Collaborate Disseminate
I’ve been messing around with my Google Titan Key and learned that each authentication challenge returns a counter for how many times the key has been accessed.
The only way I can think that this works is that there’s some s… Continue reading How much storage is on a Google Titan Key?
According to the Google information page here: https://support.google.com/accounts/answer/6103523
If you don’t have another second step or forgot your password
Note:
2-Step Verification requires an extra step to p… Continue reading Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?
Hackers are taking over high-profile Instagram users’ accounts and holding them to ransom, revealed reports this week. Continue reading Hackers demand ransom from hijacked Instagram influencers
Google has now released their “Titan” keys to the general store (albeit via a waitlist). When they first announced their product, Yubico, their chief competitor, decried the use of Bluetooth:
Google’s offering includes a … Continue reading What could MitM’ed U2F do?
Is it possible for an infected endpoint to steal private keys from a FIDO U2F Hardware Token / Yubikey? What attacks exist against these hardware tokens? What mitigations are possible? For the scope of this question it’s limi… Continue reading Can an infected endpoint steal private keys from a FIDO U2F Hardware Token / Yubikey?
Bluetooth bug allows man-in-the-middle attacks on phones and laptops, serial killer electrocutes himself in jail cell sex act, Google launches its own USB-based FIDO U2F keys, and GhostPack. Full Show Notes Subscribe to YouTube Channel
The post Bluetoo… Continue reading Bluetooth Bug, Tenable, and Cosco – Paul’s Security Weekly #569
I’m trying to figure the best strategy for having a backup U2F token. Ideally, I want to have two identical tokens; obviously I’ll have the primary one easily accessible (say, on my keyring), but the second one I’d place some… Continue reading Why is the U2F secret key on yubikeys is not programmable, and how to get a universal backup token?
Phishing attackers have failed to compromise a single employee account at Google since the company mandated authentication using U2F hardware tokens in early 2017. That’s the remarkable claim made to security writer Brian Krebs. Continue reading Google hasn’t suffered an employee phishing compromise in over a year
Quoting from agl’s article from Mar 2018:
At the time of writing, all Security Keys are based version one of FIDO’s “Client To Authenticator Protocol” (CTAP1). […T]he core protocol [can be] transported over USB, NFC, an… Continue reading Smartphone app as a U2F hardware token via Bluetooth?
Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity. Continue reading Google: Security Keys Neutralized Employee Phishing