4 ms·
I'm kind of wondering what the benefit is over having something like Yubikey at all instead of something that's just software when you just leave it in all the
by treve 10y ago
I'm kind of wondering what the benefit is over having something like Yubikey at all instead of something that's just software when you just leave it in all the time.
- acdha 10y agoTrust: a hardware token has a very limited interface where it can be attacked compared with a general purpose computer or phone. Take the devices you use: how many exploits have there been in the last year where an attacker who could get you to click on a link, view an image, etc. could run code on the device? Maybe you have something like the iOS sandboxing between application which would stop a compromised browser from compromising your authenticator app but there are many cases where attackers have been able to bypass that. Using a hardware token prevents almost all of those attacks and means that if you are compromised you'll have an easier time regaining control. They also have some nice benefits such as not running out of battery when you need them in an emergency.
- tptacek 10y agoYour computer can in theory get owned up without you losing your SSH or VPN keys, even if your keystrokes are logged.
- homakov 10y agoGet owned = SSH is hikacked = I don't need your keys and can run any commands on your behalf. This thing might protect from keyloggers but useless against proper malware that just waits for you to authenticate.
- tptacek 10y agoLike everything, it's useful against some things and not against others. For some people, hardware SSH keys are worth the effort. For others, not.
- homakov 10y agoIn my opinion it's not worth the effort (and certainly not $50). It makes marginally +X harder to exploit yet marginally +X inconvenient to use = typical security through obscurity.
- jupp0r 10y agowhat makes it attractive to me is that it's actually much more convenient to use than a password.
- homakov 10y agoIt really is, but there is no need for hardware. Software based auth would be the same
- tptacek 10y agoYou've lost me at "security through obscurity".
- homakov 10y agoMy bad, it's not what classic "through obscurity" means. Instead I meant something that makes exploitation more "obscure" (you need to be prepared to hijack a server vs simply leak the key).
- nickik 10y agoIf your SSH private key is on the Yubikey then you will not lose your private keys. Even in the case of U2F, the attacker will not figure out your U2F private keys or even all the places you are registered.
- tptacek 10y agoHis point, which is correct, is that you'll persistently lose access to your server anyways, because a backdoored SSH client is almost as bad as a compromised key. I use a Y4 for SSH, but it's good to be clear-eyed about the limitations.
- fuzzybeard 10y agoYou can compromise software on a PC. You can't do that, as much, with a hardware key used for 2 factor authentication.
- jupp0r 10y agoI specifically use it to store my gpg/ssh keys on it. The keys are generated on the device and have never been in any computer's memory. The key answers challenges from an SSH server with the appropriate response. I do not want to insert something dangling off my key every time I do git push.