Ledger Nano S Plus and X for Two-Factor Authentication (U2F)
How to use a Ledger Nano S Plus or a Ledger Nano X for two-factor authentication?
Do you know that both Ledger Nano S Plus and Ledger Nano X are also devices for two-factor authentication?
Using Ledger devices to store and manage cryptocurrencies is very common among enthusiasts, traders and investors.
Despite the widespread use of them as “hardware wallets”, most users don’t know that such devices have another, very useful, feature that doesn’t concern cryptocurrencies, at least not entirely.
A Ledger device can be also used as a two-factor authentication tool thanks to the FIDO U2F standard
What I mean is that if you decide not to deal with cryptocurrencies anymore, do not throw your device away. You may take advantage of it on websites and web services which support the FIDO U2F security protocol.
Two-factor authentication
Two-factor authentication is a security process where the user, in order to verify himself, provides two different authentication factors to better protect both his login data and the resources he wants to access.
Two-factor authentication provides a higher security level than access methods based on single-factor authentication, where the user typically provides only one password or a single pin.
Two-factor authentication methods require the user to provide not only something he “knows” (the password) but also something he “owns”, such as a security token, a smartphone, a biometric factor, etc.
Two-factor authentication adds another layer of security to the authentication process, making it harder for hackers the access to user’s devices or online accounts.
Knowing the victim’s password is not enough to pass the authentication check.
Many crypto enthusiasts use two-factor authentication techniques on exchange platforms. The most widespread authentication method is the Google Authenticator app, which is however based on the TOTP algorithm.
“Authenticator” apps remove the need of obtaining a verification code by sms, voice call or e-mail.
In order to access a website, or a web-based service, that supports Google Authenticator or other similar apps, the user must type his username and password: a knowledge factor.
The user is then prompted to enter a six-digit number. Rather than waiting a few seconds to receive a text message, the number is generated by the Authenticator.
These numbers change every thirty seconds and are different for each access. By entering the correct number, the user completes the verification procedure and demonstrates that he owns the right device: a possession factor.
The popularity of one-time password technology is due to its simplicity. In addition to a static credential (username/password) the user provides another dinamically generated authentication factor.
OTP technology is compatible with all the main platforms (desktop, laptop, mobile) and legacy systems, making it a very popular choice among second factor protocols.
Despite its usefulness and simplicity, OTP technology is not immune to phishing and man-in-the-middle attacks. Here is what can happen.
An hacker creates a fake website, designed to lead people to submit their login credentials. When a user falls into the trap and enters his information (username, password and one-time password), these data will be immediately intercepted by the hacker to access to the victim’s account.
The increased sophistication of attack techniques against OTP schemes was a motivating factor in the development of FIDO U2F protocol. Here is why this is better than the former.
When a user registers a U2F device for his account, a public/private key pair is generated.
After setting it up, when the user attempts to log in, the service provider sends a challenge to the client. The client compiles the requested information, which are then signed by the U2F device (using the private key) and sent to the server (to the service provider).
The real-time response scheme of the U2F protocol is able to face OTP vulnerabilities, such as phishing and several kinds of man-in-the-middle attacks.
Since the request is issued by the legitimate server, if a fake site or a man-in-the-middle manipulates the stream, the server will detect an anomaly in the response and will deny the access.
How to set up Ledger Nano as a U2F device
FIDO U2F is a two-factor authentication method being developed by FIDO Alliance and supported by both Ledger Nano S Plus and Ledger Nano X.
In order to get started you need a Ledger Nano S Plus or a Ledger Nano X updated to the latest firmware version. The Ledger Live app must be installed as well.
Here are the step by step instructions:
1) open the “Manager” in the Ledger Live;
2) connect and unlock your Ledger device;
3) if required allow the “Manager” on your device;
4) find “FIDO U2F” in the apps catalog;
5) click on the “Install” button of the application;
6) open the “FIDO U2F” app from the device dashboard.
In order to enable the two-factor authentication for websites or web services that support FIDO U2F, go to the security settings of the website or service and follow the instructions to register the device.
As for crypto exchanges, Binance, Bitfinex and Coinbase already support such authentication protocol. In order to find out if you can use the U2F protocol for a specific exchange, simply check the security section of the settings.
Beyond the cryptocurrencies field you can still take advantage of the U2F technology in many online services: e.g. Facebook, Google, GitHub, Dropbox and many others.
Security tips
Always make sure you set an alternative access method. You can register a second key, with another U2F device, or a different authentication factor, such as the Google Authenticator.
Registering a second access method is essential, because if you remove and install again the FIDO U2F app — whatever the reason — you will need to reconfigure it for each service.
After updating the Ledger firmware all apps must be reinstalled, and this involves the reset of the counter. This makes impossible to access the service using the device’s FIDO U2F app, hence you must reconfigure the service.
The FIDO U2F app of the Ledger device maintains an internal counter which changes every time U2F is used to access a third-party service.
