GitHub supports Universal 2nd Factor authentication

https://github.com/blog/2071-github-supports-universal-2nd-factor-authentication

by mastahyeti • 11 years ago

128 79 11 years ago

dankohn12• 11 years ago

This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work.

Is a separate USB key meaningfully more secure?

jasoncartwright• 11 years ago

I've used a YubiKey for 2FA for a year or so now. It just sits in my USB port and it feels too convenient - steal my laptop and you get my key. At least my phone has a PIN.

fak3r• 11 years ago

Mine is on my keychain, plus you need my username, password and yubikey to authenticate, so if someone steals my laptop (oh noes!) they still have hurdles to jump.

sandstrom• 11 years ago

I think the (relatively) small overlap between knowing your password and stealing your computer is important here.

Passwords are weak vs. many types of hacks, U2F is strong. And vice-versa (easy to steal the Yubi-key + computer, but they still need the password).

tetraodonpuffer• 11 years ago

I use it for my email, and have set it up with yubikey + password, given that you need both it's not like you can brute-force the login anyways

aiiane• 11 years ago

U2F is protection against someone phishing/stealing your credentials online. Your password is your protection against someone stealing your laptop. The likelihood that a person who steals your laptop also managed to phish/steal your credentials is minute.

efm• 11 years ago

Github will support a token generating app on your phone: https://help.github.com/articles/providing-your-2fa-authenti...

scrollaway• 11 years ago

It already does. Been using 2fa for a year or so.

dudus• 11 years ago

This is actually more convenient sometimes. I already have one of these FOBs permanently attached to my computer. It's a tiny pieces that fit into usb and only protrudes a couple of milimiters. Since I have this always connected all I have to do is touch it and I'm in. Takes me less than once second while taking my phone, opening the app and typing the code by hand takes 10-20 seconds.

The downside is that it takes a USB port, which is one of the reasons I hated this years MacBook so much.

UPDATE: I found the exact model I have on Amazon

http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7...

treve• 11 years ago

Dumb question... what does the yubikey then do that a normal computer can't do? If you keep it plugged in, what security benefit does it have over storing (strong) passwords?

WorldMaker• 11 years ago

From another angle they are more convenient:

Most of the USB keys are in a form factor that fits well on an existing key ring. If you are like most people, you presumably also already have a pile of keys connected to a key ring on you at all times.

You don't have to unlock your phone device and launch the appropriate app, you just need to plug into an open USB slot on the machine you are using.

calebegg• 11 years ago

OTP based 2FA is susceptible to phishing and MITM attacks. U2F is phish-proof and makes MITM more difficult.

For computers you frequently use, you can get multiple keys and leave them in the port (Yubico makes a small one that stays in the port and only sticks out enough for you to be able to touch it, but it's a bit pricey).

bhuga2• 11 years ago

Yubikey has a "always available" form factor if you're already bringing your laptop to work in the neo-n: http://www.amazon.com/Yubico-Y-110-YubiKey-NEO-n/dp/B00O8ST7.... It just lives in your USB port.

The user experience is also better with U2F than previous 2FA systems. When GitHub prompts you for U2F, you press the yubikey and are instantly logged in. No typing random numbers with n seconds, no fake keyboard.

YMMV of course, but if you've tried U2F, it feels incredibly slick.

dankohn12• 11 years ago

I think the issue is that I have a laptop at home and iMac at work so I don't bring my computer on my commute. Also, I like the extra security of the fingerprint scanner on my iPhone.

piemonkey• 11 years ago

One thing to consider is the possibility of your phone itself being compromised (stagefright et al.). Note how Duo issued a security advisory to limit access for Android devices [1].

A fully isolated component like a Yubikey has a smaller attack surface area for these kinds of things (easier to audit smaller code, no sustained Internet or cellular connectivity).

[1]https://www.duosecurity.com/blog/understanding-your-exposure...

mongol4• 11 years ago

For me that key is the emergency key. I have it on my keychain. I use Google Authenticator normally. I don't yet have U2F key always inserted the computer in my home but I think it would be convenient. I have a regular Yubikey inserted in the USB slot in my monitor to unlock Password Safe with a 25 char password. I don't think I would like it permanently inserted on a device I carry outside of my home.

zobzu3• 11 years ago

Some phones actually provide U2F. I think the SGS6 does. The secret in stored in the harware backed credentials storage.

mikecb• 11 years ago

A pin can be phished, a U2F handshake cannot.

chedabob• 11 years ago

I can't think of a single compelling reason to use this over Google Authenticator.

sowbug• 11 years ago

It's faster. No typing. No worry about malware stealing your OTP secret. It's easy to revoke a single device if you lose it without having to change your Authenticator secrets everywhere. And it looks cool.

minisu• 11 years ago

Also, phishing and Man-in-the-Middle protection.

gbraad• 11 years ago

"Note: FIDO U2F authentication is currently only available for the Chrome browser." https://help.github.com/articles/providing-your-2fa-authenti...

