Hacker News Reader

Comment by lcnPylGDnU4H9OF | Hacker News Reader

https://en.wikipedia.org/wiki/Universal_2nd_Factor

https://www.yubico.com/

A 2FA token is simply another "thing you know". A plugged-in USB dongle is actually "something you have". (Although, technically, it's still "something you know" because it has a secret key; it's considerably more difficult to phish this key.)

View on HN

Right now the most basic USB-C Yubico Key-Dongle goes for around $80 (considering taxes and shipping in Europe). As yubico state themselves, you really need 2 dongles just in case.

Most people are not paying $160 for this, period, when 2FA and passkeys are a "good enough" thing.

Passkeys are more than good enough. Software keys are indistinguishable from hardware keys in the context of credential phishing. Both kinds of keys have the same weaknesses, too, e.g. OAuth phishing (keys do nothing) and DNS hijacking (keys degrade to the same security value as OTP).

Other threat models (malware, physical access) are a different story, of course.

A Pi Pico is around $3, you could see if there are any solutions out there that can turn it into a security key. (though at that point, perhaps just wait for KeePassXC FIDO/U2F support)

I'll look into that, thanks!

Especially when they have a phone that is secured well enough. As long as the EU can keep itself from meddling away the security in their special well intended way, of course.

Reply on news.ycombinator.com