4

I want to set up two factor authentication for some of my online accounts. I don't want to install an app, and I don't like using my phone as the physical medium anyway, because it's more likely to get stolen and it's also more vulnerable than a static object that I just carry around.

I'm attracted to the idea of Yubikey, but they're a little pricey and I don't see what they're charging for. I don't know exactly what is going on under the hood in 2FA, but I can't see any reason that you couldn't use any old USB (with the appropriate software around it).

So, my question is: can you use a USB flash drive to generate 2FA codes?

3
  • This won't answer your specific question, but you can probably use Authy for 2FA if you don't want to use a phone application. Authy probably can't be installed on a flash drive, but it can be installed on whatever machine you intend to use to access these services (including desktop computers). Now, Authy does require a phone number, but it can be any telephone and does not have to be a 'smart' device. This is just to verify additional installations for your account, allowing you to install Authy on multiple devices. Verification can be done via text or via voice, and if a device is stolen yo
    – anon
    Commented Oct 23, 2019 at 19:39
  • 4
    if you want a real hardware 2FA that is compatible with existing solutions, you need a key that supports U2F or FIDO2. List of products fidoalliance.org/certification/fido-certified-products If you want to use a software 2FA and store this software or key database on a removable storage you could use any OS-recognized USB stick, SD card, external SDD, etc.
    – LLub
    Commented Oct 23, 2019 at 19:57
  • 2
    A "drive" cannot "generate" anything. Drive stores things.
    – schroeder
    Commented Oct 28, 2019 at 17:26

4 Answers 4

3

This may or may not answer my question, but I did some digging after asking the question and I've got a solution that's working for me at the moment. I'll outline it below.

First of all, there is a useful command line tool called oathtool. You can use it to generate the 6 digit codes for 2fa using your 2fa key. The steps are outlined here.

So one solution that addresses my convenience complaint is that I could store my 2fa key in my password manager, and write a script to generate the 6 digit code from that.

However, this removes the "something you have" aspect of 2fa, which I would like to keep. To address this, I did the following:

  • Store the 2fa key in an encrypted file, and store that file on a flash drive.
  • When I plug in my flash drive, mount the folder containing the (possibly many) 2fa keys into a folder my password manager can see. I use pass, so this is very easy to do. At the moment I do this manually, but I may try to automate it.
  • The interface is something you can customise, but I wrote the following bash script, called 2fa:
pass 2fa/$1 | xargs -d '\n' oathtool -b --totp

The net consequence of this (with my naming system) is that I can write 2fa gitlab and get the 6-digit code at my terminal. I have another script that writes it to my clipboard, and prompts me with a list of names (the same interface as my password manager).

Of course, none of this works without the USB drive, which makes it a bona-fide "something you have" solution. However, it will only work if you can decrypt the gpg files, which requires my private key. I only use 2fa on a few trusted machines at the moment, so this is okay for me. If I needed it to be more versatile then I may reconsider using a phone or Yubikey.

I welcome criticism or ideas for improvement, especially if there are any obvious vulnerabilities to this system that I've missed.

6
  • 3
    The file could be copied off of your flash drive by malware or a person who briefly borrows your flash drive from you. 2FA security keys have the benefit that they aren't copyable by your computer (even if your computer is completely owned by malware and keylogged) and would be extremely difficult to copy with physical access.
    – Macil
    Commented Oct 28, 2019 at 20:21
  • @Macil the encrypting if the file with PGP does mitigate that problem. Not perfectly, but in a very significant way.
    – schroeder
    Commented Oct 28, 2019 at 20:40
  • If the file is copied, they need my key. If they have the file and the key, they still need my passphrase. If they have the file and key and passphrase and the original password to the account, they've earned it. Commented Oct 28, 2019 at 21:08
  • I don't think I have an argument against the "pure malware" side, though. If I'm keylogged, or if someone could intercept the input/output of my helper scripts, then I guess I'm caught. Commented Oct 28, 2019 at 21:20
  • Indeed, there is never a 100% perfect solution, it is not totally terrible, but has nothing on using something like a Yubikey for the key storage. At the end of the day, it is possible to break open a Yubikey and copy the keys off it.
    – ewanm89
    Commented Oct 29, 2019 at 13:09
0

One could store a database of the seeds on the a USB drive for some software to use to generate the 2FA codes. This however is not recommended, I suppose one could like a password manager encrypt it under a master passkey/phrase but still, it is a rather limiting solution.

As pointed out in the comments, if using FIDO based 2FA there are other products available (fidoalliance.org/certification/fido-certified-products), if one wants to use HTOP/TTOP (Google Authenticator codes) then something like a Yubikey is an excellent choice, it's not perfect either though.

2
  • Your first paragraph sounds like more or less what I have actually done. My 2FA keys are encrypted on my flash drive, and the folder containing them is mounted in a directory that my password manager can see. They're all unlocked by the passphrase I use for all my passwords on this computer. I can see a limitation that this implies I can only use this key on "trusted machines" (i.e. ones with the private key I set up in advance). But I'm okay with that, I think - are there any other disadvantages? Commented Oct 28, 2019 at 17:36
  • Yes, and there are plenty of comments as to why it is not recommended here, it is better than nothing though. It is a problem if someone does get hold of the drive and make a copy... this could be done in seconds, and surreptitiously. That said, as with anything, one has to do their own risk analysis. Should also be noted, that any attacker having access to computer while it is plugged in could transfer that data across a network.
    – ewanm89
    Commented Oct 30, 2019 at 19:59
0

One key property of hard tokens is resistance to undetected theft of the secrets.

It should be very difficult for me to steal your physical token temporarily (while you're not looking or asleep, etc.), duplicate its secret contents, silently return it ... and then use the secrets without your knowledge for an indefinite period of time (thereby destroying the token's value as a second factor).

Devices like the YubiKey, RSA tokens, etc. are designed to make it difficult to copy their secret material non-destructively. For an attacker to use them, they have to either be stolen, or visibly damaged. The user can detect either compromise quickly, deauthorize the old token, and get a new one.

A security key on an ordinary USB key could be silently copied.

-3

No. You can't. The 2nd factor in your 2FA is either a possession or biometry. You can not do biometry with a USB flash drive. A possession factor is based on cryptographic key material. You can not safely store cryptographic keys on a USB flash drive.

4
  • This really doesn't make sense, and I figure you've just phrased things poorly. You can do fingerprint scanners on USB drives. And you can store keys on a USB drive, safely or not. So, to say "you can't" based on those statements is not correct.
    – schroeder
    Commented Oct 28, 2019 at 17:29
  • 1
    I haven't written this up, but I've settled on something that seems to work the way I want. My flash drive contains a gpg-encrypted file which contains my private key for 2FA. This is then mounted on my computer, and I use a programme called oathtool to generate the 2FA key. (by the way, I'm not the downvoter) Commented Oct 28, 2019 at 17:29
  • @preferred_anon nice writeup. However, you should be aware of, that as others pointed out your usb flash drive can be easily copied. And you do not know if anyone copied it. Then the attacker has all the time he wants to brute force your encrypted container. Then he can use TOTP with no other component (only the time, which is omnipresent) to calculate the OTP values. He can impersonate the 2nd factor without you knowing. - OK, there are a lot of "if"s, but you might want to keep this in mind!
    – cornelinux
    Commented Oct 28, 2019 at 21:30
  • @preferred_anon Again - "if they have my usb flash". They do not need to "have". They only have to be able to copy it for a few seconds. While you are on the toilet, under the shower or at the airport passing the scanner ;-)
    – cornelinux
    Commented Oct 28, 2019 at 21:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .