<story><title>Support for U2F security keys</title><url>https://blog.1password.com/introducing-support-for-u2f-security-keys/</url></story><parent_chain><item><author>tpetry</author><text>Autofill of a password manager is a working countermeasure against phishing too: If autofill does not work there is something wrong and you should look closer...</text></item><item><author>tptacek</author><text>The primary purpose of U2F&amp;#x2F;WebAuthn is to break phishing attacks. Code-based TOTP 2FA, the kind you&amp;#x27;re probably using now, is already adequate to the task of making sure you&amp;#x27;re not credential-stuffed.</text></item><item><author>josefresco</author><text>Got a free YubiKey from Wired.  Then I read that mobile is a pain, and that I really need two ... it&amp;#x27;s sat in my bag now for months, unused. I already use 2FA, and it works good enough - I&amp;#x27;m not sold on how this will make my life better, especially on mobile.</text></item></parent_chain><comment><author>ptoomey3</author><text>My experience with password managers is that they work great for me, because I understand every sharp edge and can work around them. My experience when advising family to use them is that they invariably fail them and they get frustrated. Password managers rely on pretty gross heuristics to work. They are effectively trying to automate something built for a human (choosing, remembering, and entering a password). WebAuthn gives us a real API built by and for machines. This will make the flow much less error-prone and more secure.</text></comment>
<story><title>Support for U2F security keys</title><url>https://blog.1password.com/introducing-support-for-u2f-security-keys/</url></story><parent_chain><item><author>tpetry</author><text>Autofill of a password manager is a working countermeasure against phishing too: If autofill does not work there is something wrong and you should look closer...</text></item><item><author>tptacek</author><text>The primary purpose of U2F&amp;#x2F;WebAuthn is to break phishing attacks. Code-based TOTP 2FA, the kind you&amp;#x27;re probably using now, is already adequate to the task of making sure you&amp;#x27;re not credential-stuffed.</text></item><item><author>josefresco</author><text>Got a free YubiKey from Wired.  Then I read that mobile is a pain, and that I really need two ... it&amp;#x27;s sat in my bag now for months, unused. I already use 2FA, and it works good enough - I&amp;#x27;m not sold on how this will make my life better, especially on mobile.</text></item></parent_chain><comment><author>tedunangst</author><text>Until the next exploit that can steal passwords from autofill...</text></comment>