4 ms·

Is it even safe to buy yubikeys on Amazon given the counterfeit problem?

capableweb 7y ago
Guess there could be two attack vectors, one that is easier to avoid and the other not so much. The first one being a targeted attack. Then any ordering of Yubikeys can leave to vulnerable as the supply chain can be intercepted (because they see it's you and switch out the key to a counterfeit one). This can be solved by going to a in-person store and buying it there. Then there is no risk of you being personally targeted as you can go to any store. The second one, is where all keys sold being counterfeit, which you cannot solve by going to a in-person store or ordering online. Not sure how you could avoid this vector.
- 0xffff2 7y ago
  >Not sure how you could avoid this vector. While this is a theoretical problem anywhere, it's a practical problem when ordering from Amazon far more often than anywhere else. Going to a reputable physical store likely shields you from the second scenario nearly as well as the first. Also, in the case of Yubico at least, you can order directly from their website, which presumably minimizes the number of hands the product has to go through, thus minimizing opportunities for a counterfeit to be swapped in.
jolan 7y ago
You can verify whether you received a genuine key at: https://www.yubico.com/genuine/ https://www.yubico.com/genuine/
- willismichael 7y ago
  Unless some entity can man-in-the-middle attack your attempt at verifying it.
- OrgNet 7y ago
  https is not safe against the government....
  - OrgNet 7y ago
    ... because they can force CAs to give them the keys to decrypt all traffic.
    - NobodyNada 7y ago
      That's not true, since CAs don't have "the keys to decrypt all traffic." They have the ability to sign website operators' public keys, but they do not have access to the website operators' private keys. Of course, the CA could also issue a fake certificate with attacker-controlled keys, but if they tried to do so, they would get caught by Certificate Transparency.
infosec4life 7y ago
Good question.
skore 7y ago
Don't know about counterfeiting, but when I tried to order yubikeys via German amazon, every single one of the blisters looked suspiciously as though they had been tampered with[1]. They were opened juuust slightly on the side - enough to potentially slide the key out and in again, definitely something that you could miss if you weren't paying close attention. I placed a second order and the exact same thing happened. It was quite weird and I've since ordered from yubico directly. [1] http://imgur.com/gallery/1c8uMFr http://imgur.com/gallery/1c8uMFr
diminoten 7y ago
There isn't an actual Amazon counterfeit problem, so yeah, it's safe.

Guess there could be two attack vectors, one that is easier to avoid and the other not so much. The first one being a targeted attack. Then any ordering of Yubikeys can leave to vulnerable as the supply chain can be intercepted (because they see it's you and switch out the key to a counterfeit one). This can be solved by going to a in-person store and buying it there. Then there is no risk of you being personally targeted as you can go to any store. The second one, is where all keys sold being counterfeit, which you cannot solve by going to a in-person store or ordering online. Not sure how you could avoid this vector.

0xffff2 7y ago
>Not sure how you could avoid this vector. While this is a theoretical problem anywhere, it's a practical problem when ordering from Amazon far more often than anywhere else. Going to a reputable physical store likely shields you from the second scenario nearly as well as the first. Also, in the case of Yubico at least, you can order directly from their website, which presumably minimizes the number of hands the product has to go through, thus minimizing opportunities for a counterfeit to be swapped in.

jolan 7y ago

You can verify whether you received a genuine key at: https://www.yubico.com/genuine/ https://www.yubico.com/genuine/

willismichael 7y ago
Unless some entity can man-in-the-middle attack your attempt at verifying it.
OrgNet 7y ago
https is not safe against the government....
- OrgNet 7y ago
  ... because they can force CAs to give them the keys to decrypt all traffic.
  - NobodyNada 7y ago
    That's not true, since CAs don't have "the keys to decrypt all traffic." They have the ability to sign website operators' public keys, but they do not have access to the website operators' private keys. Of course, the CA could also issue a fake certificate with attacker-controlled keys, but if they tried to do so, they would get caught by Certificate Transparency.

infosec4life 7y ago

Good question.

skore 7y ago

Don't know about counterfeiting, but when I tried to order yubikeys via German amazon, every single one of the blisters looked suspiciously as though they had been tampered with[1]. They were opened juuust slightly on the side - enough to potentially slide the key out and in again, definitely something that you could miss if you weren't paying close attention. I placed a second order and the exact same thing happened. It was quite weird and I've since ordered from yubico directly. [1] http://imgur.com/gallery/1c8uMFr http://imgur.com/gallery/1c8uMFr

diminoten 7y ago

There isn't an actual Amazon counterfeit problem, so yeah, it's safe.