News for hackers. Stuff that matters.

A comment on Tell HN: SMS-based two-factor authentication is not secure. Parent comment

Re:Tell HN: SMS-based two-factor authentication is not secure by PeterisP on Wednesday June 09, 2021 @01:28PM (#27450644)
It is safe to use the same U2F token for many sites, that's not an issue. Having a backup token is very useful, but apart from that, a single hardware token (not custom - standards are good) can easily be used to secure all your accounts.
[ Parent | on HN ]
Re:Tell HN: SMS-based two-factor authentication is not secure by dheera on Wednesday June 09, 2021 @02:13PM (#27451170)
The only thing I wish is that more sites support multiple tokens, since tokens can get lost.

If you only support one token but have an easy recovery procedure, that opens up loopholes. If you support multiple tokens, allow the user to de-activate one token from another token, and make recovery difficult, that's much more secure.

[ Parent | on HN ]
Re:Tell HN: SMS-based two-factor authentication is not secure by tialaramex on Wednesday June 09, 2021 @03:22PM (#27451973)
Again, other than AWS which "more sites"?

Dropbox, Facebook, Google, GitHub, GitLab, even Login.gov works fine with multiple tokens.

More sites should do WebAuthn (you should not do greenfield deployments of U2F today, WebAuthn is the standard). Yes, AWS should fix their feature but that shouldn't block the next ten would-be Unicorns from doing WebAuthn.

[ Parent | on HN ]
Re:Tell HN: SMS-based two-factor authentication is not secure by dheera on Wednesday June 09, 2021 @04:05PM (#27452449)
Twilio, Kraken, Paypal, Gusto, Bittrex, Coinbase, ...
[ Parent | on HN ]
Re:Tell HN: SMS-based two-factor authentication is not secure by tialaramex on Wednesday June 09, 2021 @04:30PM (#27452802)
But none of these support U2F or WebAuthn at all. The problem isn't that they need to support "multiple" tokens except in the sense that they don't support any at all.
[ Parent | on HN ]
Re:Tell HN: SMS-based two-factor authentication is not secure by dheera on Wednesday June 09, 2021 @04:39PM (#27452919)
They all support TOTP and some (such as Kraken) support U2F.

Point is whether it's U2F or Web'n'Auth or TOTP they need to support multiple keys.

[ Parent | on HN ]
Re:Tell HN: SMS-based two-factor authentication is not secure by tialaramex on Wednesday June 09, 2021 @06:55PM (#27454403)
Kraken's own support site says that they do not in fact support U2F.

https://support.kraken.com/hc/en-us/articles/360001363963-Yu...

It doesn't make sense to try to "support multiple keys" for TOTP. You can copy-paste TOTP seeds if that's what you want and feel comfortable with, if the site tries to allow you to use any of N seeds they not only increase their system complexity they also reduce their security by a factor of N which makes no sense.

Edited to add: OK, Coinbase does now have U2F and they clearly state you can use "a maximum of 5 keys" which feels like that's enough.

[ Parent | on HN ]
Re:Tell HN: SMS-based two-factor authentication is not secure by mrweasel on Wednesday June 09, 2021 @02:13PM (#27451165)
Assuming that the sites allow you to change the token manually?
[ Parent | on HN ]
Re:Tell HN: SMS-based two-factor authentication is not secure by tialaramex on Wednesday June 09, 2021 @03:04PM (#27451770)
I've never seen a site that didn't have at least this.

Usually you get a UI where you can add new ones and remove old ones, and when you add a new one you name it in their UI so that you can tell it apart from any others.

[ Parent | on HN ]