I know is stored in the same places as something I have. Granted it is protected by encryption, and another password, but it definitely increases the attack surface.
If the computer is compromised it becomes much more possible to get access to both of these items than if it was a security key, physical authenticator or even on a different device.
I always think of 2FA as insurance against password theft/leaks. If users don't practice good password practices and use the same password for multiple accounts, for example, when ${next web site to be hacked} leaks all plaintext passwords, you can't just turn around and use that password to access ${another site where I used the same password but have 2FA enabled}. Or I'm logging in to a site from someone else's computer and they have a keylogger. [Obviously this virtual 2FA device wouldn't let me log in in that scenario--but in general, this is another case where the 2FA doesn't have to be rock solid, it just needs to exist if you captured my keystrokes.]
A direct attack on my workstation to steal my virtual 2FA device and my passwords isn't protected by this virtual 2FA device, but that's low in my list of worries overall for people's account security.
This would still protect against phishing, which is probably the bigger risk for the average consumer.