U2F

Securing online accounts is at the same time extremely important and notoriously difficult. Two-factor authentication does greatly increase security and we have recommended TOTP as a good solution. A new entrant in this field is Universal 2nd Factor ( U2F ), a solution based on public key cryptography and inexpensive USB hardware tokens. While developed at Google, it has now become a standard managed by the FIDO Alliance. We do like the promise of better protection against phishing and man-in-the-middle attacks, but are concerned because the standard currently references a specific elliptic curve digital signature algorithm that is considered to be flawed.