The guide suggests adding Google Authenticator as a backup. Doesn't that mean this isn't any more secure than just using Authenticator? Why can't a crook say they don't have the key, and proceed to hack Authenticator?
Because that would require them to have physical access to your unlocked mobile device. It's equivalent to saying "why can't a crook just steal your security key".
The threat model this setup is protecting against is phishing. For that purpose, a security key is much better than TOTP (authenticator app).
That doesn't make any sense to me. If they require physical access to my unlocked phone, then isn't the phone just as secure as the yubikey? If so, why bother with the yubikey?
If the phone has other attack vectors, such as compromising the OS, and is indeed less secure than the yubikey, then doesn't having it as a backup just lower the bar for security to the phone? As far as I can tell, there's nothing stopping from someone just ignoring the yubikey if authenticator is also an option.
U2F security keys are a mutual authentication mechanism. The key authenticates the site as the site authenticates the key. Phone TOTP applications can't do that.
That still doesn't answer my question. If you read the guide that I am asking about, it advocates using security keys and also setting up phone TOTP as a backup.
But I also don't need to know too badly, so I think I'll just move on.
The subtlety is in how phishing attacks work. If you initiate a login yourself, unbidden by any outside request, the likelihood of you being phished in that scenario is epsilon. In that situation, the TOTP authenticator on your phone is fine. However, if you're logging in as a middle step in a series of steps to get something done (say, answering a request you received via Slack or an email), the likelihood that you could be being phished grows. In those scenarios, the mutual authentication done by the security key helps protect you.
The security key is slightly easier to use than the TOTP authenticator and it's what you'll tend to use most of the time. But if you happen to forget it at home or you're logging in to check your mail and your security key is halfway across the house but you have your phone handy or something like that, the TOTP backup option is convenient. You also need some kind of backup in case you lose the security key.
I agree with Maciej here: the stock message board "I'm too smart to leave any advice unchallenged" attitudes on these threads are doing a lot of people who face serious risks a lot of harm.
If you know what you're talking about and have a serious concern about this kind of advice, by all means present your argument. But if you don't, find another way to learn.
You make this point frequently, but it really seems out of place here on HN where you have near 100% technically competent users who aren't going to get phished, at least not in any way that a security key is going to protect against. (Thinking of the recent Google Docs incident.)
Security keys are great for journalists, activists, and high profile business people, but for your average geek it's an unnecessary amount of trouble, IMO. TOTP gets the job done.
The whole reason U2F exists is because technically savvy users were getting phished. Sophisticated phishing campaigns are basically indistinguishable from legitimate pages; targeted phishing campaigns will take advantage of the normal rhythms of your work and the identity of your coworkers. The fact that you're certain you're too competent to be phished probably makes you more vulnerable, not less.
