If the argument is that phone number can always be recovered from real world identity, link the damn authenticator app to SMS instead of having to hand out your phone number to every company in the world.
May own anecdote is that I almost never receive spam sms despite having nothing in place beyond whatever my service provider does.
Spam mails make it through two+ layers of filters (service provider + my own) more often than I get spam SMS, and I have to trawl the wasteland that is the spam box once in a while to ensure important mails have not been missclassified.
Using a yubikey says, specifically, that if I lose this little device and the bypass codes, that I have presumably stored on encrypted storage in a way that doesn't require the yubikey to access, then I want it to either be impossible or exceedingly difficult to recover access to this account.
Very few people actually want that, and if yubikeys become widespread, there will be a wave of people having tantrums because their yubikey is lost and the account is unrecoverable.
If it isn't extremely difficult to recover an account in the absence of a yubikey and the loss of the bypass codes generated on enrollment, then there's no point to them.
I've run a b2c website. There is a shocking percent of internet users -- I'd estimate 20% -- that cannot reliably tell you their email address (5% that literally can't, and another 15 that can't reliably). Those users having yubikeys would be an utter disaster.
The bigger problem is that a large number of sites don't implement MFA properly, and don't allow you to enroll multiple MFA devices. This really could only be fixed with regulation that clearly defined MFA, so there would be consequences for improperly implementing it.
In the politest way possible, I question whether you've interacted with the modal user.
edit: I can try to dig up the article, but here's the precis: 5-ish years ago, google briefly changed their search results ranking. Lots of people were logging into facebook by searching facebook, instead of typing facebook.com, then following the top result. Some other site briefly was the top result when searching for google. That site got a wave of users submitting help requests because they couldn't log in with their facebook credentials, and accusations of subterfuge or wrongdoing because their accounts were deleted. I think it was pinterest, but I may not remember correctly. Either way, it looked nothing like facebook and didn't use blue.
That's what a significant fraction of internet users are like.
My email address is firstname.midddlename@<wellknownemailprovder>.com
I get a dozen emails a week from companies and government agencies trying to reach people with the same first + middle name combination from around the world. People seem to think they automatically get an email address with their name provisioned or something and they just sign up for accounts and services using that combo.
Someone would need to physically take your laptop, unlock it, and get your account passwords before they could use your yubikey to login to accounts.
Would that be what passkeys would be?
Durability: If you drop your smartphone, there's a pretty good chance you'll shatter the screen and buy a new one. You can play tennis with a Yubikey and it'll be fine. You can run it through the washing machine and it'll be fine.
Longevity: Laptops and smartphones generally only have a 3-5 year lifespan due to battery degradation, and many people will want to swap it for one with more storage or whatever anyways. A Yubikey will essentially last forever, and if you stay clear of the insanity that is Passkeys its Webauthn element can support an infinite number of websites.
Portability: I have a smartphone, a work laptop, a home laptop, and a home desktop. My Yubikey has USB and NFC, so it can trivially be used with all of them. Individually enrolling each device would be a nightmare, and having the credentials sync is a bad idea from a security perspective.
Security: If your device gets compromised, it's pretty much game over: the attacker can now log in to all your accounts, any time they want. With a Yubikey I have to physically insert it and tap the button for each login - which is relatively rare because active sessions don't tend to expire. This means I would have to actively participate in a mass compromise of my accounts, making it way more likely to be noticed.
The point of passkeys that the key is kept inside a separate secure computer running secure blobs, so user codes can't touch it. That sounds sketchy but contactless payments using similar embedded secure computer has been fine so this should be too.
But I do recognize that really is a legitimate question and it feels like Yubi would benefit from running more outreach / promotion programs with schools and companies. I never felt like I could justify spending $50 just to try it out(especially when it doesn’t have support in a lot of sites), but then they partnered with Cloudflare to sell up to 5 per person at $10 each. It was a no-brainer to try it at that price and I haven’t looked back
$5 in the US is roughly equivalent to $20 in my country, when you adjust for purchasing power parity. We have over 70 million people who use Facebook and Youtube daily.
If rich Americans won't pay $20 for a Yubi key (and they are currently $25) why should we be expected to?
RSA keypads were an example. Absolutely free. Hung on keychains. Work well in that it was "secure" and worked, but an absolute nightmare for the banks to manage. UX was equally terrible (sure Yubikey isn't that).
The only way to mass introduce it is require multiple key entites to push and collaborate like your bank + phone provider to push it out for free.
Yubi keys are a logistical nightmare for my parents. SMS is not. For my parents, sticking to something in the phone is good.
Doesn’t using your password manager as TOTP code generator reduce the number of factors back to 1?
If the attacker got a list of passwords from a leak and your password was on it, the 2nd factor provided by the TOTP will still save you.
So, it just depends on your threat vectors. I’d rather people I support keep unique passwords alongside TOTP in a manager they’ll actually use than skip or use SMS TOTP because of a vague concern about targeted hacking of their manager.
Are there other threats that TOTP-in-password-manager can protect against that the randomized passwords don't already?
tbh the UX problem of 2fa for "I use random passwords and am not vulnerable to credential stuffing" users is a pretty big reason to stick TOTPs in your password manager.
