3 ms·

I have been using the YubiKey for over a year now, and the novelty wore off. I lost my key a couple of weeks ago and was surprised how easy it was to get back

by korzun 9y ago

I have been using the YubiKey for over a year now, and the novelty wore off. I lost my key a couple of weeks ago and was surprised how easy it was to get back into my accounts with just my phone. There is no point in using something like that if providers allow you to failover to more conventional authentication methods without any hassle; the keys are useless. They are not going to add manual verification for a couple of people who lost their YubiKey. YubiKey is useful for instances when you want to grant somebody access to something with just a key. I don't see it going beyond that anytime soon.

scottLobster 9y ago
Depends on the provider. From some quick Googling Lastpass at least requires email verification before disabling Yubikey support. https://lastpass.com/support.php?cmd=showfaq&id=2546 https://lastpass.com/support.php?cmd=showfaq&id=2546 Even for providers that do provide seamless failover, the inevitable "we see you requested an account recovery" email would serve as useful canary to know you're being targeted.
- korzun 9y ago
  > Depends on the provider That was the whole point of my comment. It is up to the vendor and vendors do a horrible job. > the inevitable "we see you requested an account recovery" email would serve as useful canary There is nothing useful here. They are allowing you to bypass a secure key with a dumb email confirmation. Your idea of a 'useful canary' is great; until you get rooted at 5 AM on a Monday morning and that email disappears before you wake up.
  - albertgoeswoof 9y ago
    A cool down period would be useful here, just wait a couple of days for access
  - scottLobster 9y ago
    Well I imagine in most people's cases if they've managed to compromise their email then the game is already won. Anecdotally, someone got my steam account credentials. I discovered this when they tried to change my password. Fortunately I had Steam's two-factor enabled and got the notification (2-factor is required to change steam account passwords), which alerted me to change my password. They actually tried the account recovery option and I got an email notification about that as well. So in situations like that such notifications can be quite useful. But yeah, if they've compromised your most critical accounts/devices then YubiKey isn't going to save you. I don't think that's a knock against it.

by korzun 9y ago

scottLobster 9y ago

Depends on the provider. From some quick Googling Lastpass at least requires email verification before disabling Yubikey support. https://lastpass.com/support.php?cmd=showfaq&id=2546 https://lastpass.com/support.php?cmd=showfaq&id=2546 Even for providers that do provide seamless failover, the inevitable "we see you requested an account recovery" email would serve as useful canary to know you're being targeted.

korzun 9y ago
> Depends on the provider That was the whole point of my comment. It is up to the vendor and vendors do a horrible job. > the inevitable "we see you requested an account recovery" email would serve as useful canary There is nothing useful here. They are allowing you to bypass a secure key with a dumb email confirmation. Your idea of a 'useful canary' is great; until you get rooted at 5 AM on a Monday morning and that email disappears before you wake up.
- albertgoeswoof 9y ago
  A cool down period would be useful here, just wait a couple of days for access
- scottLobster 9y ago
  Well I imagine in most people's cases if they've managed to compromise their email then the game is already won. Anecdotally, someone got my steam account credentials. I discovered this when they tried to change my password. Fortunately I had Steam's two-factor enabled and got the notification (2-factor is required to change steam account passwords), which alerted me to change my password. They actually tried the account recovery option and I got an email notification about that as well. So in situations like that such notifications can be quite useful. But yeah, if they've compromised your most critical accounts/devices then YubiKey isn't going to save you. I don't think that's a knock against it.