That said, whenever you want to update the Ledger firmware or install again the FIDO U2F app, take the following precautions:
1) use an alternative tool — such as an Authenticator app — to log in to the services you wish to access;
2) once logged in, go to the security settings of the services where you use FIDO U2F. Then remove the FIDO U2F authentication method that you had set up with your Ledger device;
3) register again your Ledger device as an authentication method.
Video tutorial: set up Fido U2F with Ledger Nano X for Google account
As an example, in this video tutorial you can learn how to secure a Google account using your Ledger Nano X with Fido U2F.
Hopefully this article helps you figure out how to use a Ledger Nano as a key for Two-Factor Authentication (U2F). Should you have any doubts or questions, ask me in the comments below.
How to use Fido U2F with Ledger Nano S?
Since I as I scroll through them menu of wallet on the Ledger Nano S and I keep seeing Fido U2F, I think its a good additional layer of security to use.
Would it be safe to purchase the Fido U2F from amazon? Or similar to crypto hardware wallets its best to purchase the item from the OEM?
Lastly, Im a little confused about the whole U2F situation, since I was browsing the Trezor website and they said that the very Trezor device can function as a U2F device for other applications like Dropbox and others, so does that mean Trezor doesnt have the option of having Fido U2F for its wallet?
And if so why does Ledger Nano S have the option of pairing a Fido U2F device, but at the same time cannot function as a U2F device for other applications?
sorry if that seemed a bit scatterbrained, Im just so excited to learn more about Ledger since mine just came in the mail yesterday!
Use Ledger wallet as Security Key for Google and other online accounts
Google allows its users to add an extra level of security for their accounts, via 2-Factor-Authentication (2FA). With this option enabled, users have to authenticate themselves through a different channel, in addition to providing the account password, in order to gain access to the account.
The second level of authentication may be done via SMS OTP, Google Authenticator app, or a USB Security Key. Many users might prefer to use the USB Key for this purpose, because it’s hardware-based, faster and more secure compared to the other options. Also, it seems kinda cool to be able to unlock your account by plugging in a USB key.
Many companies issue hardware products built specifically for this purpose. Such USB devices are usually based on the FIDO U2F standards and are compatible with any website or service which use the same standards for 2FA.
For example, YubiKey is one such popular device that can be used to authenticate yourself on Google and other services that support the FIDO U2F standards. To unlock your Google account via 2FA, you just need to plug in the device to your compute, and press the physical button at the back of the device when asked, in order to login to your account.
But if you are a cryptocurrency holder who uses a hardware HD wallet like Ledger, you could also use the same hardware wallet as a USB Security Key for 2FA, instead of using a dedicated device such as YubiKey.
This article explores how you can set up your Ledger Wallet as a USB Key for unlocking your Google account using 2FA. But the same method holds true for setting up USB Key-based 2FA for other FIDO U2F supported services as well.
In order to set up your Ledger Wallet for 2FA, first you need to ensure that the FIDO U2F app is installed on your Ledger Nano S or Ledger Blue device. If not, follow the steps below to install the FIDO U2F app:
- Download and install the Ledger Manager Chrome app on your computer.
- Connect your Ledger Wallet to your computer and provide the Wallet Pin.
- Launch the Ledger Manager app and install the FIDO U2F app on your Ledger device.
Once installed, your Ledger device is ready to serve as a USB Security Key for your Google Account.
Now, you need to set up your Google account in such a way that it can be unlocked by plugging in your Ledger Wallet device (or any USB Key). Follow the steps below to configure your account for 2-Step Verification via USB Security Key:
- Turn on 2-Step Verification for your Google account, if not already done.
- Connect your Ledger Wallet to your computer and provide the Wallet Pin to unlock it.
- Click on Add Security Key link from the available 2-Step-Verification options.
- Click Next on your computer and then open the FIDO U2F app on your Ledger device. You will get a prompt to authenticate yourself.
- Choose yes on the Ledger device. The device will now be configured to work with your Google account.
From now on, whenever you need to sign in to your Google Account from your computer, you need to plug in the Ledger Wallet, open the FIDO U2F app on the device, and confirm authentication from it.
Note: It is recommended to have a secondary 2-Step Verification option enabled, such as OTP or Google Authenticator, along with USB Security Key. This will allow you to use alternative methods for 2-Step Verification while logging in from browsers in which USB Security Keys are not supported (for example, Safari, mobile browsers, etc.).
Although this article is meant specifically for Ledger Wallet users, this workaround is also applicable for any other hardware HD wallets that supports FIDO U2F features.
Now that you know how to use your Ledger Wallet as a USB Security Key for 2FA, you no longer need to invest on a separate device. And for those of you who aren’t familiar what hardware HD wallets are all about, you can check out our dedicated article on the same.
Sorry, you have been blocked
This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.
What can I do to resolve this?
You can email the site owner to let them know you were blocked. Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.
Cloudflare Ray ID: 80ec0af929c4412b • Your IP: Click to reveal 45.84.122.41 • Performance & security by Cloudflare