Re:Google: Security Keys Neutralized Employee Phishing
by resonanttoe on Monday July 23, 2018 @01:17PM
(#17594166)
Not quite. A 6 digit code can be phished out from users pretty easily. They'll enter it anywhere its asked, similar to a password.
However the U2F and Fido spec requires a Cryptographic assertion (with all that replay attack mitigation stuff like Nonces) that makes it so that an attacker can reuse a Token touch. I'd probably encourage a glance over this https://fidoalliance.org/specs/fido-u2f-v1.0-ps-20141009/fid...
Sadly the Wikipedia article doesn't have a good layman's explanation yet, but I'm sure it'll will soon.
Yes at a high level, its still 2FA but like most options in any factor of Auth. It can be improved upon. (For a simple case, take Fingerprint readers and look at the advances of liveliness checks and how many unique points it requires.)
Re:Google: Security Keys Neutralized Employee Phishing
by dboreham on Friday July 27, 2018 @10:22AM
(#17626155)
When I say "2FA" I mean proper 2FA with a hard token. As used for 20 years or so in government, large companies.
The key (sic) thing about U2F isn't that it is new and special (it isn't -- it's plain old 2FA as used for more than a decade) but rather that it is practical to deploy for smaller organizations. You don't need to buy large quantities of keys. You don't need a special server. You don't need staff with special skills to deploy it. It works with "cloud" providers like Google and Facebook, out the box (same key as you use for your internal services).