Hacker News Reader

Comment by cendyne | Hacker News Reader

An AES key is symmetric. Both parties need it for this cryptographic operation.

The OTP key is separate from other keys that enable WebAuthn.

Also, please don't use Yubikey OTPs. While they can't be brute forced like TOTPs, they can be phished. There are better technologies to implement.

View on HN

My understanding is that, TOTP are equally vulnerable to phishing.

Hetzner Cloud and Bitwarden use Yubico OTP.

Use U2F instead.

U2F is FIDO1 though, everyone is switching to FIDO2/WebAuthn/Passkeys.

TOTP can be phished. The parent is recommending FIDO/WebAuthn

As someone shopping for physical 2FA tokens right now, do you have any recommendations?

YubiKeys.

Just use FIDO2. I have no idea why OP is trying to use the YubiKey OTP protocol, which is legacy.

I wasn't trying to use it, I was just looking around and came across the "YubiKey Personalization Tool", which doesn't show anything about FIDO2.

Now that FIDO2 has been mentioned as something that solves this issue, it turns out there's another tool called the "YubiKey Manager", which allows you to configure/toggle various "applications" on a key, including Yubico OTP and FIDO2.

YubiKeys are fine, just avoid their proprietary OTP thing. They're fairly configurable and also do FIDO/WebAuthn, as well as TOTP/HOTP, PGPcard and PIV.

nitrokey

I like my OnlyKey.

I don't think I've ever heard of people actually brute forcing TOTPs on any halfway decent implementation. Since they rotate every so often you'd have to hit the whole range of 000-000 to 999-999 in like 15 seconds. A simple rate limit of only allowing a few tries every 30 seconds would completely prevent TOTP brute forcing while still being plenty accessible.

Reply on news.ycombinator.com