4 ms·

> Other than the risks inherent in any USB device, what's the worst that could happen? A cloned device might let an attacker have a duplicate key. But that's us

> Other than the risks inherent in any USB device, what's the worst that could happen? A cloned device might let an attacker have a duplicate key. But that's useless unless they also have your username and password. So if this isn't a risk ("it's useless") then doesn't that automatically imply that there are no benefits of using a Yubikey? edit: To add, this comment is in reply to the final question of the article "What's the worst thing that can be done with a compromised Yubikey?". My answer being, the risk would be that you think you are using 2FA but you "aren't".

dmurray 5y ago
You are using 2FA. If just one of your two factors is compromised, that doesn't mean you "aren't" using 2FA - just that there exists an attacker who is one step closer to breaking into your account. Any attack on 2FA requires the same attacker to compromise your password and your physical device. If one adversary phishes your password and someone else finds the YubiKey you dropped on the train, you're almost certainly still OK. You need to ask whether there's a reasonable threat model where the same guy gets your password and also gets you to use his own fake key.
- xenocratus 5y ago
  > the same guy gets your password and also gets you to use his own fake key. The article started from an event happening at a conference. I haven't been at many, but I assume: 1) at some you have a badge identifying you; 2) even if you don't, depending on who you are, it could be easy to identify you from other sources. At that point, if your identity is revealed and you're using the fake token, you're no longer using 2FA. This is not the same as "some guy finding your lost token on a train", unless, of course, that person saw you losing it and knows who you are, but even then - if you lose your token, you wouldn't/shouldn't keep using your spare... I mean, if you get a notification from HIBP that some password has been compromised on some account, I assume you'd change it, you wouldn't just go "meh, I have 2FA, why bother". Why would you ever keep on using a (potentially) fake Yubikey?
- waffleiron 5y ago
  But the author argues, and sets up the following scenario: >A cloned device might let an attacker have a duplicate key. But that's useless unless they also have your username and password. That even in case there is a cloned device, it's not an issue because you still have your password.
sascha_sl 5y ago
Or the USB device could turn into literally anything else, from an ethernet interface to a keyboard. This is a classic case of overthinking your threat model and missing the more obvious attack vectors. And for enterprises that want to make sure people enroll with genuine keys (as they sometimes also use these keys as physical access tokens), they can already use the factory-set OTP slot (the one with the cc instead of vv code) to check if a token is actually from Yubico.

dmurray 5y ago

You are using 2FA. If just one of your two factors is compromised, that doesn't mean you "aren't" using 2FA - just that there exists an attacker who is one step closer to breaking into your account. Any attack on 2FA requires the same attacker to compromise your password and your physical device. If one adversary phishes your password and someone else finds the YubiKey you dropped on the train, you're almost certainly still OK. You need to ask whether there's a reasonable threat model where the same guy gets your password and also gets you to use his own fake key.

xenocratus 5y ago
> the same guy gets your password and also gets you to use his own fake key. The article started from an event happening at a conference. I haven't been at many, but I assume: 1) at some you have a badge identifying you; 2) even if you don't, depending on who you are, it could be easy to identify you from other sources. At that point, if your identity is revealed and you're using the fake token, you're no longer using 2FA. This is not the same as "some guy finding your lost token on a train", unless, of course, that person saw you losing it and knows who you are, but even then - if you lose your token, you wouldn't/shouldn't keep using your spare... I mean, if you get a notification from HIBP that some password has been compromised on some account, I assume you'd change it, you wouldn't just go "meh, I have 2FA, why bother". Why would you ever keep on using a (potentially) fake Yubikey?
waffleiron 5y ago
But the author argues, and sets up the following scenario: >A cloned device might let an attacker have a duplicate key. But that's useless unless they also have your username and password. That even in case there is a cloned device, it's not an issue because you still have your password.

sascha_sl 5y ago

Or the USB device could turn into literally anything else, from an ethernet interface to a keyboard. This is a classic case of overthinking your threat model and missing the more obvious attack vectors. And for enterprises that want to make sure people enroll with genuine keys (as they sometimes also use these keys as physical access tokens), they can already use the factory-set OTP slot (the one with the cc instead of vv code) to check if a token is actually from Yubico.