JamesBaxter• 11 years ago

Here's the issue for the feature in Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=1065729

zobzu3• 11 years ago

Yeah this stuff won't be "universal" until at least all browsers support it... which would be GREAT

_kst_2• 11 years ago

The "Special Offer for GitHub Users!" link is giving me a 504 error (took too long to complete).

https://www.yubico.com/github-special-offer/

j_s2• 11 years ago

If you want to try for one of the 5,000 $5 Yubikey with everyone else currently killing the server...

1) sign in with github at: https://www.yubico.com/github-special-offer/

2) buy now: https://www.yubico.com/github-special-offer/github-yubikey-s...

3) checkout: https://www.yubico.com/checkout/

Once you complete one step successfully you should be able to skip to the next. Good luck vs. the 504's!

striking• 11 years ago

Thank you very much, the individual links are great.

lfowles3• 11 years ago

EDIT: Disregard, they're still available. Discount is applied to the subtotal, not individual items.

Original Post: Looks like the $5 keys are sold out, my cart shows $36

j_s2• 11 years ago

A discount is applied at checkout.

gkoz• 11 years ago

The only international shipping option I can see is DHL Express for $65.00 :(

Symbiote• 11 years ago

There are competitors producing U2F keys, I see one for £4.99 / €5.99 on Amazon.(co.uk|de|fr).

_kst_2• 11 years ago

The second link is now giving me "yubico site under maintenance". Same for https://yubico.com/

larssorenson• 11 years ago

I got 'down briefly for scheduled maintenance, please check back in a minute.'

Scheduled? Yeah right.

philip1209• 11 years ago

I like this because I keep a U2F Neo-n device permanently in my laptop USB port. It's just more convenient for services that support it. In the future, I would like to require it for employees on our app.

However, when I go into Github to turn it on (in chrome using U2F devices I have already used with Google) it says "This device cannot be registered." Even when I remove the device it says that. I'm disappointed that the feature is not working.

co0nsta2• 11 years ago

I had this problem too, and it turned out my system wasn't configured correctly. I had to download https://github.com/Yubico/libu2f-host/blob/master/70-u2f.rul... to /etc/udev/rules.d and then udevadm control --reload-rules . Worked fine after that. HTH.

co0nsta2• 11 years ago

Gah, just noticed you are using a different brand of device. Anyway, if you're on Linux, poking around the USB stack might point to a solution. It did for me.

dheera5• 11 years ago

I never understood the point of 2-factor authentication, and moreover, certain agencies (e.g. banks) that force using it. Can't we just pick good enough passwords?

Personally I hate being {attached to|associated with|being required to carry} a particular piece of hardware; I much prefer that information freely flows with me as I move between the various devices I interact with over the course of a day.

There are many times I don't carry my phone around with me or do not wish to, simply because I have a terminal that loads my personalized environment everywhere I go. Information flows with me, not hardware.

jcoene• 11 years ago

You're expressing a preference for convenience over security. The truth is that most people pick bad passwords, and even good passwords can be cracked.

2FA with a physical component is generally the best way to achieve the goal of "information flows with me". With a password only, you can more aptly describe the situation as "information flows with anyone who knows my password".

dheera5• 11 years ago

In that case, can we do 2FA with something biometric? Or even 2 passwords?

A physical component has a lot of issues:

* It can be stolen or robbed at gunpoint. Torture, drugging, and hypnosis aside, your mind is much more secure.

* It can run out of batteries.

* It's one more thing you can lose. It's already annoying enough to have to remember to carry 7 or 8 things every day, including a phone, bike light, smart watch, tablet, battery pack, reusable utensils, and so on. I don't want to have to add more things to this list.

* It can be damaged by the elements.

* It can be difficult to give access to others who you want to give access to.

* It may have security holes of its own, both in hardware and in software.

* When damaged or robbed, the user is highly inconvenienced, to the point that they are unable to access their own money/accounts/etc. How do get food, water, and get home from the middle of nowhere after your wallet and phone have been taken from your person? With password-only methods, you could theoretically find a nearby public terminal, log in with a simple username and password, and get an ride/call a friend/file a report/do whatever you need to do.

