Hacker News Reader

Comment by kevin_b_er | Hacker News Reader

The problem is that if poor solutions as far as usability are present, you'll have the telecos win.

This is a race against Mobile Authentication Taskforce and their fundamentally insecure accounts. If the solution can't beat them, it'll get trampled.

Those other "unsafe actors" are trying to completely take over authentication, meanwhile you need 2 $50 hardware security keys at a minimum to safely use this tech. This will lose on consumer pricing and consumer uptake to the insecure Mobile Authentication Taskforce and you won't GET the option to use a FIDO2, because you'll have the choice of insecure mobile auth or nothing.

You have to win against the public or they'll be suckered by bad and insecure authentication that is easier to use, and the things you want to use will be insecure anyways.

View on HN

You can get a U2F device that lives in your phone’s SEP, right now, for free. U2F kegs are not $50.

https://krypt.co/

You don't need $50 products. You especially don't need two of them.

Yubico already make a Security Key that isn't also a PGP key store, a TOTP authenticator, bagel toaster and whatever else for about $20. And there are cheaper vendors if price is the main concern.

Why do you say you don’t need two?

The argument seems pretty straightforward: if you don’t trust SMS, you need to disable all backup authentication. If you’ve disabled backup, you surely don’t your physical device to be a single point of failure?

You don't have to use sms as your backup authentication mechanism. TOTP and 1 time use codes are both better options.

My point was that your backup "emergency" token doesn't need all the fancy features of the 5 series.

It's the backup option, it's the reserve, it didn't have to be the best possible thing, just enough to get you back into the game after you lose the main token somehow.

The $20 one doesn't support a phone, regrettably. We need at least the $45 NFC edition, or it won't help people trying to log in with their phones. We continually talk on HN about how many are increasingly only using their phones and no longer use or posses general purpose computing devices. A USB-A only device only works for people still using computers. The Mobile Authentication Taskforce still wins and your only choice anywhere that isn't already highly technical will end up being Project Verify and the point of failure will still remain as socially engineering underpaid customer support staff.

Reply on news.ycombinator.com