7 ms·

Isn't this the same as a code app like Authy? Why carry the extra dongle?

by scrrr 8y ago

matharmin 8y ago
Similar use case (2FA), but different implementation. Instead of typing in a code, you press a button. It also protects against phishing by validating the URL of the site you're authenticating on (with a code-based 2FA you can still enter your code on a phishing site, which then forwards it to the real one).
- scrrr 8y ago
  Good reasons, thanks!
- m_eiman 8y ago
  There are apps that also validate the source and can automatically sign you in (or require a button press), e.g. https://www.kryptco.com https://www.kryptco.com Seems like it might be useful, but haven't had the time to try it out yet.
  - tialaramex 8y ago
    AIUI Krypton is basically doing the same thing as these FIDO2 Security Keys, but their software substitutes an app on your Phone for the Security Key. So a web site offering WebAuthn can't tell the difference (unless you allow it to interrogate the "Security Key" to ask who made it, which you probably shouldn't) I personally would rather have Security Keys, but a solution like Krypton is definitely easier for a lot of users and obviously the price differential is hard to argue with.
ZiiS 8y ago
An app has a much larger attack surface (for instance from malware on the phone). TOTP has to use short easy to enter codes (six digit numbers), Titan is doing a full handshake using modern cryptography with sensable key lengths. In many use cases pushing the button on the key is quicker/easier then using the app.
pg_bot 8y ago
While both handle two factor authentication, Authy only assists with time based one time passwords (TOTP) which still leaves the end user open to phishing. These security keys are meant to be used with universal second factor (U2F) which prevents phishing entirely. https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_a... https://en.wikipedia.org/wiki/Universal_2nd_Factor https://en.wikipedia.org/wiki/Universal_2nd_Factor

Isn't this the same as a code app like Authy? Why carry the extra dongle?

by scrrr 8y ago

Isn't this the same as a code app like Authy? Why carry the extra dongle?

Similar use case (2FA), but different implementation. Instead of typing in a code, you press a button. It also protects against phishing by validating the URL of the site you're authenticating on (with a code-based 2FA you can still enter your code on a phishing site, which then forwards it to the real one).

scrrr 8y ago
Good reasons, thanks!
m_eiman 8y ago
There are apps that also validate the source and can automatically sign you in (or require a button press), e.g. https://www.kryptco.com https://www.kryptco.com Seems like it might be useful, but haven't had the time to try it out yet.
- tialaramex 8y ago
  AIUI Krypton is basically doing the same thing as these FIDO2 Security Keys, but their software substitutes an app on your Phone for the Security Key. So a web site offering WebAuthn can't tell the difference (unless you allow it to interrogate the "Security Key" to ask who made it, which you probably shouldn't) I personally would rather have Security Keys, but a solution like Krypton is definitely easier for a lot of users and obviously the price differential is hard to argue with.

ZiiS 8y ago

An app has a much larger attack surface (for instance from malware on the phone). TOTP has to use short easy to enter codes (six digit numbers), Titan is doing a full handshake using modern cryptography with sensable key lengths. In many use cases pushing the button on the key is quicker/easier then using the app.

pg_bot 8y ago

While both handle two factor authentication, Authy only assists with time based one time passwords (TOTP) which still leaves the end user open to phishing. These security keys are meant to be used with universal second factor (U2F) which prevents phishing entirely. https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_a... https://en.wikipedia.org/wiki/Universal_2nd_Factor https://en.wikipedia.org/wiki/Universal_2nd_Factor