4 ms·

Until there's a YubiKey 4C nano, I'll wait. Having something of that size sticking out of my computer is not really practical. Not having it inserted defeats th

by jupp0r 10y ago

Until there's a YubiKey 4C nano, I'll wait. Having something of that size sticking out of my computer is not really practical. Not having it inserted defeats the whole point.

LeifCarrotson 10y ago
> Not having it inserted defeats the whole point How so? I would keep this on a keychain or lanyard (it looks rugged enough to handle that sort of environment). When I need to authenticate, I plug it in, when I'm done, I unplug it. That seems a lot more secure than leaving it in the computer all the time. If someone gets my computer and the YubiKey is always installed, that sort of defeats the purpose of having a separate hardware security device. In that case, why not just use Keypass?
- eumoria 10y ago
  I've had the standard USB version on my keys for about a year at this point. They're in my back pocket and take a bunch of abuse. Still works just fine.
  - sdwisely 10y ago
    Yup, mine has been on my keys and in use for nearly 6 years now and it works just as well as it did the day I bought it.
- nickik 10y ago
  Direct physical access to your computer is not the only thread. Even if you have in your computer all the time it gives you better logins, easier and safer. Specially protection from phishing. When I leave my computer out of my eyes it usually locked (unlock with password), so I don't expect somebody to quickly go in and do something. If I leave for longer, I sometimes pull the Nano out and put it somewhere I don't lose it for a while. The advantage of your system is that you can use the U2F screen unlock instead of the password.
akulbe 10y ago
Do you have to leave it plugged in to your computer the entire time? or just times you need 2FA?
- fuzzybeard 10y ago
  You only plug it in when logging in.
  - niij 10y ago
    Although, it is not a security vulnerability to leave it permanently plugged in.
danjoc 10y ago
If that's what you do, why wouldn't you prefer something built in? Like TPM?
treve 10y ago
I'm kind of wondering what the benefit is over having something like Yubikey at all instead of something that's just software when you just leave it in all the time.
- acdha 10y ago
  Trust: a hardware token has a very limited interface where it can be attacked compared with a general purpose computer or phone. Take the devices you use: how many exploits have there been in the last year where an attacker who could get you to click on a link, view an image, etc. could run code on the device? Maybe you have something like the iOS sandboxing between application which would stop a compromised browser from compromising your authenticator app but there are many cases where attackers have been able to bypass that. Using a hardware token prevents almost all of those attacks and means that if you are compromised you'll have an easier time regaining control. They also have some nice benefits such as not running out of battery when you need them in an emergency.
- tptacek 10y ago
  Your computer can in theory get owned up without you losing your SSH or VPN keys, even if your keystrokes are logged.
  - homakov 10y ago
    Get owned = SSH is hikacked = I don't need your keys and can run any commands on your behalf. This thing might protect from keyloggers but useless against proper malware that just waits for you to authenticate.
    - tptacek 10y ago
      Like everything, it's useful against some things and not against others. For some people, hardware SSH keys are worth the effort. For others, not.
      - homakov 10y ago
fuzzybeard 10y ago
This isn't something you should leave plugged in. It's a key after all used for authentication. Keep it on your keychain or in your wallet and plug in as needed.
- wyager 10y ago
  If it's sufficient to authenticate a particular machine, not necessarily a particular user, leaving it plugged in is acceptable and convenient.
- dastbe 10y ago
  The security is that it requires physical presence (your finger completing a circuit) to perform authentication. Leaving it plugged in doesn't detract from that.
artursapek 10y ago
Why do you need to keep it in? I have the blue U2f key and it's much larger. I just keep it on my keychain and only insert it while signing into something that requires it.

by jupp0r 10y ago

Until there's a YubiKey 4C nano, I'll wait. Having something of that size sticking out of my computer is not really practical. Not having it inserted defeats the whole point.

LeifCarrotson 10y ago

> Not having it inserted defeats the whole point How so? I would keep this on a keychain or lanyard (it looks rugged enough to handle that sort of environment). When I need to authenticate, I plug it in, when I'm done, I unplug it. That seems a lot more secure than leaving it in the computer all the time. If someone gets my computer and the YubiKey is always installed, that sort of defeats the purpose of having a separate hardware security device. In that case, why not just use Keypass?

eumoria 10y ago
I've had the standard USB version on my keys for about a year at this point. They're in my back pocket and take a bunch of abuse. Still works just fine.
- sdwisely 10y ago
  Yup, mine has been on my keys and in use for nearly 6 years now and it works just as well as it did the day I bought it.
nickik 10y ago
Direct physical access to your computer is not the only thread. Even if you have in your computer all the time it gives you better logins, easier and safer. Specially protection from phishing. When I leave my computer out of my eyes it usually locked (unlock with password), so I don't expect somebody to quickly go in and do something. If I leave for longer, I sometimes pull the Nano out and put it somewhere I don't lose it for a while. The advantage of your system is that you can use the U2F screen unlock instead of the password.

akulbe 10y ago

Do you have to leave it plugged in to your computer the entire time? or just times you need 2FA?

fuzzybeard 10y ago
You only plug it in when logging in.
- niij 10y ago
  Although, it is not a security vulnerability to leave it permanently plugged in.

danjoc 10y ago

If that's what you do, why wouldn't you prefer something built in? Like TPM?

treve 10y ago

I'm kind of wondering what the benefit is over having something like Yubikey at all instead of something that's just software when you just leave it in all the time.

acdha 10y ago
Trust: a hardware token has a very limited interface where it can be attacked compared with a general purpose computer or phone. Take the devices you use: how many exploits have there been in the last year where an attacker who could get you to click on a link, view an image, etc. could run code on the device? Maybe you have something like the iOS sandboxing between application which would stop a compromised browser from compromising your authenticator app but there are many cases where attackers have been able to bypass that. Using a hardware token prevents almost all of those attacks and means that if you are compromised you'll have an easier time regaining control. They also have some nice benefits such as not running out of battery when you need them in an emergency.
tptacek 10y ago
Your computer can in theory get owned up without you losing your SSH or VPN keys, even if your keystrokes are logged.
- homakov 10y ago
  Get owned = SSH is hikacked = I don't need your keys and can run any commands on your behalf. This thing might protect from keyloggers but useless against proper malware that just waits for you to authenticate.
  - tptacek 10y ago
    Like everything, it's useful against some things and not against others. For some people, hardware SSH keys are worth the effort. For others, not.
    - homakov 10y ago

fuzzybeard 10y ago

This isn't something you should leave plugged in. It's a key after all used for authentication. Keep it on your keychain or in your wallet and plug in as needed.

wyager 10y ago
If it's sufficient to authenticate a particular machine, not necessarily a particular user, leaving it plugged in is acceptable and convenient.
dastbe 10y ago
The security is that it requires physical presence (your finger completing a circuit) to perform authentication. Leaving it plugged in doesn't detract from that.

artursapek 10y ago

Why do you need to keep it in? I have the blue U2f key and it's much larger. I just keep it on my keychain and only insert it while signing into something that requires it.