(untitled)

2fa seems like an obvious step forward in terms of securing accounts, but it doesn't seem like they are really popular. The most common form of two factor authentication is when a site sends you a text to see if you have the phone of the person you are claiming to be. However, there are several types of 2fa. This thread is about physical keys. Most of these keys use the FIDO U2F standard. The most popular of these keys is the Yubikey, but there are other vendors for this type of hardware. Of note is the u2fzero which is completely opensource. https://u2fzero.com/ https://www.yubico.com/ If anyone uses these devices, what do you think of them? Should everyone get one? Which one works for you and why?

2fa sounds good on paper, but I can never get behind it. I have bad cell where I live so sms is a pain. Email is annoying. And physical dongle is annoying because I lose stuff all the time. So honestly I just stick with passwords. I know these are not good reasons but I'm too lazy to switch. (for now)

>>4835 >sms is a pain. SMS is not even a legitimate form of 2FA since 2016 according to NIST since it's security is bad. In some services, SMS is used as a recovery method and it's opens a huge security hole. Sometimes, you don't even need to hack SS7, all you need for forwarding SMS and phone calls is your name and billing address. This is how someone lost all the coins, I can't find the article tho. >https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html

>>4836 > all you need for forwarding SMS and phone calls is your name and billing address. Wow that's scary! Learn something new everyday.

>>4837 >all you need for forwarding SMS and phone calls is your name and billing address. just found the article. >How to lose $8k worth of bitcoin in 15 minutes with Verizon and Coinbase.com >https://medium.com/@CodyBrown/how-to-lose-8k-worth-of-bitcoin-in-15-minutes-with-verizon-and-coinbase-com-ba75fb8d0bac >After talking at length with customer service reps, I learned that the hacker did not need to give them my pin number or my social security number and was able to get approval to takeover my cell phone number with simple billing information.

I turned on the Advanced Protection Program on my Google account. https://landing.google.com/advancedprotection/

>>4835 There is another option lainon. Use a TOTP. TOTPs are derived from a client side algorithm, just like an RSA dongle. You can use programs like duo to generate them, and duo has no knowledge of your totp seed. If you don't trust duo the algorithm is public and you can write a little app to generate your own totps. As long as your seed matches the services seed, it works. Many, many providers support this method of 2fa.

>>4834 I have a u2fzero and a Tomu but i still use the google authenticator app because it is more convenient to pull out my phone than it is to take off my necklace and plug in the device and click the button

>>4835 Losing the keys is always going to be a problem until we can inject keys into our skin, but you can always have two. Keep one in a safe or buried in the backyard and if you lose the other then you can still login and change the keys. To me that is an acceptable inconvenience for the amount of added security they provide. >>4849 I've never heard of the Tomu but it looks really interesting. How has the zero or tomu held up being worn on a necklace. How durable are they?

>>4850 I only wear the u2fzero on my necklace but it's staying strong. Been there over a year and still no issues, i've read it can even do a cycle in a washer and still be fine.