Allowing YubiKey 2FA for Sythe.org

I believe allowing YubiKey's for 2FA for Sythe.org would be a considerable security improvement. I think this would be a wise choice. Does anyone else agree?

 

Why would it be a considerable security improvement? People like me who have no knowledge on this stuff could use some input on why it's better than other 2FA options.

 

It's a layer of protection that cannot be accessed without the YubiKey, it's your standard encryption key. In order to log into your account you would plug in your Yubi-key and touch it, allowing you access to Sythe.

 

I never heard someone that got their 2FA ''Hacked'' or problem, I don't think it necessary.

 

This is a layer of protection, past 2FA.

 

This.

And over-engineering is never a good idea

 

OP, are you suggesting it be as option that stacks onto the current 2FA or that it be an alternative?

 

An alternative.

 

I'm not sure of how sites go about integrating with YubiKey, but I saw this product a while back and it looks like a good method for hardware authentication.

It looks like a custom method would have to be made for vBulletin:
Yubico Developers

 

If this is the case I doubt it happens. As far as I'm aware we've never had any issues with existing 2fa either, so I'm not sure why we would need additional authentication.

 

The forum migrated from vBulletin to XenForo almost 5 years ago. I wouldn't be surprised if there's a plugin available for XF2, but that upgrade is yet to be completed.

 

No support, just the regular 2FA works fine.

 

Yeah I thought he said Xen in his post, not VB. Either way, I don't think this is necessary.

 

No support. Don't personally see the need for it.

 

I understand the LOE to implement isn't large, and that having options is a good user experience, but I don't particularly enjoy the idea of trying to assist in YubiKey-related issues such as lost keys, software malfunction, or set up inquiries. The maintenance of having the option greatly outweighs the benefit of implementation (which essentially is just the convenience of options, since existing 2FA support is more than sufficient).

I'm not an expert on the maintenance of 2FA features, so if people above my pay grade deem it worth implementing, I wouldn't be mad about it at all, but I don't see a reason to offer up my own support for the idea.

 

At the time I don’t think It’s necessary simply because the members who are dedicated to the forum have 2FA already so there isn’t a real worry about “hacked accounts”.

 

@Godshero0
Regular 2FA seems to be working just fine for now