3 ms·
A rouge employee could steal a physical key left lying out, much like they can steal keys from computers.
by surround 6y ago
A rouge employee could steal a physical key left lying out, much like they can steal keys from computers.
- hiq 6y agoThe point is that you would realize much sooner, since it's real theft, not copying.
- lanstin 6y agoNot necessarily in a company. Lots of inventory can be unaccounted for.
- MrManatee 6y agoBut it’s not enough to steal a blank YubiKey from the office storage room. You would have to steal some specific person’s activated YubiKey, and that person will notice it if they need the key regularly to do their job.
- dastx 6y agoSure, inventory is unaccounted for but you as an engineer knows it's not accounted for. So you go to IT, and you ask for a new one. IT revokes access of the original key, and gives you a new one. No one in that transaction cares if it was lost or stolen.
- sneak 6y agoYubikeys used to store gpg keys for use with gpg or ssh require a pin code to do any signing/decryption. You only get some limited number of pin attempts before it locks you out. A stolen key is useless for gpg/ssh.