I think hardware 2FA is great in a corporate environment where there is an administrator that can enable/disable accounts and issue a new HW key if required.
For personal accounts though, I somehow feel uneasy about reliance on a small piece(s) of HW. Having a great password manager, lots of 2FA (with TOTP, where I own and back-up the secrets) and have all of that secured with a cloud backup with a super strong password that I don't know or have to write down, but can recreate if need be (e.g. an MD-5 hash of a specific segment of a public text).
Too much? Anyone else has the same concerns or am I missing something?
I also don't like the idea of many sites/services trying to roll their own 2FA and introducing custom phone apps. I frankly do not trust most vendors to design nor write secure software. I want an interoperable standard so I can choose a trusted authenticator and enroll it with as many different services as I need. I want to use such sites with my desktop/laptop browser and like the idea of 2FA login or transaction approvals to limit the chances of unauthorized use.
I don't mind using the phone as a 2FA token, but I want to have extra tokens as backup in case the phone is lost or damaged. The yubikey seemed attractive in that way, but support is not as good nor widespread as I would need.
I discovered absurd things like a bank allowing multiple tokens to be enrolled, but automatically expiring them if I don't use them frequently. This blocks the idea of enrolling a backup token to store safely offline.
I also want to disable any SMS/phone call/email mechanism to do account recovery by sending secrets through an insecure channel. Otherwise, the 2FA tokens are mostly useless security theater. But, for most things I would care about personally, this is not offered even if you enroll multiple tokens.
Most people already have a small piece of hardware called a phone that can be applied to the same effect.
Free/open source TOTP apps are readily available for both iOS and Android. This isn't rocket science, it's a simple SHA hash that either works or it doesn't.
What if you lose your phone? Remember --- this is 2FA so you need more than my phone to access my accounts. My TOTP app is password protected and I have a backup of the keys so I can easily transfer to another phone or use a desktop app to access my accounts.
What happens if you lose your hardware key? Perfect security does not exist.
It's not so much asking for 'perfect' security - I agree, that doesn't exist.
But do HW security tokens create a probability of a hard lock-out that outweighs the security/convenience they provide.
If you lose your key, you're locked out --- simple as that.
About the only reasonable way to create a backup is by buying/using/registering multiple keys. But at $40+ each, the cost adds up quickly.
It is hard to beat your phone for overall convenience. My phone is always with me and with my TOTP keys backed up to secure on-line storage, I can easily restore these to another device if/when needed and continue with only a minor hesitation. For most people, this is the most convenient/least expensive/best all around solution IMO.
(One is on their keychain with an AirTag, one is stored securely in their home. One is stored offsite.)
Every site I’ve registered them with has allowed me to register all three keys. Nobody has lost a key yet (thanks AirTag) but it wouldn’t be a huge ordeal if they did. Just delete that key from their services and use a backup.
Speaking personally, I feel like my primary concerns are:
- ease of use (if something is a pain in the ass, I've found I won't use it in practice, in spite of what I know is in my best interest)
- credential stuffing/data breaches
- phishing
- getting locked out of my accounts due to losing my credentials
In particular, I think that, although a password manager plus any sort of 2FA mitigates credential stuffing concerns pretty well, HW 2FA is probably more effective against phishing compared to a TOTP app or email 2FA[1]. Purchasing a single backup key that I have a trusted family member hold on to, plus printing out recovery codes and storing them in the same place I keep other important personal documents (passport, birth certificate), is for me is a pretty reasonable hedge against lost credentials[2]. I also personally find HW 2FA to be much more convenient than TOTP authenticator apps in general[3]. Thus, I use a hardware 2FA token (at least for "important" accounts) and sleep pretty soundly at night, but that's very much the result of my own specific concerns, preferences, and priorities.
[1] A hardware key is able to validate the domain directly and mainly relies on the browser not fucking up[1a], whereas SMS/email/TOTP tokens require the user to evaluate the authenticity of the form they're filling out. Obviously there's some subtlety here, since a PW manager browser extension can also do domain validation, but at the end of the day, I think there's some non-trivial benefit to using a HW token.
[1a] Chrome's WebUSB API is an interesting case study here.
[2] I actually lost my primary HW token earlier this year, and so got the opportunity to test out my recovery plan. Having done so, I'd recommend anyone who depends on HW tokens to go through a similar exercise (preferably simulated, rather than "for real"), if nothing else than to get some very satisfying peace of mind.
[3] I suspect this is not a universally held opinion.
I dislike any form of 2FA with my phone involved. Low battery, low privacy, phones just generally suck if they are involved in security. I would even prefer the old SMS while being staunchly aware that and code will be send in free text.
Still better than some shitty random app from the shitty app store.
I would be careful about a hash of a public text. I certainly would at least XOR it with secret value, even if its appearance in rainbow tables is very unlikely.
What are the chances?
If you do have secrets that are valuable enough to justify the effort; have you really put in the effort to secure them? Or have you got multifactor authentication and fancy encryption happening on a system that's physically available to anybody from the janitorial services company all night? The equivalent of a big impressive vault door standing alone without walls around it.
