7 ms·
The Yubikey/WebAuthn comments are really ignorant and discouraging people from the best defense against this sort of attack that exists. First of all you can g
by lrvick 6y ago
The Yubikey/WebAuthn comments are really ignorant and discouraging people from the best defense against this sort of attack that exists.
First of all you can get WebAuthn devices for as little as $10 now.
Second, there is no app to configure. You plug it in when it says register and tap it. Done.
Third, if the WebAuthn device gets stolen the attacker presumably lacks a password. You can't use the device by itself. Also the vast majority of attacks are remote, not IRL.
Fourth: fingerprint or pin authenticated WebAuthn devices exist if your threat model worries about physical access.
IRL attacks are a radically different threat profile.
I can't even with this article.
- latopedej 6y agomost people have a phone that can leverage webauthn, so you don't even need to buy anything. On top of that, webauthn can be configured to prevent phishing as well
- edent 6y agoCould you let me know where I can buy a well supported WebAuthn key for that price? Looking at Amazon UK - https://amzn.to/3oWGYe4 https://amzn.to/3oWGYe4 - the cheapest appears to be about £30. Unless I want to risk my security to some no-name brand with zero customer support. When I got my YubiKey, it told me I had to download an Android app to make it work. So, perhaps better documentation is needed? I'm sorry you didn't like my post, I'll try to do better in future.
- _wldu 6y agoConor sold U2F Zero's for less than 10 dollars (years ago) and has a kick starter now to fund his new Solo keys: https://www.kickstarter.com/projects/conorpatrick/solo-the-first-open-source-fido2-security-key-usb/ https://www.kickstarter.com/projects/conorpatrick/solo-the-f... https://u2fzero.com/ https://u2fzero.com/ I have a few U2F Zeros and they have been working fine for years. These are simple devices. You don't need to overpay for them. Edit: Conor was building the U2F Zero tokens for $2.26 USD per unit. Read more here: https://www.conorpp.com/u2f-zero-year-in-review/ https://www.conorpp.com/u2f-zero-year-in-review/
- gnufx 6y agoI don't think the kickstarter is relevant now. You just buy them from solokeys.com. There's been Somu since that, and Solo2 is in the offing, with plenty of storage, apparently. I bought Somu partly for convenience, and partly for the promise of PGP support, which unfortunately hasn't been added yet (though there is a development version). In answer to the expense question, two Solo keys appear to set you back 38 quid at the current exchange rate. I don't know how they compare with HYPERFIDO, which I don't think I'd come across before.
- ecesena 6y agoI can confirm what you and _wldu are saying and yes, the latest project is https://solokeys.com/v2 https://solokeys.com/v2 and is launching end of this month. From an economic perspective, unfortunately, it's really hard to focus on reducing the cost, there's simply no incentive. First, consider that the biggest cost in the customer getting a security key is basically shipping + packaging. Imagine a key that costs <$3... even packaging with a polybag + printed label + padded envelop gets to a cost that has a significant % of the production cost. Next, it's features. To stay on par with competition, people expect the same features (see, e.g., openpgp mentioned above - the code currently doesn't fit in the stm32l4 flash), both firmware and hardware. As a result we have to look at the latest & greatest micro, but of course that alone has a significant cost. And finally, there's the overall viability. We all know that open source projects die without a business model. The numbers in the U2FZero review simply don't add up, that was clearly unsustainable and that's why we made SoloKeys. A business has expenses other than manufacturing and if you don't account for that, the business dies together with your dream project. Anyway, thank you both (and all others) for the great support. One step at a time, we'll get to a stronger and eventually also cheaper product!
- gnufx 6y agoAh, I didn't know about the PGP code size. Point taken about the cost, and I hope you can sell to organizations. I'm surprised I can buy a competitor for £8, but then I can't run the proprietary programming software or, I assume, re-flash it. I'm happy to support a free software project anyhow. I wish I could register my Somu with the work Duo system rather than the display-a-number-you-type HOTP keys they reluctantly issue as the expensive alternative to expecting us to use personal phones for such purposes. Phishing, we've heard of it.
