Collaborate Disseminate
Twitter has given millions of users a way of making their accounts even harder to hack, with the introduction of support for physical keys.
Read more in my article on the Hot for Security blog.
Continue reading Twitter gets physical – with support for hardware security keys
Is there any browser that supports Fido U2F over CCID for smart cards? As far as I can see Firefox and Chrome only support U2F over HID, and only Chrome for Android (with Google Authenticator2) supports U2F over NFC.
Why is no desktop bro… Continue reading Desktop browser that supports Fido U2F over CCID
The Pixelbook’s power button is a 2FA token, which is great, and almost nobody noticed, which isn’t. Continue reading The Google Pixelbook power button is now a 2FA token
As all of the FIDO Alliance documents state, the FIDO U2F protocols should never be able to abused to identify whether a user has multiple accounts with one service, or for services to collude and find out a specific user’s i… Continue reading U2F FIDO sends identifiable serial numbers
I’m trying to understand what the different configuration elements mean in Mozilla Firefox. There was an announcement recently from Dropbox that they had enabled support for WebAuthn. I tried logging in-to DropBox using my U2… Continue reading Webauthn configuration differences in Firefox
I’m trying to improve my password management, and I have a vision in mind for a solution. However, I’m having a problem putting it all together or finding a product(s) that fits.
First I would like to find out if my overall specification/s… Continue reading Hardware-Based Password Manager [closed]
I’m looking at 2FA options for my Google account, and I noticed they now allow you to add a security key to your account. I’m a bit of a novice to infosec, but I’m struggling to see the benefit for me. My phone already covers… Continue reading Is there a benefit to setting up a security key on an account that already has phone-based 2FA?
Looking for a ultra tiny development board? Tomu is an ARM Cortex M0+ device that fits inside your USB port. We’ve seen these in person, and they’re tiny.
There’s a few commercial devices in this form factor on the market. For example, the Yubikey Nano emulates a keyboard to provide codes for two-factor authentication. The Yubikey’s tiny hardware does this job well, but the closed-source device isn’t something you can modify.
Tomu is a new device for your USB port. It sports a Silicon Labs EFM32 microcontroller, two buttons, and two LEDs. This particular microcontroller is well suited to …read more
Using a U2F USB authentication key to login to services such as Google seems a good idea. However, these services often allow you to register a backup two-factor-authentication (2FA) method, which you can use in the event tha… Continue reading Possible to use *only* U2F authentication?
To respect the 2FA philosophy, after a 1st factor of authentication (login/password), we need to request a 2nd factor of authentication.
But for a mobile app, I suppose we can’t use SMS OTP, email OTP or TOTP (with another m… Continue reading What 2nd factor accepted on a mobile app?