Slashdot Mirror
Google Adds USB Security Keys To 2-Factor Authentication Options
An anonymous reader writes with this excerpt from VentureBeat: Google today announced it is beefing up its two-step verification feature with Security Key, a physical USB second factor that only works after verifying the login site is truly a Google website. The feature is available in Chrome: Instead of typing in a code, you can simply insert Security Key into your computer's USB port and tap it when prompted by Google's browser. "When you sign into your Google Account using Chrome and Security Key, you can be sure that the cryptographic signature cannot be phished," Google promises. While Security Key works with Google Accounts at no charge, you'll need to go out and buy a compatible USB device directly from a Universal 2nd Factor (U2F) participating vendor.
I wonder if I can go dig out one of my old C=64 application dongles to use... of course it will be disconcerting if I heard the read/write heads slamming against the side of my disk drives
Have a Day!
So, what is a good USB device for this? Any recommendations?
Let me know when they start selling cheap NFC dongles so we can just tap our phone on them to login. I'm sure our company would buy a bunch. 2-factor makes logging in to conference systems a pain in the ass - everyone is always looking to the guy who doesn't use 2-factor to login already. I don't see how fumbling around with USB sticks is much better.
What keeps me (or my malware, respectively) from opening a google page in the background (i.e. not visible to the user by not rendering it but making Chrome consider it "open") and fool the dongle into recognizing it and the user into pressing the a-ok button?
A machine that is compromised is no longer your machine. If you want two factor, use two channels. There is no way to secure a single channel with two factors sensibly.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
How will the government help us correctly understand politics if they can't read our email?
Good way to spread BadUSB exploits.
When i bought yubikey neo more than a year ago i was disappointed to find out that due to new regulations each device had been updated to have a serial number that was also appended/part of every transaction. I inferred that to be a back door. Is this still the case. Is this new version truly my key or is it yubi cos key also that can be stolen?
The announcement was again very fluffy, hoping someone else does the footwork to see if this is truly viable to secure my kingdom...
It still doesn't protect you against someone who steals the USB key, or uses duress to obtain it from you. Perhaps a 3-step system could be designed. Step 1: Have login/password. Step 2: USB key. Step 3: Huge, muscular guy with a lead pipe and/or gun.
It's fucking Google. You don't need security because you CAN'T have security with them.
Privacy and security are impossible to attain when you're making use of the services of a company whose purpose is to gather all the data it can about you by any fucking means possible.
Does anyone know if LastPass USB dongles qualify?
It's really sad to see Google turning inwards like this. What happened to working towards open standards for such things?
where to buy one from.
"Your search - FIDO U2F Security Key -amazon - did not match any shopping results"
I can't wait for Mozilla to create a version of this that's actually trustworthy and works well outside of Google's ecosystem. That way the purpose isn't just to help Google know more about me under the guise of "helping protect me". I also can't wait for nobody to adopt it because it's not fully compatible with the Google or Apple ecosystems.
The way some bank do it, is that the authification asker (a 2F-protected service provider) sends a signed/encrypted message, that the security token decodes/verifies/displays. That message can't be tampered with (cryptography).
So the token will display the message (something like "Authentication required to access GMail.com").
so if an attacker tries to intercept your credential by opening an actual google page in the background, you'll notice that what the thing pretends to be on screen and what the dongle register as an asker aren't the same.
The way to fool the user would be to try to look actually like the page you're trying to spoof. So an attacker needs to look like GMail, so the user thinks he's on Gmail, whereas actually it's a malware page maskarading as it and relying security tokens from the real Gmail.
Now the way that banks counter-act that, is that any critical action (payment, etc.) needs to be confirmed again by the security token system. So the theoretic man-in-the-middle can't inject payment for 10'000$ for his Cayman Islands account. Because every payment needs to be confirmed again. And the bank will issue confirmation message regarding transaction.
You'll notice if when paying a phone bill, the confirmation message instead is 10'000$ for Cayman Islands.
Overall, it works as if the security token is its very own separate device, designed to work over non-reliable non-trusty channel.
(The device doesn't implement a full TCP/IP stack. Most example device accepts only:
- a string of caracters as an input (i.e.: you need to type the last five digit of the account you need to send funds too. The bank will notice when you type the digit of your utility company, but the man-in-the-middle has tried to inject a cayman island account from your browser).
- a 2D flashing barcode to automate string input.
- for the most crazy solution: writing a string to file on a flash-disk, this flashdisk is shared with the security token's microcontroller.