* If it relies on cellular service, it may not work internationally if the user changes SIM cards or devices. For many that live near border towns and cross borders every day for work, this becomes a massive inconvenience.

lfowles3• 11 years ago

The point is that without it, information just as freely flows to someone with your password across the world. Getting USB sticks like this is a win for me, I hate using my phone for 2FA as well, but something I can just toss on my key ring? Hardly a burden.

dheera5• 11 years ago

What if the thing you're trying to access from doesn't have a USB port? Like, an intelligent table surface, a digital wall, a smart goggle device, or even an tablet that only has a micro-USB port?

Information flow protocols and hardware should be abstracted and separated in the same way that we generally separate church and state in most modern nations. Otherwise, the innovation of either is going to be pulled behind by the other.

reitanqild• 11 years ago

  > I never understood the point of 
  2-factor authentication

Ouch. People choosing bad passwords has been mentioned already but the real reason is because it protects against a broad range of MITM attacks as well as some sorts of phishing attacks.

alexruf• 11 years ago

Good to see that. Hope more services will support it also soon.

IgorPartola• 11 years ago

This is fun:

  Notice: load_plugin_textdomain was called with an argument that is deprecated since version 2.7 with no alternative available. in /nas/wp/www/cluster-50027/yubico2/wp-includes/functions.php on line 3510
  Notice: Use of undefined constant WOOCOMMERCE_VERSION - assumed 'WOOCOMMERCE_VERSION' in /nas/wp/www/cluster-50027/yubico2/wp-content/plugins/woocommerce-wootax/woocommerce-wootax.php on line 552
  Fatal error: Class 'WC_Payment_Gateway' not found in /nas/wp/www/cluster-50027/yubico2/wp-content/plugins/yubico-payment/yubico-payment.php on line 16

Animats• 11 years ago

How do you know the YubiKey isn't going to attack your machine through the USB port?

tokenizerrr4• 11 years ago

How do you know your mouse or keyboard isn't going to attack your machine through the USB port?

mike-cardwell• 11 years ago

Sod the Yubikey. Get a Pebble Time watch and install the QuickAuth app. One press of a button on my watch and I get a list of two factor auth codes for my various services, now including Github. Doesn't require plugging anything into my laptop. Doesn't require my phone to be near me or on. Doesn't require Internet access.

microtonal• 11 years ago

TOTP is vulnerable to phishing and MITM attacks. U2F (assuming that you are not MITMed when registering the device) is not.

DaveWalk• 11 years ago

When will Amazon get U2F/2FA? I have heard it's good for AWS but what about for us plebs who just buy stuff?

mongol4• 11 years ago

Although I think Yubikey is great, I use Plug-Up key to test U2F. http://sk.happlink.com/plugup/en/

It was cheaper but is more fragile, worked well to test it out.

Now when U2F is getting more support, I think I will buy a Yubikey with U2F.

jnpatel• 11 years ago

It's always exciting to see the list of services supporting U2F for 2FA grow. It now includes Google, Dropbox, and GitHub.

zobzu3• 11 years ago

Duo also supports it.

drdaeman2• 11 years ago

Uh. U2F feels incredibly limited compared to PKCS#11 I really wonder why it was chosen (and somewhat disappointed by the choice.)

With a smartcard that can hold an key pair, one can both authenticate (sign) and encrypt messages, using a same single key (or multiple keys if wish for multiple identities). With U2F all one can is authenticate, using a distinct securely-stored PSK for each remote party.

superuser2• 11 years ago

The infrastructure around smartcards is designed for one enterprise to pay another enterprise millions of dollars to roll out Active Directory-based authentication for a Windows domain with hundreds of thousands of users, for a multinational corporation to roll out a payment card, etc.

A single hobbyist maintains an open-source tool that allows applets to be loaded on to GlobalPlatform-compliant cards. It's pretty fragile and requires some trickery and tribal knowledge. You have to hope some forum somwhere has the unlock key to allow applet loading on whatever card you bought. Another single hobbyist maintains a PKCS#11-compatible card applet, PKIApplet. It requires a relatively modern JavaCard version and compatible JavaCards are not always available for individual purchase in the U.S. If you're prepared to really get down and dirty with DIY trickery, you might manage to load PKIApplet onto a JavaCard with GlobalPlatformPro.

