7 ms·
I have helped literally hundreds of people setup Yubikeys across several companies. Your take is just not my experience at all. Tapping a blinking light it is
by lrvick 6y ago
I have helped literally hundreds of people setup Yubikeys across several companies.
Your take is just not my experience at all. Tapping a blinking light it is much easier than fussing with a 2FA app and works when someone's phone is dead. Yubikeys in particular are near indestructible. They even work after you soak them in acetone overnight and melt the plastic off. I tried.
When it says "plug in your device" you plug it in. When it says tap you tap.
Also the mugger comment is not part of a typical threat profile. Yubikeys and similar devices are meant to protect you from remote attackers which is the class of attack 99.9999% of people need to defend against.
If a mugger points a gun at you, no form of 2FA is going to save you.
Also my Yubikey has a pin enabled and fingerprint enabled WebAuthn devices exist. I have several. If you are carrying things so valuable you are worried about being mugged, you can probably afford a higher end model with a fingerprint or pin.
Edit: yes I know random muggings happen, but a hit and run mugger that knows what a Yubikey is and already has your password is a hiiiiighly targeted attack. -That- pretty much never happens unless you are walking around with a $1,000,000 in Bitcoin in which case it has happened a total of 5 times that are public.
- screamingninja 6y ago> If a mugger points a gun at you, no form of 2FA is going to save you. https://xkcd.com/538/ https://xkcd.com/538/
- ajcp 6y agoIf it's so easy why did you have to help hundreds of people across several companies set it up?
- tialaramex 6y agoYou have to (well, I guess if it isn't your job you don't have to but it's polite) help people set up anything. Doesn't mean it isn't easy. Helped my mum set up Zoom (so she could attend virtual church apparently), is Zoom not easy? Two (three?) jobs back I had to set a bunch of people up on one time passcodes. Those seem pretty easy right? Still had to go there in person and show them.
- fjiizrsdfjjj 6y agoIf my Yubikey gets stolen, how do I log in into my accounts? Serious question; never understood how that works.
- proactivesvcs 6y agoThe last time I've used the configurators on Windows and Linux they provide the private key material for one to backup.
- ahmedalsudani 6y agoThat’s how 2FA works. It’s a physical token. You either have other 2FA devices or backup codes.
- corty 6y agoDepends. Some have a bunch of magic numbers you can use as alternative "second factor", basically another password for the special purpose of bypassing a real 2nd factor. That's of course stupid and dangerous. Then there are those where you can register another 2nd factor, e.g. another Fido-Key, SMS-Codes or recovery email. Those might be better or might be worse, depending on the method and circumstances. E.g. SMS is vulnerable to all kinds of SIM-Cloning and redirection stuff, email is vulnerable to whatever your email might be vulnerable to. The only thing I would accept as really idiot-proof and secure is "go someplace, show a government-issued hard-to-fake ID" (like a passport, not your drivers license...) like banks do. But that only works with physically present businesses and accounts that are strictly tied to one person. And even there, "Joe Smith" might impersonate "Joe Smith"...
- wyager 6y agoI have a backup U2F device. You can register multiple with any account. If I somehow manage to lose both, I assume I’ll have to talk to a customer support rep or something.
- growse 6y agoThis depends on the service supporting it though, and not all of them do (e.g. AWS).