Each time, the attack surface is very small. Only a short string of data is passed. You can't get much exploitable bugs.
For the output, only a string again:
- that you read and type from the token's screen.
- that the token can type on your behalf, communicating with a HID chip on the same device.
- the token can send it to a flash device that makes it visible inside a file.
Again, the security token it self is limited to send just a string. Very small attack surface. All the funny "stuff" are implemented outside, and thus very low risk of remote exploitability)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Why not use standard smartcards with client-side SSL certs for this? There's already a widely used cross-platform, cross-browser, hardware/software standard to do exactly this!
MITB is the difficult case, and the way that bank accounts get emptied. The bad guy has malware on the victim computer, and the malware puts up web pages, and of course it can just lie about the url bar. So then the bad guy puts up the fake bank web site, and the victim type in the 2-factor code or whatever, and now the bad guy has it. Obviously Google knows about the MITB case. Does this thing have some sort of MITB mitigation? I'm guessing it does something. Hey Google, what do you say?
The classical solution to MITB is that the little key has its own display, so it can show "Confirm transfer $4500 to account 3456" - showing the correct info to the "victim" even if their laptop is compromised. Basically, keeping the usb key itself from getting malware is feasible, while keeping the laptop or whatever clean is not.
Use FreeOTP or Google Authenticator? It's simple yet pretty well secure and allows an arbitrary mobile device to provide keycodes? Sure, you have to actually type a few numbers (the horror), but at least you don't need yet another security dongle that, despite the current hype, will probably be obsolete in a couple of years.
XML is like violence. If it doesn't solve the problem, use more.
"new NEO?"
Is this a built-in redundancy?
I would have a sig but I am too busy updating programs and restarting my computer
Cant wait to get my hands on one of these. Unfortunately Amazon doesn't ship to Poland so I can't get it here. I have two concerns regarding this:
I understand this is an amateur class device. Better (or is it?) than Authenticator app as you need to gain the physical key since a phone app can be accessed remotely at least in theory but still not hard security as corporate smart cards, RSA tokens etc. Just hardware two form auth for the masses and I guess it is a good thing to have (or is it?). But as I see the form of distribution of this hardware is quite loose. If I order it via Amazon (if I could) it goes through amazon warehouses, shipping company etc. - could this device be tampered with in shipping? Shouldn't it have a safer distribution method like physical store so you can randomly pick one and it couldn't be identified to your identity?
How does it work? It states that it requires supported browser (Chrome 38) on any platform it runs but does it also work in Chromium (I am using Chromium)? Can it be used in other applications f.e. VPN client, SSH client? Does it use some open source library, tools? How it works as a device - I plug it in and it registers as standard USB class device - what class is it?
I've tried to google these concerns for few seconds but couldn't find good information so please anybody could clarify on this?
A lot of SOE's disable USB access on their computers, so this is fucked before it starts. A 2F application running on iOS/Android devices polling an authentication API for pending approvals might work well, e.g.:
You mean like all Chinese banks have been doing for the last 10 years?
its a usb device. So the standard methods of usb redirection apply. If your computer is infected with something that can do that, which is not uncommon functionality in a decent modern rootkit for windoze, this dongle wont make you more secure.
Its a permanent, hardware based ID token. And its for use with G-oogle services. Yes, the bar gets raised as to WHO gets to misuse your account. Yes, bypassing this requires alot more work on the part of random Joe Hacker who's fishing in the upstream...
However, dare i say, against attackers who own the networks, the telcos, the spooks, the organised faggots who get access to firmware of this thing, it has potential of reducing security for the end user. One token to clone, one token to completely take over your identity. And don't get me started on the possibilities that having a hardware token controlled by third party stuck in one of your usb ports creates for monitoring and infiltration. Also, its made by an american corporation. Trusting those is beyond stupid.
Existence of such devices is theater. No real security.
An online service I know offers a Yubikey, but it only has two slots. One of them is pre-configured to work with their service, which leaves one for your own use.
While I like the idea of the keys I am afraid, that instead of 50 passwords we're gonna have 50 (ok, 25) keys dangling on our keychains. Any solutions before they're needed?
I use Google Authenticator for quite some sites, not only the Google ones.
After reading the links here I'm under the impression that any site outside Google will not work with this method and I'll have to continue using the Authenticator app on my phone. Is that correct?
Personal Phone, Tablet, Laptop and now Dongle....