6 ms·

I don’t buy into the “passwordless” designs. A fingerprint scanner might be better then a touch sensor but in the end it’s still a single factor. I meet a lot

I don’t buy into the “passwordless” designs. A fingerprint scanner might be better then a touch sensor but in the end it’s still a single factor. I meet a lot of people who bought yubikey nanos and leave them plugged in all the time. Defeats the purpose. There should be a kiosk where you can exchange people’s unattended yubikeys for a cookie or some other treat. That would take care of that problem.

ghostpepper 5y ago
Doesn't Yubikey design them to be left plugged in all the time? I don't see how it compromises the security at all
- packetslave 5y ago
  Depends on which Yubikey. The nano series (aka the "gnubby") are designed to be permanently plugged in. The 5 and 5C are designed to live on your keyring.
arianvanp 5y ago
When Webauthn requests user verification on a non-bio yubikey user needs to provide a (6 digit) pin.
_zoltan_ 5y ago
it absolutely does not defeat the purpose: if you somehow manage to get my password/ssh key _remotely_, there is still one more obstacle you cannot get as it's _local only_. that is why it's a second factor. something you know with something you have. I'd say this covers the 99% of how credentials are being misappropriated.
loosescrews 5y ago
The yubikeys are designed to be non-clonable, so it is two factors: something you have and something you are. Not all factors are created equal, and in the past there have been issues with biometrics not really being a reliable indicator of something you are.
- eh4545b4 5y ago
  What do you do if the hardware fails, or gets melted in a fire?
  - xxpor 5y ago
    You keep a spare somewhere. Everything that does U2F IME allows you to register at least 2 tokens.
    - bsder 5y ago
      Except AWS, no?
      - ecnahc515 5y ago
        Correct, but for AWS, you can use SSO and delegate the MFA to your SSO provider.
        Spivak 5y ago
        In AWS you must delegate your MFA to the SSO provider. Having an SSO provider but AWS managed MFA isn’t even possible because SSO users map to roles instead of IAM users.
        arianvanp 5y ago
        It actually is. AWS SSO itself (so not on the IAM users level) supports user management too without an external SSO provider and actually _does_ allow multiple MFA devices unlike IAM. It's a giant hack but works!
      - staticassertion 5y ago
        Yep, super annoying, AWS doesn't allow you to register more than one MFA device.
    - bilalq 5y ago
OJFord 5y ago
It doesn't defeat the purpose (if you take it, they've lost a Factor and you still don't have enough of them) but it will certainly teach them to have more than one. (Aside: I have a story for another time about how I soft-bricked my first while finally getting around to setting up a second; that I've not yet quite recovered enough to properly tell...)
staticassertion 5y ago
Importantly though it's a good single factor. Passwords aren't good. 1. They get repeated. 2. They get phished. Even just as a single factor, even without a fingerprint reader, a yubikey is far superior to a password. Adding a biometric on top of that is wayyyy better than a password. Most of what MFA has done for us is actually just provide slightly better "A's". It's not the quantity that counts, it's the quality. Previously to reach a good quality we'd need multiple factors. We've reached a point now where we have standards for authentication that are strong, often "strong enough", even with a single factor. A password then becomes a bit of a bonus.
- deleted 5y ago
  [deleted]

ghostpepper 5y ago

Doesn't Yubikey design them to be left plugged in all the time? I don't see how it compromises the security at all

packetslave 5y ago
Depends on which Yubikey. The nano series (aka the "gnubby") are designed to be permanently plugged in. The 5 and 5C are designed to live on your keyring.

arianvanp 5y ago

When Webauthn requests user verification on a non-bio yubikey user needs to provide a (6 digit) pin.

_zoltan_ 5y ago

it absolutely does not defeat the purpose: if you somehow manage to get my password/ssh key _remotely_, there is still one more obstacle you cannot get as it's _local only_. that is why it's a second factor. something you know with something you have. I'd say this covers the 99% of how credentials are being misappropriated.

loosescrews 5y ago

The yubikeys are designed to be non-clonable, so it is two factors: something you have and something you are. Not all factors are created equal, and in the past there have been issues with biometrics not really being a reliable indicator of something you are.

eh4545b4 5y ago
What do you do if the hardware fails, or gets melted in a fire?
- xxpor 5y ago
  You keep a spare somewhere. Everything that does U2F IME allows you to register at least 2 tokens.
  - bsder 5y ago
    Except AWS, no?
    - ecnahc515 5y ago
      Correct, but for AWS, you can use SSO and delegate the MFA to your SSO provider.
      - Spivak 5y ago
        In AWS you must delegate your MFA to the SSO provider. Having an SSO provider but AWS managed MFA isn’t even possible because SSO users map to roles instead of IAM users.
        arianvanp 5y ago
        It actually is. AWS SSO itself (so not on the IAM users level) supports user management too without an external SSO provider and actually _does_ allow multiple MFA devices unlike IAM. It's a giant hack but works!
    - staticassertion 5y ago
      Yep, super annoying, AWS doesn't allow you to register more than one MFA device.
  - bilalq 5y ago

OJFord 5y ago

It doesn't defeat the purpose (if you take it, they've lost a Factor and you still don't have enough of them) but it will certainly teach them to have more than one. (Aside: I have a story for another time about how I soft-bricked my first while finally getting around to setting up a second; that I've not yet quite recovered enough to properly tell...)

staticassertion 5y ago

Importantly though it's a good single factor. Passwords aren't good. 1. They get repeated. 2. They get phished. Even just as a single factor, even without a fingerprint reader, a yubikey is far superior to a password. Adding a biometric on top of that is wayyyy better than a password. Most of what MFA has done for us is actually just provide slightly better "A's". It's not the quantity that counts, it's the quality. Previously to reach a good quality we'd need multiple factors. We've reached a point now where we have standards for authentication that are strong, often "strong enough", even with a single factor. A password then becomes a bit of a bonus.

deleted 5y ago
[deleted]