Slashdot Mirror
Google Launches Its Own Physical Security Key (cyberscoop.com)
An anonymous reader writes: Google launched its own Titan Security Key on Wednesday, a small USB device which includes firmware developed by the omnipresent tech giant itself. This comes days after Google said its workforce has been phish-proof for more than a year thanks to security keys distributed to its 85,000 employees. The new key means new competition for Yubikey manufacturer Yubico which confirmed it is not involved with Google's new key. The product is available now to Google Cloud customers and will eventually be available to general customers, the company announced Wednesday at its Google Cloud Next conference in San Francisco. CNET, which tested the device, adds: It'll come in a bundle with both the USB and Bluetooth versions for $50, or you can buy one or the other for about $20 to $25 each, Brand said. The set of security keys should work on any device with a USB port or a Bluetooth connection.
And will it still work when Google abandon the project. Google are probably the most famous company on earth for abandoning projects that don't take off right away.
"That's the way to do it" - Punch
I imagine this thing will make sure to slurp up every last piece of data that the good little Google drones aren't already giving the Mothership.
I don't respond to AC's.
According to this story just posted yesterday, Bluetooth security is far from absolute.
Yes, but what if I social engineer your password and it's still useless because all your accounts use 2FA and I don't have your key?
what happens when you lose your key... fall back is always some info
When you register your key, you print out some temporary codes and keep that paper in a safe place. Then if you lose your key, you would use one of the temporary codes to log in.
Any sufficiently unpopular but cohesive argument is indistinguishable from trolling.
Hopefully it will be better than Google's "Find your phone" feature.
"Lost your phone? Finding it is simple! To start, sign in by typing the six-digit code we've just sent to your lost phone."
A phishing attack generally takes the form of a web form that looks like a legitimate site, the idea that the victim will enter their user and password into the form and the attacker will then be able to steal the credentials. 2FA is not always immune to this sort of attack since the second factor could be stolen and passed along immediately to the target site. In the U2F protocol implemented by these security keys, there is a public/private key pair generated for each site (which is in turn tied to the TLS certificate of that site). Proof of possession of the key by means of a signature is the second factor. This makes it pretty difficult to phish since the fake server owned by the phisher would not be able to stand up the same domain and TLS cert in order to get U2F on the client to generate a challenge that would be accepted by the attacked site.
Maybe I didn't explain it that well.. but the point is that the key becomes cryptographically tied to the target site in a way that cannot be replayed by a standard phishing attack.
The 3-2-1 backup strategy says you should have 3 copies of important information, 2 copies onsite but on separate drives or mediums and 1 copy offsite in case of malware or the kind of disaster you're describing.
Any sufficiently unpopular but cohesive argument is indistinguishable from trolling.
>In this case, it doesn't matter what 2-factor authentication method you use. I don't think this proves Google's device is any better or worse than any other 2FA mechanism, merely proving "requiring 2FA makes phishing less effective".
Actually the U2F protocol (yubikey and google's new key) is more phish-proof than TOTP or SMS based 2FA. In TOTP, it would be possible to for a phishing attacker to set up a fake website which passes credentials directly to the real website, thus owning the account. In SMS, it would be possible for an attacker to trigger the SMS authentication through the same means (passing the first factor to the real website, then presenting a form for the second factor). 2FA outside of U2F makes phishing more difficult, but still is possible, and these kinds of attacks do happen. U2F is "practically unphishable" because it doesn't allow a user to type in a OTP on a fake website.
And if my house burns down with my key and my paper and I can no longer access a machine that, for whatever reason, is not consumed in the inferno?
Generally speaking the keys are designed to be connected to your machine and left there permanently. I have the Yubikey Nano, because my employer requires two factor authentication to Github, and I leave it in the machine. So if the key was destroyed in a fire, so was the machine I use to connect.
I used to carry the Yubikey on my key ring, but its own lanyard cut right through the metal loop on the back of it. Not well designed at all as a removable device.
U2F is perfectly functional in Firefox 60+ as downloaded. But, for reasons I honestly can't get, it's not turned on by default. It worked before FF 60 with plugins.
about:config -> security.webauth.u2f true
Cloning is easy only for things that were designed to be read easily, from mag-stripes to normal flash memory (for example) that is specifically designed to give you the data you're asking for. Otherwise in real world it is really, really, really hard to clone things. If you don't believe me go and clone a kidney, heck even a tooth; your body has all the needed information isn't it?
Even the SIM cards from 20+ years ago are pretty resistant to attempts to extract the keys from them, and even if there are a few vulnerabilities and the designs were in infancy. Still even for those it's a pretty complicated affair to get the keys out.
Now it's a different story, any such devices are much more tamper-proof. Unless there's a backdoor (which is really a vulnerability of any such system) I think even three letter agencies will have a very hard time to get into those. Especially that there won't be any push to get them cracked, it requires too much effort as opposed to just getting the data from the provider (from what I understand these are for 2FA not to hold arbitrary encryption keys).
So someone just needs to use social engineering to get you to provide one of those codes.
Not even. It's likely even easier to use social engineering to get a user to run a program that opens a tunnel.