6 ms·
A password manager and a handful of YubiKeys are pretty perfect. And they make for a good, simple advice to give to people if they're worried about security.
by blfr 7y ago
A password manager and a handful of YubiKeys are pretty perfect. And they make for a good, simple advice to give to people if they're worried about security.
- gcthomas 7y agoYup. The target for MFA is not perfect security, but security better than passwords alone — the bar is quite low to start with. And all of the above techniques offer that to varying degrees. I use strong passwords on all sensitive accounts, stored in a local password manager, with an authenticator app for those that don't accept my Fido2 Yubkey. Seems good enough to me.
- eeZah7Ux 7y agoIf a workstation is compromised, having multi-factor authentication is useless for most services: The real targets become the HTTPS session cookies and files on disk.
- robcohen 7y agoThis is correct, which is why I am a big fan of FIDO U2F software like https://Krypt.co https://Krypt.co . This requires your phone which is essentially a second workstation to authenticate. So now you need to exploit two workstations.
- eeZah7Ux 7y agoNo. Once you authenticated your sessions are the target.
- scient 7y agoEven then the external services will still require first and second factors of authentication. If your workstation is compromised on an ongoing basis, then nothing matters. If its an one-time even, 2FA will protect the external services still.
- acdha 7y agoNote that responsible sites do variations on IP / location fixation to reduce the value of exfiltrated session cookies and, of course, they're only valid for as long as you go between verifications. One really nice thing about FIDO is that it affords a low-pain “tap the button to confirm it's you” verification instead of a full password challenge.
- eeZah7Ux 7y agoThe attacker can very easily use your workstation as a vantage point. Even used directly your browser and your SSH sessions. It's makes it even more difficult to detect and trace.
- acdha 7y agoYes, which is a different threat than what was under discussion. Don't argue that we don't need seatbelts because they don't help when the driver is a kidnapper.
- sebazzz 7y agoHow does Yubikey prevent against SSL spoofing?
- wcip 7y agoWhat do you mean by SSL spoofing? Someone getting a public CA validated cert for a domain they do not own? I'd consider that a game over level threat myself, I can't imagine much of anything protecting against that completely. Certificate pinning can help mitigate the threat though.
- Spooky23 7y agoTotally different threat. The lock on your car door won’t stop a tow truck.
- graton 7y agoSomewhat related. U2F, which Yubikey supports does help prevent against DNS spoofing. A DNS name which looks very similar but is not the true DNS name of the site you want to connect to. Something that a human might not notice or get confused by will be stopped by U2F.
- rb808 7y agoWhat if they keys get lost/stolen or your house burns down. Do you keep a backup somewhere?
- graton 7y agoThey mentioned having a handful of Yubikeys. The nice thing about U2F is that many providers support having multiple U2F tokens. For example Google, Github, and Gitlab do. Though others do not, for example AWS (last time I checked). So you can keep one or two on your keychain and keep others in different locations as backups. One nice thing about the Yubikeys is that they can also support TOTP like Google Authenticator. So you could store your authenticator token on both your phone and on the Yubikey. Then use the Yubikey Authenticator app to get the code from the Yubikey. I do recommend requiring touch to access the code from the Yubikey. You most likely need to setup this up at the same time on both your phone and Yubikey. As most authenticator apps (but not all) don't let you have access to the secret once stored on your phone.
- tzs 7y ago> The nice thing about U2F is that many providers support having multiple U2F tokens. For example Google, Github, and Gitlab do. Though others do not, for example AWS (last time I checked). Note that in the case of AWS it is not as bad as it seems, if you use your AWS account they way Amazon recommends. When you initially create your account, the credentials you make (email and password) have full privileges on the account. This is called the "root" user. The root user can create other users on the account, and delegate to them most of the privileges of root (but not all). Amazon recommends that you make one or more admin user accounts to wield all the privileges that can be delegated, and then no longer use the root account except for those few tasks that can only be done with root. Use the admin user(s) to create regular user accounts for everything else. If you have N U2F tokens, make N admin users and associate each with a different token. Associate each regular user account with one of the tokens you carry on your key chain. If you lose a token, use one of the remaining tokens with the admin account it is associated with to reset the accounts that were using the lost token and then associate them with one of the remaining tokens. If you use U2F with the root account and lose its token you can do a reset of your 2FA setup via email and phone. You should only rarely need to use the root account, so its token should probably be one of the ones you keep in some safe spot like in your fireproof safe, not one you carry around on your key chain.
- brians 7y agoThese are great for operators in an ops center or devs at workstations. They’re not enough for managers on email or execs traveling across interesting borders.