5 ms·

For the reasons listed in the article and more, Yubikeys and similar devices aren’t likely to ever be popular. To give future security devices along the same v

For the reasons listed in the article and more, Yubikeys and similar devices aren’t likely to ever be popular. To give future security devices along the same vain a better chance at gaining popularity and being widely adopted (which will hopefully bringing us a more stable, less stressful society), the designs of these new devices must solve or workaround the issues the author describes. It’s really annoying when individuals such as yourself respond so very negatively and unconstructively while others are trying to discuss the issues with existing designs — an act necessary for us (collectively) to develop new designs. The author may not provide strong evidence for their claims, but neither do you provide strong evidence (or extensive reasoning) for yours. The net gain here is negligible, expect for showing that contrary opinions exist, but that’s not particularly helpful as for every opinion held it is inevitable that someone holds the polar opposite. I’m not a moderator, but I ask you to please try to better further the discussion with future comments.

hehehaha 6y ago
I think Yubikey (and similar physical solutions) will eventually gain popularity. Carrying a key is pretty much a standard practice across the globe and benefit is more than negligible because it forces physical attack versus remote/virtual.
- cxr 6y ago
  Instead of a hardware authenticator to be carried on a keyring, they should be put into rings, i.e., the things meant to be worn on your fingers, i.e., the things that most people use for providing input to their computing devices, whether they sit on a desk or are held in one's hands.
  - hehehaha 6y ago
    This is actually brilliant.
  - tilsammans 6y ago
    I had one twenty years ago, a Java Ring. Apparently they are still being made today.
- MrStonedOne 6y ago
  Until keys become cloneable they will never gain popularity. Nobody wants to re-setup every site ever because they lost their laptop that they kept it plugged into, so they won't. either this means using their backup until they lose it without even revoking the original and then swearing off the entire concept while telling all their friends to do the same, or just not using hardware tokens after the first lost of keys. Also the "back up code" they will also get, guess where thats going! save as -> downloads or print2pdf -> downloads. When it comes to personal account security by end users, hardware tokens will never take off, and this is why they get so much hate. There is a real problem here that really needs to be really solved, wrt to end users and phishing/hack resistant credentials, and as long as we legitimize the lie that yubikey solves it, we gimp progress towards actually solving it.
  - hehehaha 6y ago
    I am not understanding your concern. You definitely don’t want the keys to be “cloneable”. You need at least two keys, sure, but I don’t see that as an inconvenience. And you should be using a password manager (with passwords cycled on a periodic basis) that is bound to your physical key.
  - rstuart4133 6y ago
    I don't think cloneable is a good idea. If some 3rd party clones your token and uses it to commit a crime there is no way to prove that happened. There are other solutions. Being able to make one key a proxy for another is one. That allows you to keep your master identity in a bank vault, and then use it to "sign" the one you keep on you during the day. Should you lose your daily driver, just sign another one. This still suffers from the "one true name" problem though - if someone steals that bank vault ID, you're gone. Another approach is servers allowing a client to register multiple ID's, and later delete them. Since there are multiple ID's, there isn't one true name any more. If one is lost you cancel it, and replace it with another. The approach is already built into the FIDO2 protocol, so they've already thought about your concerns and solved them, and IMHO solved them in a better way than you propose. A more robust approach still would be a combination of the idea above: FIDO2 multiple ID's solution, plus proxies. One key could then provide multiple ID's to every server you log into, signed by different masters that are stored in different places. Keys can't be copied, but a lost key can be replaced by signing it with the master. A compromised master can be have all it's ID's dropped by logging in with an ID proxying other master. You could think of it as RAID for 2FA's.
- RajBhai 6y ago
  I've long thought that U2F should be incorporated into phones, since everyone has one of those. Even not well off people in third world countries. In order for U2F to proliferate, everyone should have access to it. A $10 FIDO key probably won't be given a consideration if they think a free password is good enough.
  - tialaramex 6y ago
    WebAuthn is the modern replacement for U2F. Do not deploy greenfield U2F, it's a legacy technology only. A modern iPhone or high-end Android phone already does WebAuthn secured with your fingerprint or (on some iPhone models) facial recognition, like your lock screen or contactless payments.
nightski 6y ago
I use a Yubikey daily and the OP is greatly exaggerating the issues in my opinion. Vanguard for example it took less than a minute to set up. I don't have an "application" installed locally for the Yubikey, it was plug & play. No special software needed. I honestly think Yubikey type devices' largest problems are - 1. Marketing. People simply do not know they exist or how they work (simple or not). 2. Support - Many websites do not support Webauthn yet. We really need developers and businesses to consider this a priority. I have bought some keys for my family members and they love them once I demonstrate how they work.
- guenthert 6y ago
  Price. Yubikey's "best seller" goes for $45, that's grotesque. I would be surprised if the hardware costs exceeds $2 per unit and the software (or similar) can be had for free.
  - bsder 6y ago
    It's not about the hardware. In spite of the fact that they can nominally be broken into, most modern USB microcontrollers can easily implement being a security key. The expense is that the security world hasn't converged on anything remotely approaching a single standard. So, a key has to support ... PGP, OpenSSH, FIDO, FIDO2, U2F ... For example, you couldn't use some of the older YubiKeys with AWS because AWS only supported time-based TOTP. That's a LOT of software work, and you can't be "Startup Sloppy" with your code or someone will break it.
    - upofadown 6y ago
      The PGP thing is wildly different than the other applications in that it is a complete airgapped system on a key. The decryption and signing is actually done on key so the private key isn't exposed. PGP is pretty much the only thing that does this and as a result can be held up as an example of where we do in fact have a unique standard.
ak217 6y ago
> I’m not a moderator, but I ask you to please try to better further the discussion with future comments. Please don't go there. You're both adding to the discussion, maybe some strong words here and there, but this turn of phrase you used is a huge conversation destroyer.

