Collaborate Disseminate
I want to order a 2FA key (like yubikey) online and I want to know if someone could make a duplicate of whatever key I order during shipping.
I don’t want to discuss if someone could access my package. I want to know if someo… Continue reading Can 2FA keys be duplicated?
I would like to use hardware security keys in an environment where it is additionally needed to lock down any ways in which a user could download data to a device like a usb key. Is it possible to lock down a usb slot in a wa… Continue reading Hardware security key with locked down usb slots
Google this week made it easier for Android users to enable strong 2-factor authentication (2FA) when logging into Google’s various services. The company announced that all phones running Android 7.0 and higher can now be used as Security Keys, an additional authentication layer that helps thwart phishing sites and password theft. Continue reading Android 7.0+ Phones Can Now Double as Google Security Keys
My Google Titan security key has both USB and NFC interfaces, and I’m able to use it via NFC on my Android phone. However, my laptop also has an NFC reader, and it doesn’t seem to work out of the box. The laptop makes NFC noi… Continue reading Is there any way to use my Titan security key via NFC on my laptop, instead of USB? [migrated]
FIDO keys, used for 2 factor authentication are based on a challenge-response mechanism.
Besides generating a common 1-time-key using diffie-hellman, or transferring all data over TLS, how can they prevent reflection attacks… Continue reading How do FIDO keys prevent MITM reflection attacks?
Are there any commercially available U2F keys that support both USB-C and NFC?
So far I’ve looked at Yubico which seems to have a USB-C model that doesn’t have NFC support or a USB-A model that does support NFC.
I’ve also f… Continue reading USB-C and NFC U2F Keys
U2F is touted as a new 2 factor authentication standard that has built in defense against phishing attacks. As I understand it, this works by registering the device with each service, thereby creating a unique keypair. If a p… Continue reading Does U2F prevent phishing of passwords?
A FIDO U2F Device relies on public/private keys. Do they expire like in regular x509 certificates ?
Following the recent post at ZDNet on Google Titan devices designed and manufactured by a Chinese vendor and potentially prone to built-in backdoors: is it even theoretically possible to inject a backdoor on a U2F device, giv… Continue reading U2F devices: backdoors possible?
I’ve been messing around with my Google Titan Key and learned that each authentication challenge returns a counter for how many times the key has been accessed.
The only way I can think that this works is that there’s some s… Continue reading How much storage is on a Google Titan Key?