Soft U2F: A software-based U2F authenticator for macOS

Re:Soft U2F: A software-based U2F authenticator for macOS by nevir on Monday July 24, 2017 @05:47PM (#14843019)

It's really not that much less secure than physical 2FA: I'm willing to bet that most people just leave their hardware key in their laptop at all times. (where "most people" ends up being corporate U2F users, who are probably given YubiKey Nanos and the like)

At that point, your laptop is basically your 2nd factor - which this software is pretty similar to.

[ Parent | on HN ]

Re:Soft U2F: A software-based U2F authenticator for macOS by petee on Monday July 24, 2017 @07:58PM (#14843855)

But even if you leave it in, everything is still protected in hardware, and in addition, malware can't trigger a physical presence button push...so, it is in fact significantly less secure...

[ Parent | on HN ]

Re:Soft U2F: A software-based U2F authenticator for macOS by djcapelis on Tuesday July 25, 2017 @01:21AM (#14845278)

> malware can't trigger a physical presence button push

It kinda can, it just needs to trigger a dialog the user thinks looks legit. Or easier, just stay resident until the next time the user pushes the button.

Don't get me wrong, U2F has benefits, but it's not invulnerable to malware designed for it. You want real system level protections to back it up and most users aren't running on operating systems that can really cash the check you're trying to write with that threat model.

[ Parent | on HN ]