3 ms·
All that seems targeted, not a generic malware checking for Yubikeys connected to random systems. It also doesn't seem "simple" or "practical". Is your argumen
by jolmg 6y ago
All that seems targeted, not a generic malware checking for Yubikeys connected to random systems. It also doesn't seem "simple" or "practical".
Is your argument that the sensor is useless because you can bypass it like that, or is your argument that it's not absolutely foolproof? If the former, I disagree; if the latter, then I can agree.
I mean, we're comparing to the alternative where if the credential is cached, then any software can use the key as they like without the user being any wiser. They wouldn't need to present convincing fake login screens or anything else.
- gruez 6y ago>All that seems targeted, not a generic malware checking for Yubikeys connected to random systems. Well that's because it's 2 factor, not because you're using a hardware token. Using TOTP would offer similar protections against "generic" malware that's scanning credentials to use later. >It also doesn't seem "simple" or "practical". Is it? It doesn't seem too hard to hook into browser (or whatever other program like gpg or ssh-agent) so you can listen for authentication requests, and disable the wifi using the platform api. >Is your argument that the sensor is useless because you can bypass it like that, or is your argument that it's not absolutely foolproof? If the former, I disagree, if the latter, then I can agree. The sensor adds marginal amount of security and provides a false sense of security. Most the increased complexity (compared to "generic" malware) involved in such a hypothetical attack comes from the 2 factor aspect, not from having a hardware token or having a physical button on the token.