Anyone using Yubikey for 2FA?

[billymach4]

SMS is getting tired and old. Hackers have been intercepting sms texts via sim card hijacking.

How SIM Card Hijacking Works - Cipher

Your cell phone is the key to two-factor authentication in many instances. This fact has led hackers to focus on taking over phones in order gain access.

cipher.com

 

[youppi]

I never used a Yubikey.
I use Google Authenticator (work) and Microsoft Authenticator (personal) applications since 2 years when I stopped using SMS as 2FA because of the SIM card hijacking possibility.

 

[SmithOp]

Another vote for Google authenticator, its used by my retirement system, wish I could switch banking to use it.


Sent from my iPad using Tapatalk Pro

 

[dioxide45]

Do these other 2FA systems require the website or company to support them in order to work? SMS seems to be more universally accepted.

 

[Ken555]

Do these other 2FA systems require the website or company to support them in order to work? SMS seems to be more universally accepted.

Sites which accept use of an authenticator are typically agnostic in regards to which software you use. Google, Microsoft, Authy, Duo, etc… I started using Duo many years ago on my servers for direct approvals so use it daily, but I also have the others. I find software solutions like these much more convenient than any hardware based solution like Yubikey.

SMS is the default because it’s difficult to require a MFA app.


Sent from my iPad using Tapatalk

 

[jabberwocky]

I have a Yubikey but only use it for limited applications. It's not as widely accepted. I'm using Microsoft Authenticator mainly now with Google being a close second.

The other disadvantage that SMS has for 2FA is that it isn't always available when traveling in another country whereas authentication apps or Yubikey can run anywhere you have an internet connection.

 

[Ken555]

The other disadvantage that SMS has for 2FA is that it isn't always available when traveling in another country whereas authentication apps or Yubikey can run anywhere you have an internet connection.

FYI, I use my business VoIP or Google Voice phone numbers for many sites because of this issue. With either, I get an alert on their app and an email with the text verification. Works great.

 

[billymach4]

Do these other 2FA systems require the website or company to support them in order to work? SMS seems to be more universally accepted.

Where possible and applicable I am converting to Yubikey . SMS is flawed in that hackers can hijack the SIM card. Yubikey once set up is actually very seamless and and faster than fumbling around and waiting for SMS texts and the ever growing demand for Google Authencator and Authy requests.

Although I don't think I can ever get totally off of SMS, or software authentication.

 

[billymach4]

Order of strength

Good sms
Better software Authentication
Best hardware Security Key

 

[billymach4]

Do these other 2FA systems require the website or company to support them in order to work? SMS seems to be more universally accepted.

Yes the site has to be compatible with a hardware security key such as Yubikey.

Google
FACEBOOK
YAHOO

Have the functionality.

 

[youppi]

Do these other 2FA systems require the website or company to support them in order to work? SMS seems to be more universally accepted.

You can check this website https://2fa.directory/ to see which websites support SMS, email, HW token (yubikey, ...), SW token (authenticators apps) as 2FA.
Many websites don't support SMS as 2FA like the majority of VPN providers.

I don't know if TUG supports SMS as 2FA but I know it supports SW authenticator apps because I use Microsoft Authenticator as 2FA for my TUG account.