Actually using it requires OpenSC, not a shining example of usability or code quality. It requires specific drivers for different cards, each having slightly different personalization procedures. Many of the drivers in it are for cards that can no longer be purchased. PKIApplet appears to have a driver in OpenSC but I haven't gotten an opportunity to test it yet. Much of the tooling you'll find references to in documentation turns out to have expired domains and abandoned SourceForge projects last updated 2002.

The OpenPGP route appears to be a little less sad than the PKCS#11 route, since at least Yubikey maintains a modern OpenPGPApplet.

If your Fortune 100 company's CTO wants to play golf with Gemalto, smart cards are for you. Otherwise, probably not. It makes sense that a modern personal 2FA solution would want to be free of all that legacy.

drdaeman2• 11 years ago

Makes sense. Enterprise shit is, indeed, terrible. However, I didn't mean there is any reason to support every JavaCard out there and existing (enterprise) software - and I suppose this is where it all really starts to smell. On the other hand, they have designed a whole new standard, protocol and devices.

I've edited this for quite long time and finally figured out what I really had in my mind. I'm not disappointed it's a new standard or anything like this. I'm disappointed by the fact that this stuff isn't extensible and nothing new can be build upon this.

Not in a sense that no new software can be added to a token, but when you use U2F you just have a means to prove you know some PSK. And that's it. Would the token hold a keypair and use digital signatures instead, it could bring much more possibilities in the long run. Like sending encrypted emails to the token owners, or building a global identity system where identities are something user possesses, not leases from the "identity providers".

lovemetender2• 11 years ago

I would have used it if it used Google Authenticator.

danielsamuels• 11 years ago

You've been able to use Google Authenticator with Github for years.

lovemetender2• 11 years ago

I dug through 2 links and found it, thanks for letting me know:

https://help.github.com/articles/about-two-factor-authentica...

moreati2• 11 years ago

A few U2F details worth mentioning

Browser support is currently limited to Chrome, and possible Windows Edge*

For now it only works with USB. Bluetooth and NFC specs are out, browser support is the bottleneck

The protocol is public/private key based, with the private key strongly encouraged to be in tamper resistant/evident storage.

The protocol is authentication method agnostic. It doesn't care if you use a USB key, a retinal scan, a pin or divination.

You could write a software only authenticator if you wanted, but servers could detect that (and reject it if they chose to) through the attestation certificate you provided. You can't pretend to be a brand X authenticator, because only company X will have the private key(s) matching the attestation certs to sign (batches) of model X authenticator.

Yubikeys are just one implementation of a U2F authenticator. In theory GitHub now works with any present/future authenticators that talks U2F (modulo browser support) e.g. an iPhone+TouchID+NokNok SDK, a Pebble watch+app, an Android Phone+$your_app, an NFC implant, m-of-n wearables

* Microsoft announced something U2F related for Windows 10, I never got to the bottom of what exactly

For more detail I did a talk at EuroPython this year https://moreati.github.io/passwordspain/#/ https://www.youtube.com/watch?v=YSTsgldazSU

Rafert2• 11 years ago

Thanks for the link to your presentation. I'm currently implementing this in a Rails app and had a bit of a hard time to grok U2F with only the info from Fido site. Your talk will make it easier for my colleagues to understand U2F :)

moreati2• 11 years ago

Have you seen https://github.com/castle/ruby-u2f? As linked from https://developers.yubico.com/U2F/Libraries/List_of_librarie...

nikolay2• 11 years ago

You can still order:

1. Go to https://www.yubico.com/github-special-offer/

2. Add the special edition security key to cart

3. Apply the "GITHUB" coupon

4. Check out

Once you get it, don't forget to also use it with Dropbox and Google, which both predate GitHub in the U2F support. If you know any other provider, comment below, please!

superchink• 11 years ago

Can confirm that this worked! This should be the top post.

Thanks for the tip.

nikolay2• 11 years ago

For more sites that support U2F (or how to bug them to add support): https://news.ycombinator.com/item?id=10315888

imrehg• 11 years ago

Looks in the meantime it was overwhelmed, only 1 hour since your post.

We are experiencing difficulties and the GitHub Special Offer is temporarily unavailable. We are working hard to fix the issue and appreciate your understanding.
Keep an eye on Twitter (@yubico) for updates on when we will have the GitHub Special Offer available again.

buffoon• 11 years ago

Just a warning with the yubikeys. I had to use a solution that had these for a few months. The USB port of my laptop (2011 MBP) was pretty much worn out due the physical insertion and removal - other stuff would just fall out. Eventually this port blew entirely stopped working.

This is not specific to the MBP as a colleague's ThinkPad had the same problem.

GitHub supports Universal 2nd Factor authentication

Related Stories