2 ms·
Could you expand a bit more on the threat model that exile targets? Checking out the workflow, my naive concern is that it seems to make physical possession of
by akerl_ 8y ago
Could you expand a bit more on the threat model that exile targets? Checking out the workflow, my naive concern is that it seems to make physical possession of the yubikey the sole requirement to use the secret key (well, possession + noticing that there’s an AWS key stored in the OATH slot).
Considering the “normal” threat model for AWS IAM keys, where the keys are stored in ~/.aws/credentials, they’re vulnerable to: (1) malicious/compromised apps/scripts on the local workstation, (2) theft of the laptop if it’s unlocked/decrypted. Moving the keys seems to solve (1), but degrades (2) by making it “theft of the yubikey”.
I’ve seen other systems that move the AWS secret keys to the OS keychain (for example https://github.com/99designs/aws-vault https://github.com/99designs/aws-vault ), which seem to harden against (1) without weakening (2).
Is there a mitigation I’m not taking into consideration?
- ak217 8y agoSure, that's a valid question. 1. YubiKey's OATH application can be protected with a password. If you can't unlock the YubiKey with a password, you can't access any OTPs (or "OTPs" in exile, where they're being used as HMAC keys instead). (Granted, exile does not directly integrate with this yet, nor even mention it - thanks to you, I'll add it to the readme ASAP) 2. The YubiKey is an HSM, which means it can't be duplicated. As soon as you find your laptop/keychain stolen (which is much easier than detecting that the contents of your home directory have been copied) you can revoke the AWS API keys. 3. I consider a hack and theft of my home directory contents to be more likely than physical theft of my YubiKey (which I believe for most people is either permanently inserted into their laptop, or on a physical keychain). This risk calculus may be different for you. 4. As you point out, the attacker would need to know how to make use of this (as yet) fairly obscure use of the YubiKey.