On: Basic security precautions for non-profits and journalists (2017)

[jowiar]

I think the main argument here is that Gmail+Chrome lets you use a hardware second factor for login.

[Tomte → jowiar]

Tangent: I thought with webauthn and the new Firefox, U2F keys should work with Google Services.

Has anyone been able to log in using a Yubikey and Firefox to Google? Because I haven't.

[geofft → Tomte]

Yes, I do this, on Debian stable, using the browser download from the Firefox website. You need a recent Firefox (I think the latest ESR is fine but not before that) and for stupid reasons you need to register the security key with Chrome, but once it's associated with your account you can log in via Firefox.

[Tomte → geofft]

The register/use distinction is really stupid, but probably what's going to help me. Thanks a lot!

[Leace → Tomte]

> Has anyone been able to log in using a Yubikey and Firefox to Google? Because I haven't.

Yes, this works ever since Google introduced new accounts page. Tested with Firefox on Windows and Linux.

[pcwalton → Tomte]

It should be supported in Firefox now. In general you should be fine using Firefox (note: not Tor Browser) if security is important to you.

[geofft → pcwalton]

What are your reservations about Tor Browser? (Or is it just that Tor is a different threat model and ballgame?)