3 ms·
I don't trust the YubiKey Neo because of the security flaw that allowed anyone to trivially bypass PIN authentication and GPG sign stuff just by waving their RF
by makomk 11y ago
I don't trust the YubiKey Neo because of the security flaw that allowed anyone to trivially bypass PIN authentication and GPG sign stuff just by waving their RFID-enabled phone past your YubiKey, and because they insisted it didn't really matter because an attacker might have been able to learn your PIN anyway[1]. This is a general downside of smart card based devices; they're generally designed so that the only thing enforcing the use of the PIN/password is an if statement somewhere in the code, and if that contains a logic flaw or can be bypassed...
[1] https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.html https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory...
- deleted 11y ago[deleted]
- nickik 11y agoNobody will ever make a 100% secure system. What are the alternative NFC Smartcards that I can use? Yubico did not behave badly. Their products continue to improve in secuirty. What is your alternative setup that provides anything close the same usablity?
- Tharkun 11y agoThat's not true. The whole point of a smart card is that it's NOT just an "if statement".
- makomk 11y agoI'm afraid it is in many cases. The whole point of a smart card is to wrap enough hardware anti-tamper measures around that if statement in order to stop you from bypassing it.