Security is always a series of trade-offs, and 2fa brings some hideous trade-offs in many sites (well over half only allow one at a time, for example, and then you lose access permanently). TOTP with a standard like this lets you choose, rather than the site choosing for you.
Right, and if an attacker can dump password hashes they can likely dump TOTP seeds as well. With that level of database access the attacker may be able to steal all your info from the impacted service, so talking about the password may even be a distraction since all your data is already stolen.
TOTP + something like 1P moves this from happy-monday-an-infra-engineer-left-time-to-rotate-100-accounts to something you can just do periodically as you like.
The problem is that the vault file can be copied, which means this is now "something you and your attacker have". Even worse, it's not just the (probably encrypted) vault file: if your computer ever gets compromised, it is trivial to wait until you unlock the vault, at which point they can extract the now-plaintext TOTP secrets.
The way I understand it, the "something you have" factor is something which is intrinsically only a single item: either you have it, or you do not. If it can be copied, one of the copies could be compromised without you noticing - and because it's a copy you wouldn't even be able to revoke it without changing your own token too.
If that happens, nothing will save you. The malware can just grab your session tokens whenever you log in, then do whatever it pleases.
I don't know anyone who buy a second smartphoe to make it sure 2FA is on a separate device.
Google Voice is a total mess, and as a “free” consumer service that Google has shown little interest in maintaining and supporting, you don’t get any kind of support or help whatsoever.
My sincere advice (if you’re a free Voice user) would be to delink your Google Voice number from all critical services. Get a real phone number for which you have the ability to get customer support.
Google Voice is probably my favorite Google service... I have looked at alternatives many times in the past and have never found anything that compares that isn't super expensive (and usually not as good). I really hope Google keeps it. But I am prepared to migrate if Google shuts it down (and I really hope they provide a seamless number porting experience if they ever do...).
Their own internal teams as well as game studios didn't know about Stadia's end until the day it happened, what makes you think they'll treat you better with an unpaid service?
You can trust google they will let you use forever and won't block your account anytime without warning though.
(Perhaps this is just dread since I use it for the same purpose)
It’s absurd that for ultimate identity, currently services tend to rely on email, google account, or SMS, all of which are some combination of insecure, at risk of banning you on a whim, hard to recover, or prone to spam since they don’t verify real life identity.
The going argument is, WhatsApp if your number gets unused for 90 days doesn't let you reset password or something so its all fine.
Then its a matter of submitting a written application with the bank to change your mobile number so its all fine
My favorite is it's often paired with "passwordless" trash lol.
Why can't I just give my whole fucking credential out in 1 action. What's this nonsense where I have to enter my username, THEN wait for the page to load, THEN click "send verification email" or "send code", then half the time they want to SMS me and have me enter another code lmao.
I can’t speak to all of them, but many sites that require (only) a username first have enterprise SSO integrations.
The enterprise buying the service (understandably) doesn’t want its employees to type in both username and password on a 3rd party site, especially since the SSO process will handle auth after the username is entered.
I know of one site with both username and password on the first page, and has enterprise SSO. Login will automatically fail if you enter anything in the password field when logging in with an SSO-enabled username. But that doesn’t stop copy-pasted credentials from being transmitted to their server, which is something enterprise customers want to avoid
> [...] pay for international roaming [...]
I don't remember ever having to pay to receive SMS abroad. Is that a common feature with the plans where you live? (I mostly have experience with pre-paid plans from Asia, Australia and Europe.)
That post request is processed by my own Google apps Script to send it to my own telegram bot.
When I travel where my phone will not work in that country, my wifi connected devices get OTP right away, in about 5 seconds.
SMS 2FA predates cell phones. First SMS 2FA was AT&T in 1996 using pagers.
The first draft of the RFC for TOTP was written in 2008. Google Authenticator came out in 2010.
I knew someone who worked for a bank in the late 80’s - early 90’s, and I distinctly remember them having a little keychain dongle that generated one-time codes every (30? 60?) seconds for secure remote login.
The product may have been an RSA SecurID, or something else. Branding aside, it’s the same concept as modern TOTP. The main novelty of the TOTP RFC was standardizing the setup / secret sharing process and algo.
Weird, all the carriers I used either have free international roaming (at least for receiving text), or have wifi calling which allows me to use my phone as if I'm on the home network anywhere with an internet connection.
And though the one I used before did, I usually have a cheaper local SIM in my phone for data use when I'm traveling, and I'm not swapping SIMs just to authenticate to some company that hates its customers.
I'm pretty sure it's illegal for an EU network to charge for receiving a standard SMS or MMS - even while roaming.
I can therefore receive an SMS OTP in any country and won't pay a penny.
Note that the law in Brazil forbid telecoms from charging to receive phone calls or messages, even when roaming. But I guess the regulations don't extend to foreign users that are on international roaming, or companies do it anyway counting that the person will only find out after returning home and won't know how to fight it. Authorities are not set up as well to receive complaints from non-residents.
False
Many people don't have free international roaming, in fact mine only has roaming for US (I'm in Canada) and for zero roaming options available outside of North America.
Receiving calls isn't necessarily free when roaming.