4 ms·
Yubikeys can perform many functions; the one in the article is an OTP which can be accidentally pasted into Slack.
by suprfsat 6y ago
Yubikeys can perform many functions; the one in the article is an OTP which can be accidentally pasted into Slack.
- Thorrez 6y agoYes. But the main insecurity isn't accidental pastes, it's being phished. The company the author of this article works for needs to switch to U2F.
- Spivak 6y agoIf the only phishing protection you find meaningful for 2FA tokens is domain matching then any extension-based password manager like Bitwarden will work with far less hassle than needing a physical token or your phone.
- Thorrez 6y agoJust hope your password manager's password doesn't get phished. > or your phone. Using your phone for 2FA doesn't provide any phishing protection that I know of. What realistic attacks is a non-U2F Yubikey protecting against that TOTP (Google Authenticator) won't protect against?