Hacker News Reader

Comment by tialaramex | Hacker News Reader

And the annoyance makes people want to turn it off.

Typical solution: Make the timeout much longer so you don't need to keep doing the work

Correct solution: Deploy a second factor that isn't annoying

If your second factor is a FIDO Security Key then you just touch the key. Doing this a dozen times per day feels about as much trouble as how you have to hit the spacebar to make spaces when typing, ie you aren't even aware of it.

The VPN couldn't easily do this out of the box today (as OpenSSH demonstrates, where there is a will there is a way but I wouldn't trust a typical proprietary VPN client to not open massive security holes this way) but all the web stuff you mentioned could use WebAuthn, and Okta supports that if your employer deployed it as I understand it.

View on HN

Correct solution to me is to just turn it all off and accept the tradeoff to not make your employees suffer all day.

That security key works fine in an office environment, but becomes a lot more annoying on, for instance, a mobile device.

I'm hoping that more apps start accepting NFC security tokens for mobile apps. Apple says they added NFC FIDO-2 authentication support in iOS 13.3[0], but I have yet to see an app that allows me to authenticate that way.

[0]: https://www.macrumors.com/2019/11/12/ios-13-3-fido2-security...

This is certainly better, but it doesn't really get us to the point the GP is describing, where authenticating "feels about as much trouble as how you have to hit the spacebar to make spaces when typing, ie you aren't even aware of it." I have to somehow get both my phone and my token out of my pocket at the same time, and hold them together, which can be awkward on a cramped subway, or when I'm holding something in my other hand.

Apple has subsequently announced and demo'd a platform authenticator for Macs and iPhones, like the one on a Pixel (the flagship Android phone).

So then you don't need the token because the platform (ie your phone) does the multi-factor authentication itself. In this case you touch a fingerprint reader. I can hold my phone in a way where my right index finger naturally is placed to do this so it feels pretty convenient.

Again, not on iPhones today but it has been demo'd and does already exist on Android.

GitHub's web interface uses my security key in NFC form from my android phone, I assume it would be the same on iOS?

Android has supported NFC security keys for a long time, and I believe it's automatic for websites that support U2F. I'm not sure about iOS, in the past it used to be impossible.

I use one of these: https://www.amazon.com/Feitian-ePass-NFC-FIDO-Security/dp/B0... . Plug into laptop when using laptop, hold against back of phone while using phone, and the form factor is non-annoying on my keyring with my house keys. I was shocked that YubiKey doesn't offer a single key that works for both phone and laptop.

The yubikey 5 NFC does. I think they also have a cheaper product which does FIDO2/U2F only also via usb A and NFC too. Before that, the yubikey neo did both NFC and USB A.

Reply on news.ycombinator.com