Hacker News Reader

Hacker News

Comment by pier25 | Hacker News Reader

Full thread

pier25

So what happens if you lose one of those USB devices?

Can you use multiple USB devices on the same site?

View on HN

OK, so here are the options I've seen people deploy for 2FA:

1. Force users to register two U2F tokens. Google's 'advanced protection' requires this.

2. Have users print out one-time-use recovery codes and put them somewhere safe. This is what Google does without 'advanced protection'.

3. Require the user to provide a cell phone number, thus offloading the problem to cell phone companies, introducing all the insecurities that result from that. This is what Apple does (as far as I can tell)

4. AWS is similar, but requires both an e-mail and an automated phone call.

5. Github delegates 2FA recovery to Facebook, via their "Recover Accounts Elsewhere"

6. Facebook allows the user to designate 'trusted contacts' who can get a code they can give to the user in person or over the phone.

7. Have the customer contact customer services, who follow a process companies are cagey about disclosing.

8. In corporate settings, just have them visit helpdesk in person.

I like #2 the best personally, though #6 sounds interesting too.

For something like #5, let's hope the other website's auth isn't on the same key too :)

#2 sounds most appealing. I live in Japan and don’t have a reachable phone #. Wife and I simply FaceTime if we need anything. Otherwise I have no mobile means of authentication. There have been several occasions where I simply couldn’t use the service because I could not authenticate via a phone number. I feel that companies that force this method of authentication have never considered my use case and could care less if they lose me in the signup process. Too bad. I for one actually have the money to pay them, but hey, if you don’t want it that’s fine with me.

In addition to being able to add multiple devices, there are recovery scenarios that would ostensibly fall outside of the scope of WebAuthn. A service using WebAuthn could give you a set of one time use high-entropy codes that can be printed and stored in a safe location. When you use those code to gain access to an account for which you have lost your token(s), you would of course get an e-mail letting you know that someone (you in this case) did that.

webauthn has to solve the problem, or the problem will still exist and will stop mass adoption.

Not necessarily, it just has to not preclude a de facto standard solution. And it doesn't. The scheme described by OP above sounds fairly sane without compromising the overall security of the system (in the way that e.g, password reset forms and security questions do).

No, its a shitty way of doing it that will never work in practice.

Nobody will remember where those are.

They will likely download the pdf, store it in downloads, where it will be used by some Trojan to hijack their account, or they will lose it during a device switch or some dataloss event.

Telling people to store one time codes securely and reliably, for every single account they own, and telling them that will only work for the services that bothered to add that on to their implantation of the standard, works for techys, but not the overall populous.

How is losing your key any different from losing your password? "Password" doesn't try to solve the problem of losing your password, that's beyond the scope. All recovery methods that apply to passwords also apply here.

If you lose a FIDO token now somebody else has a FIDO token. Unless they know specifically that it was yours the only thing they can do with it is use it as their own.

A good implementation of this approach allows you to add multiple tokens. GitHub does for example, but not all are good.

That will depend on the site. It's not a new problem to think about either.

For instance, you can set up multiple MFA mechanisms on Google, and I believe you can set up multiple U2F devices for any given account.

To this day you cannot set multiple MFA devices on an AWS account. No, enrolling multiple devices at the same time from the same screen does not count.

Yes. Multiple U2F devices are possible. I have 2 yubikeys connected as well as the Google prompt.

Google's advanced protection actually requires you to register two hardware keys.

If you don't have that, printing out backup codes and storing them somewhere safe is probably the way to go.

I think this is an issue of 2FA in general. If you can only have one second factor (and some backup codes), then you're going to be out of luck if something changes.

Reply on news.ycombinator.com