hehehaha 6y ago

I think Yubikey (and similar physical solutions) will eventually gain popularity. Carrying a key is pretty much a standard practice across the globe and benefit is more than negligible because it forces physical attack versus remote/virtual.

cxr 6y ago
Instead of a hardware authenticator to be carried on a keyring, they should be put into rings, i.e., the things meant to be worn on your fingers, i.e., the things that most people use for providing input to their computing devices, whether they sit on a desk or are held in one's hands.
- hehehaha 6y ago
  This is actually brilliant.
- tilsammans 6y ago
  I had one twenty years ago, a Java Ring. Apparently they are still being made today.
MrStonedOne 6y ago
Until keys become cloneable they will never gain popularity. Nobody wants to re-setup every site ever because they lost their laptop that they kept it plugged into, so they won't. either this means using their backup until they lose it without even revoking the original and then swearing off the entire concept while telling all their friends to do the same, or just not using hardware tokens after the first lost of keys. Also the "back up code" they will also get, guess where thats going! save as -> downloads or print2pdf -> downloads. When it comes to personal account security by end users, hardware tokens will never take off, and this is why they get so much hate. There is a real problem here that really needs to be really solved, wrt to end users and phishing/hack resistant credentials, and as long as we legitimize the lie that yubikey solves it, we gimp progress towards actually solving it.
- hehehaha 6y ago
  I am not understanding your concern. You definitely don’t want the keys to be “cloneable”. You need at least two keys, sure, but I don’t see that as an inconvenience. And you should be using a password manager (with passwords cycled on a periodic basis) that is bound to your physical key.
- rstuart4133 6y ago
  I don't think cloneable is a good idea. If some 3rd party clones your token and uses it to commit a crime there is no way to prove that happened. There are other solutions. Being able to make one key a proxy for another is one. That allows you to keep your master identity in a bank vault, and then use it to "sign" the one you keep on you during the day. Should you lose your daily driver, just sign another one. This still suffers from the "one true name" problem though - if someone steals that bank vault ID, you're gone. Another approach is servers allowing a client to register multiple ID's, and later delete them. Since there are multiple ID's, there isn't one true name any more. If one is lost you cancel it, and replace it with another. The approach is already built into the FIDO2 protocol, so they've already thought about your concerns and solved them, and IMHO solved them in a better way than you propose. A more robust approach still would be a combination of the idea above: FIDO2 multiple ID's solution, plus proxies. One key could then provide multiple ID's to every server you log into, signed by different masters that are stored in different places. Keys can't be copied, but a lost key can be replaced by signing it with the master. A compromised master can be have all it's ID's dropped by logging in with an ID proxying other master. You could think of it as RAID for 2FA's.
RajBhai 6y ago
I've long thought that U2F should be incorporated into phones, since everyone has one of those. Even not well off people in third world countries. In order for U2F to proliferate, everyone should have access to it. A $10 FIDO key probably won't be given a consideration if they think a free password is good enough.
- tialaramex 6y ago
  WebAuthn is the modern replacement for U2F. Do not deploy greenfield U2F, it's a legacy technology only. A modern iPhone or high-end Android phone already does WebAuthn secured with your fingerprint or (on some iPhone models) facial recognition, like your lock screen or contactless payments.

nightski 6y ago

I use a Yubikey daily and the OP is greatly exaggerating the issues in my opinion. Vanguard for example it took less than a minute to set up. I don't have an "application" installed locally for the Yubikey, it was plug & play. No special software needed. I honestly think Yubikey type devices' largest problems are - 1. Marketing. People simply do not know they exist or how they work (simple or not). 2. Support - Many websites do not support Webauthn yet. We really need developers and businesses to consider this a priority. I have bought some keys for my family members and they love them once I demonstrate how they work.

guenthert 6y ago
Price. Yubikey's "best seller" goes for $45, that's grotesque. I would be surprised if the hardware costs exceeds $2 per unit and the software (or similar) can be had for free.
- bsder 6y ago
  It's not about the hardware. In spite of the fact that they can nominally be broken into, most modern USB microcontrollers can easily implement being a security key. The expense is that the security world hasn't converged on anything remotely approaching a single standard. So, a key has to support ... PGP, OpenSSH, FIDO, FIDO2, U2F ... For example, you couldn't use some of the older YubiKeys with AWS because AWS only supported time-based TOTP. That's a LOT of software work, and you can't be "Startup Sloppy" with your code or someone will break it.
  - upofadown 6y ago
    The PGP thing is wildly different than the other applications in that it is a complete airgapped system on a key. The decryption and signing is actually done on key so the private key isn't exposed. PGP is pretty much the only thing that does this and as a result can be held up as an example of where we do in fact have a unique standard.

ak217 6y ago

> I’m not a moderator, but I ask you to please try to better further the discussion with future comments. Please don't go there. You're both adding to the discussion, maybe some strong words here and there, but this turn of phrase you used is a huge conversation destroyer.