3 ms·
What's the risk from replacing YubiKeys with software that relies on the internal security chips in modern computers? My most cited paper was used by the origi
by Syzygies 5y ago
What's the risk from replacing YubiKeys with software that relies on the internal security chips in modern computers?
My most cited paper was used by the original BitCoin paper, so I can attempt to listen to a security argument. I have yet to hear anyone justify external USB key security when computers have security chips. I also follow the progress in provably correct programming; saying we're too stupid to allow the computer to handle it isn't a compelling argument. Write some provably correct secure code for this!
I would so love to see Duo and YubiKey go out of business. However, if they had been more respectful of my time, I wouldn't have this thought.
My college and university both require multifactor authentication for logins required by my daily work. They have chosen Duo Two Factor Authentication, preferring that I find my phone and launch Duo's app for each login. YubiKeys are supported as an alternative. I have a YubiKey in each of five machines; I'm no more willing to move around a single YubiKey than I am willing to find my phone.
Duo's implementation requires numerous extraneous mouse clicks. They don't autodetect if a registered YubiKey is already present. Rather, they present a global default choice of YubiKey, and force a click for the dialog that supports then tapping a YubiKey. If one doesn't change the selection, one gets an error message that the YubiKey isn't registered, when it is; it's there on the original menu. Duo doesn't accept direct user feedback, further ingratiating me with my IT department when I file reports about this.
I'm starting to feel that this is all deliberate obfuscation, to draw attention away from having to tap the YubiKey, which is security theater a company like Apple cold put out of business in a heartbeat. I'd go to prison for life for kidnapping, but when a corporation dilutes this same harm, stealing five seconds each daily from many users, it gets excused as incompetence. The kind of incompetence Steve Jobs would never tolerate if he were alive.
Most people are extraordinarily clumsy with computers, expecting random mouse work. I embrace agility tasks while cooking, but I take extreme umbrage at this clumsy interface being forced on me every day. My first memory of school was a student teacher leaving the classroom in tears after I taught half the class to play Simon Says backwards. I didn't take the time to customize QMK firmware for my keyboards, only to have some CEO I've never met force me to play Simon Says.
If one wanted to automate tapping a YubiKey, it just needs a connection to ground while it flashes, which would be a cute Arduino-class project.
- Forbo 5y agoHow does recovering from a broken/lost/stolen device work in this scenario? I'm assuming it's the same as other MFA methods, namely using a recovery code that was given at the time of enrollment, or am I wrong in that line of thinking?
- rootusrootus 5y agoRecovery code or another key. You can enroll multiple keys. As long as you have one of them, you can use your access to disenroll the broken/lost/whatever key and enroll a replacement. I have one key that I keep with me, and another that I keep in my safe. If I lose both, I'll use a recovery code that I keep in an encrypted vault online (as well as in my safe in paper form, but assuming that whatever destroyed the key in the safe also destroyed the list of codes in the safe...)