Hacker News Reader

Comment by kevin_b_er | Hacker News Reader

We'll see. There was barely any uptake of FIDO U2F on the web. Sure there were a few major players, like google, but pretty much nothing financial for the public have taken up anything but insecure SMS/call authentication.

Meanwhile telcos are working hard to convince the public they should all throw in with their insecure telecos accounts as a chain of trust after time and time again showing that your telco account is trivial to steal.

Not convinced on FIDO2, either. It means you need TWO of these devices. One as a backup and another as the common case. Why? Because if you lose a single physical key, you'd have to recover your account. Recovering your account will probably end up being insecure SMS auth or easily socially engineered below-US-min-wage outsourced phone support.

View on HN

Some actors doing unsafe things should not preclude us from building safe things in the mean while. Google/GSuite accounts matter. GitHub accounts matter.

The problem is that if poor solutions as far as usability are present, you'll have the telecos win.

This is a race against Mobile Authentication Taskforce and their fundamentally insecure accounts. If the solution can't beat them, it'll get trampled.

Those other "unsafe actors" are trying to completely take over authentication, meanwhile you need 2 $50 hardware security keys at a minimum to safely use this tech. This will lose on consumer pricing and consumer uptake to the insecure Mobile Authentication Taskforce and you won't GET the option to use a FIDO2, because you'll have the choice of insecure mobile auth or nothing.

You have to win against the public or they'll be suckered by bad and insecure authentication that is easier to use, and the things you want to use will be insecure anyways.

You don't need $50 products. You especially don't need two of them.

Yubico already make a Security Key that isn't also a PGP key store, a TOTP authenticator, bagel toaster and whatever else for about $20. And there are cheaper vendors if price is the main concern.

Why do you say you don’t need two?

The argument seems pretty straightforward: if you don’t trust SMS, you need to disable all backup authentication. If you’ve disabled backup, you surely don’t your physical device to be a single point of failure?

You don't have to use sms as your backup authentication mechanism. TOTP and 1 time use codes are both better options.

My point was that your backup "emergency" token doesn't need all the fancy features of the 5 series.

It's the backup option, it's the reserve, it didn't have to be the best possible thing, just enough to get you back into the game after you lose the main token somehow.

The $20 one doesn't support a phone, regrettably. We need at least the $45 NFC edition, or it won't help people trying to log in with their phones. We continually talk on HN about how many are increasingly only using their phones and no longer use or posses general purpose computing devices. A USB-A only device only works for people still using computers. The Mobile Authentication Taskforce still wins and your only choice anywhere that isn't already highly technical will end up being Project Verify and the point of failure will still remain as socially engineering underpaid customer support staff.

You can get a U2F device that lives in your phone’s SEP, right now, for free. U2F kegs are not $50.

https://krypt.co/

Reply on news.ycombinator.com