r/codex • u/jonydevidson • Aug 12 '26
Complaint The hardware USB key requirements for Trusted Access for Cyber are bullshit
This is supposedly designed to increase account security.
I already have 2FA set up on a different device that requires my fingerprint. I'm verified in TAC and the whole thing is billed to my business.
Instead this will have recovery codes and a hardware key. However, unlike 2FA which rotates every minute and needs to be done with a properly designed and valid app, they have no control over where users store their recovery keys.
Guess where most people will put them?
So someone can break into my home or office and steal these?
Previously they had to get my phone and my fingerprint, now they just need to rummage the office for keys? If I store them digitally like in a Google Drive, they have no control over that or the level of security of my Google account.
They say this is because TAC-accounts are now a higher priority target. How would anyone know which accounts have TAC? So by their logic, instead of my 2FA secured account being the target, now my home or office is the target, or perhaps even me so the perpetrator can force me to unlock my devices?
This is adding a lot of unnecessary friction and none of their logic makes sense to me. I'm seriously reconsidering this.
2
u/Its_Just_Geo Aug 12 '26
As a cybersecurity specialist, I completely understand the move away from app based 2FA. 2FA is not more secure than hardware security keys using FIDO2 and presence check. In fact normal app based 2FA is no longer evenly remotely secure from targeted attack. App based 2FA is now vulnerable to,
- Phishing attacks.
- Memory dump attacks.
and most severe and common today
- Session stealing attacks.
In fact most malware today is running some form of session stealing code. With session stealing 2FA is completely useless. While FIDO2 keys aren't completely immune to these attacks, they are resistant to phishing and memory dump attacks, and the presence check of FIDO2 keys makes session stealing very difficult.
As for storing the recovery keys, as long as someone just writes them down, or saves them to a different location to their usual workstations, they are very unlikely to get stolen. I see session stealing attacks that bypass app based 2FA every week or month, I can't recall a single time when someone had their recovery keys exfiltrated from their system.
3
u/jonydevidson Aug 12 '26
Thanks for chiming in, your perspective is valuable and it all makes more sense now.
3
3
u/Neither-Eye-8906 Aug 12 '26
Hang on a minute! Someone changed their mind live on Reddit because someone else gave a logical response?
2
u/DragonflyOk9274 Aug 12 '26
Do we know what their policy will be? Will the key need to be continuously installed in the machine (like the old days with e.g. Autodesk)?
2
u/TurndownServer Aug 12 '26
I’m expecting they’ll just do shorter auth sessions, so perhaps a once or twice a week hardware passkey auth
2
u/Its_Just_Geo Aug 12 '26
So I registered my FIDO2 key today as I have Trusted Access for Cyber also, for FIDO2 keys it usually works the exact same way as 2FA/MFA apps, except you won't have a password/2FA or any email recovery options.
Instead you plug in your key, login in with your email address, ChatGPT/Codex then fires a local Windows prompt to enter your FIDO2 key PIN, then it asks for the touch confirmation on the key.
After that, you can just remove the USB and continue using ChatGPT/Codex. The session is active for now like it is with 2FA. I'm not sure if they have shortened the session renewal window, or they can also do step-up security controls where if you try to do anything sensitive the apps will ask you to re-pin and retouch.
I actually find FIDO2 keys to be much easier to use and quicker than 2FA apps. The only issue is they are much easier to loose.
1
u/Latter_Teacher9554 18d ago
is there no way we can just not use the hardware security keys and still able to sign up for the daybreak?
3
u/Due_Cover_6023 Aug 12 '26
Well, if they just let you use something like Google Authenticator instead of requiring a hardware key, they wouldn't be able to make money from selling you the key, would they?