Why would a U2F key be more secured than an OTP device?

Question

I have a Yubikey 5, I can store a PGP key inside, it has OTP abilities, FIDO, NFC, etc... Which is great for a device like this.

First of all, I understand how a smart card is more secured than an app/sms based OTP for instance, but seeing how the market is doing, I don’t get why it’s still considered more secured.

2FA means adding a second factor, which can be your mobile for SMS OTP, an OTP device (like RSA tokens), a USB key, and so on. Currently, almost all these solutions relies only on the fact that you own this object and nothing else (this is the case for Yubikeys and SMS OTPs), and app based OTPs now include an authentication to be launched, which makes it more secured. But without this authentication layer, a mobile is still less easy to lose than a tiny USB key. And why would a tiny USB key, advertised as being made to stay plugged in your computer forever makes it more secured at all?

I mean, if your laptop is stolen, and your thief happens to have your credentials, well, your smart card doesn’t authenticate you so it adds no security at all then, but so will be the app OTP as a thief could also have your pin code.

Anyway, seeing I find app based OTP more secured than key based today, which are more secured than portable always on tokens like RSA’s, not because of their design but because of how they’re used today. Am I right?

Answer 1

One of your main points is valid: if the USB key is stolen with your device, it may still be game over if other credentials are known. Personally, I am not concerned about loss or theft of the USB token, since it doesn't really weaken security if used as a second factor, plus access can be revoked and some features may require a PIN.

However, the USB token is superior to a phone in that it cannot be compromised remotely and have its secrets dumped. Also, FIDO2 provides a layer of protection against phishing attacks that OTP simply cannot provide.

Answer 2

As per me you are absolutely correct. The whole presumption of the usb based 2fa key is based on the fact that you own the key. There are however reasons from my point of view why usb based key is in vogue:-

1. These usb based keys are mostly used by or mostly meant for system administrators/devs/devops and the likes whose daily jobs include logging into various sytems, servers, cloud instances etc.

2. Keeping point 1 in mind imagine having to open your phone everytime you need to login to a server. That is why usb based key is used to provide the servers/systems that additional based security

3. Also now-a-days the keys are so small that they remain attached to your pc, laptop and no one takes it out of the slot, so losing it becomes a bit difficult.

Answer 3

Two-factor authentication usually means adding something you have, like a phone, laptop, or token, or something you are, like a biometric measurement, in addition to something you know, like a password.

The primary benefit of a security key like a U2F or FIDO2 device over a TOTP password is phishing protection. These devices, when used with a web browser, receive the true URL from the browser itself and include it as part of the material when generating the signature. Therefore, assuming the attacker cannot compromise the web browser or the legitimate web site, it's not possible for them to phish the digital signature made by these devices, since a signature entered for a phishing domain would not be valid for the original domain.

Security keys are also typically designed to be at least tamper resistant. That means that the keys can't be duplicated or compromised, and as a result, attackers really have to have the physical device to use them. It is, of course, possible to steal them, either as part of the laptop or otherwise. But it is also very easy to steal a phone someone has carelessly left unattended. The risk of theft is the same regardless. And in many cases, the security key can require a PIN for various purposes, providing some resistance against misuse in case of theft.

TOTP credentials do have the benefit that they can be backed up and easily transferred to a new device. That makes them less secure, but also more convenient. For this reason, I generally enroll both on my account, and primarily use my YubiKey, leaving the TOTP as a backup in case something goes wrong.