- captn3m0 6y agoThe HYPERFIDO Mini keys (8 GBP[0,1]) are certified by the FIDO Alliance: https://fidoalliance.org/showcase/hyperfido-mini/ https://fidoalliance.org/showcase/hyperfido-mini/. [0]: https://www.amazon.co.uk/HYPERFIDO-MINI-FIDO2-HOTP-Security/dp/B0813YWZB2 https://www.amazon.co.uk/HYPERFIDO-MINI-FIDO2-HOTP-Security/... [1]: https://www.hypersecu.com/products/hyperfido https://www.hypersecu.com/products/hyperfido
- tialaramex 6y agoThe HyperFIDO is basically fine, it's obviously your choice to insist on the expensive famous brand products, but it seems a bit crazy to on the one hand insist those are too expensive and then reject perfectly good cheap options. If I had a corporate budget to spend maybe I'd order trays of Yubico Security Keys or Google's Feitian rebrand. But I just wanted to have more than one vendor so I have this product (well not this one, but it's the same product under different branding) and it works fine.
- avipars 6y agoAMAZON AFFILIATE LINK. Please delete....
- DecoPerson 6y agoFor the reasons listed in the article and more, Yubikeys and similar devices aren’t likely to ever be popular. To give future security devices along the same vain a better chance at gaining popularity and being widely adopted (which will hopefully bringing us a more stable, less stressful society), the designs of these new devices must solve or workaround the issues the author describes. It’s really annoying when individuals such as yourself respond so very negatively and unconstructively while others are trying to discuss the issues with existing designs — an act necessary for us (collectively) to develop new designs. The author may not provide strong evidence for their claims, but neither do you provide strong evidence (or extensive reasoning) for yours. The net gain here is negligible, expect for showing that contrary opinions exist, but that’s not particularly helpful as for every opinion held it is inevitable that someone holds the polar opposite. I’m not a moderator, but I ask you to please try to better further the discussion with future comments.
- hehehaha 6y agoI think Yubikey (and similar physical solutions) will eventually gain popularity. Carrying a key is pretty much a standard practice across the globe and benefit is more than negligible because it forces physical attack versus remote/virtual.
- cxr 6y agoInstead of a hardware authenticator to be carried on a keyring, they should be put into rings, i.e., the things meant to be worn on your fingers, i.e., the things that most people use for providing input to their computing devices, whether they sit on a desk or are held in one's hands.
- hehehaha 6y agoThis is actually brilliant.
- tilsammans 6y agoI had one twenty years ago, a Java Ring. Apparently they are still being made today.
- wyager 6y agoPlus, iPhones already support webauthn via Face ID, and I assume MacBooks will support it via Touch ID at some point.
- justincormack 6y agoIt is disappointing that touch id doesn't support this yet, it would be great. I put my ssh keys on touch id but my webauthn and gpg are on the yubikey and I have to remember which to touch. And the yubikey with finger print reader isnt out yet and I already have pretty much the right hardware in the mac...
- easterncalculus 6y agoDisappointed but not surprised when reading this. To be really honest, I can't remember the last time I read something that criticized so called "techbros" and actually said something reasonable. As for the U2F devices, the idea of just leaving them in, the small yubikeys and all that, seem to just be a bad idea from the get-go.
- Freak_NL 6y agoYou can leave them in, but you still have to tap/touch them for every authentication action (user interaction); the small YubiKey Nano included.
- wyager 6y agoWhat is your objection to just leaving a yubikey plugged in? It eliminates most of the ways an attacker could impersonate me besides literally stealing my laptop, which is a high bar. Most people are valuable enough targets to phish or infect with malware or something, but not to plan a computer heist.
- kps 6y agoIf stealing the computer is enough, someone's seriously screwed up already — it's supposed to be 2FA, not 1FA.
- aidenn0 6y agoStealing the computer is usually enough, as a browser cookie serves as proof of authentication all on its own. Some destructive operations require extra auth, but in terms of data exfiltration, stealing a laptop gives you everything you need.
- izacus 6y agoWhat exactly does that have to do with YubiKeys though? Every time you use one you need to enter password. And you can also immediately revoke it as soon as you notice its stolen.