News for hackers. Stuff that matters.
Re:Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U... by jiveturkey on Friday August 10, 2018 @03:16PM (#17736023)
Title (original from TFA) is very misleading. The study is too late in the process of setting up 2FA. No one in the study was motivated to set up 2FA in the first place. This is "merely" a UX study that benefits Yubico. It doesn't address (at all) why people do or do not want 2FA in the first place.

To use my own insight: regular joe does not want to buy an expensive product and install some hardware. (the "cheap" $20 ones are literally worse than useless. but even $20 is too much.) 2FA's future is in touchID (integrated into touch bar on mac) and push to a phone app. The latency of push to a phone app is more acceptable than the confusion and vagary around adding an expensive usb key that you don't understand and then doesn't work on your mobile anyway.

Re:Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U... by techsupporter on Friday August 10, 2018 @05:16PM (#17736806)
> the "cheap" $20 ones are literally worse than useless.

How so?

> 2FA's future is in touchID (integrated into touch bar on mac) and push to a phone app.

As another person pointed out, this is quite literally what krypt.co's Krypton app does and it integrates with existing U2F/FIDO standards so either a hard or soft device can be used.

Re:Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U... by yayana on Friday August 10, 2018 @07:35PM (#17737444)
I find that quote odd too. I find the $10 USB-only ones useful, I just wish they had dual normal/micro USB like some flash sticks.

I don't want Bluetooth, NFC or software u2f devices for security reasons, but I also think they could each have additional support problems if given to family members.

The ideal option for me would be an applet on a smartcard in my phone's 2nd sim bay and a hard power toggle for the 2nd bay. Then I suppose my phone could also provide proxying of u2f as a USB device.

But last I looked Android was blocking access to simcard slots for general purpose..

Re:Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U... by StavrosK on Friday August 10, 2018 @07:21PM (#17737389)
Krypt.co looks pretty nice, I have a Yubikey and andOTP but I hate either getting up to fetch the hardware key or fumbling about for the right TOTP code, so the soft-approve by Krypton looks like the most convenient option, and reasonably secure, to boot.
Re:Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U... by mvanbaak on Friday August 10, 2018 @03:54PM (#17736278)
"then doesn't work on your mobile anyway." The yubikey neo works perfectly on your mobile, as long as it has NFC support.
Re:Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U... by jiveturkey on Friday August 10, 2018 @05:03PM (#17736714)
i'm sure the neo is flying off the shelves at $50 ...

it's awkward enough for desktop use that push to mobile is a superior UX

Re:Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U... by javagram on Friday August 10, 2018 @05:19PM (#17736820)
U2F through the yubikey doesn’t work on iOS devices because iOS NFC is only 1-way outside of Apple Pay.
Re:Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U... by jacquesm on Friday August 10, 2018 @05:54PM (#17736996)
I hate private APIs. There ought to be a law that vendors can only use public APIs.
Re:Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U... by Tomte on Friday August 10, 2018 @04:43PM (#17736592)
So Apple is out, right?
Re:Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U... by DarkStar851 on Friday August 10, 2018 @04:58PM (#17736681)
What? iPhone 6s and newer supports NFC.
Re:Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U... by gruez on Friday August 10, 2018 @05:09PM (#17736753)
6s supports NFC for EMV only. 8 and newer has generic NFC support.

https://developer.apple.com/documentation/corenfc

Re:Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U... by devinl on Friday August 10, 2018 @05:39PM (#17736935)
The "generic NFC" support you refer to is read only which means that protocols like U2F still don't work so usability of U2F for iPhone users is still not there (without bluetooth keys which have their own problems).
Re:Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U... by dbb01 on Friday August 10, 2018 @07:29PM (#17737416)
The neo NFC works with iPhones 7 and above
Re:Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U... by sofaofthedamned on Friday August 10, 2018 @05:39PM (#17736937)
Only for Apple Pay, which is another reason Apple are disingenuous when it comes to security.
Re:Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U... by m-p-3 on Friday August 10, 2018 @10:17PM (#17737913)
Sadly my Xiaomi device doesn't..
Re:Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U... by dijit on Friday August 10, 2018 @05:12PM (#17736775)
What about krypt.co ?