News for hackers. Stuff that matters.
Re:Apple, Google and Microsoft Commit to Expanded Support fo... by xur17 on Thursday May 05, 2022 @11:28AM (#31274589)
Has anyone tried a Ledger or Trezor device for something like this? Your FIDO U2F private key is deterministically generated [0] based upon your seed phrase, which you can backup, and restore on other devices.

[0] https://www.reddit.com/r/ledgerwallet/comments/udzx1c/ledger...

Re:Apple, Google and Microsoft Commit to Expanded Support fo... by lxgr on Thursday May 05, 2022 @03:03PM (#31277227)
At least Ledger actually does support U2F as an installable application, but that's the predecessor to FIDO and has some weaknesses in comparison. I'm also not sure whether WebAuthN supports legacy U2F authenticators without the browser performing some protocol translation.
Re:Apple, Google and Microsoft Commit to Expanded Support fo... by nybble41 on Thursday May 05, 2022 @06:03PM (#31278866)
Ledger and Trezor both support U2F, which is a FIDO protocol but not the latest version. The Trezor Model T additionally supports FIDO2 (WebAuthn).
Re:Apple, Google and Microsoft Commit to Expanded Support fo... by eswat on Thursday May 05, 2022 @03:47PM (#31277673)
I have a Ledger as a backup key. Keyword is backup since it's less convenient to use than a Yubikey due to needing to put in a pincode first. Though that could be a security feature in and of itself.
Re:Apple, Google and Microsoft Commit to Expanded Support fo... by aaaaaaaaata on Thursday May 05, 2022 @02:34PM (#31276940)
Any input which (Trezor/Ledger) is least likely to be a honeypot?, and/or a good device?
Re:Apple, Google and Microsoft Commit to Expanded Support fo... by xur17 on Thursday May 05, 2022 @02:41PM (#31277014)
What do you mean by a honeypot? Both are pretty well trusted devices, and users easily have tens of billions of dollars deposited on them. Given that, I feel pretty comfortable using them for 2fa.