What I Wish I Knew About U2F and Other Hardware MFA Protocols

Re:What I Wish I Knew About U2F and Other Hardware MFA Proto... by mPReDiToR on Saturday April 17, 2021 @04:09AM (#26842511)

I tried YubiKey and SoloKey (OSS).

I've settled on OnlyKey (https://crp.to) because it's OSS and you can back it up and restore. Backup can be GPG encrypted.

24 slots, programmable to store URL, U/N, P/W, 2FA, with the ability to click the address bar in a browser, hit a key on the OnlyKey and watch as it types it all in without any other interaction.

It stores MANY types of auth.

Not affiliated, but a very happy user.

It's a device you'll learn more about as you use it, but YubiKey functionality is achieved in a couple of minutes.

[ Parent | on HN ]

Re:What I Wish I Knew About U2F and Other Hardware MFA Proto... by gnufx on Saturday April 17, 2021 @07:13AM (#26843365)

OnlyKey's features are attractive, but its implementation has been questioned. https://news.ycombinator.com/item?id=21884184

[ Parent | on HN ]

Re:What I Wish I Knew About U2F and Other Hardware MFA Proto... by mPReDiToR on Saturday April 17, 2021 @02:48PM (#26846471)

I'm not sure I come away from that discussion with less confidence.

The dev managed to answer everything put to them with alacrity. The question of code quality was of no consequence as even ugly code can work, and it's got more eyes on it than closed source.

In my threat theatre this device is far more than adequate for securing GitHub, GOOG, and a couple of GPG/ssh keys.

Should I ever becaome a spy, I'll probably revert to speaking to strangers about how red sparrows fly at certain times of day again.

[ Parent | on HN ]