7 ms·

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen of any of my devices either. Edit: There is a way to use a Yubikey to decrypt Linux full-disk encryption. It relies on an abandoned personal GitHub project. Sounds fun, but not sufficiently secure it's worth spending more than $100 to allegedly improve my security with it.

warent 4y ago
I think a huge benefit of 2fa, one of the main purposes of it, was for securing accounts with weak passwords. Back in the days before password managers etc. I think these days password managers actually deprecate the need for 2fa
- TrueGeek 4y ago
  Every now and then you hear about a leak at some company that was storing passwords in clear text. Thanks to password managers this only affects that one site, but it still makes me thankful for 2FA.
  - iudqnolq 4y ago
    I don't understand the threat model there. Wouldn't nearly all hacks that lead to plain text passwords also allow the hacker to access all the login-protected data, making a more secure login process pointless?
    - bb88 4y ago
      Not necessarily. It's common practice for a hacker to break into a site, grab the passwords, then sell them or release them on the dark web. The methods they used to break into the site are often considered "trade secrets".
- askvictor 4y ago
  Multiple layers are always better. If your computer or browser is compromised, then your password manager's secrets have been pwned, but with 2FA your accounts are still safe (assuming the 2FA is on a separate device, which it really should be) There's also non-tech users to consider. It's pretty hard to convince users to use a password manager; plenty of people still re-use the same password across sites. It's impossible to prevent that. But it is possible to enforce 2FA for _your_ site.
  - iudqnolq 4y ago
    Your first example is interesting, but it's much more limited than you describe. The attacker can't use your credentials to authenticate their own session, but they have complete control over the authenticated session on your laptop. I can't think of an account I have where that would be meaningfully less bad.
    - askvictor 4y ago
      The attacker has access to all of your authenticated sessions on your compromised laptop. They don't have access to any un-authenticated accounts which have 2FA enabled.
      - bb88 4y ago
        Further because 2FA is simpler, a session can time out in a shorter amount of time.
- dilyevsky 4y ago
  Wrong - mfa is to prevent credentials stuffing mostly
- bb88 4y ago
  Passwords are an antipattern. Password managers are just a crutch to make it less painful. Password recovery is often done through the phone via SMS (health care/banking) when a 2FA hardware key would be safer. And since you're implementing 2FA, just remove the password, and ask the user to use the 2FA key.
  - smeej 4y ago
    I think my favorite example of using SMS in the least sane way possible is PayPal. I have a hardware key AND an authenticator app active for the account, but they STILL won't let me send transactions without entering a code sent to my phone number. And actually, not even then, because even though I receive the code fine, they say they can't authenticate me and don't give me a chance to enter it. Yes, it's a VOIP number, but it's been the same VOIP number for the 10 years I've had the account. It's not like it's new.
    - bb88 4y ago
      I needed to recover my user account / password through Voya recently for a corporate 401k. They needed to send me 3(!) SMS messages in the process. One to get the username (with a valid email address). One more to request to change the password. And one more to actually change the password.
ivanhoe 4y ago
Can you define what do you mean by sufficient support?
- iudqnolq 4y ago
  Sure: Enough support so that my life becomes sufficiently easier or more secure to be worth the cost. I know that's a bit wishy-washy, but for example I think I could replace my memorized 1password password with something longer if I never had to enter it from memory, which would only be the case if I could use the Yubikey on all my devices.
  - akerl_ 4y ago
    I use a yubikey with x509 cert and PIN for local auth to my Mac, and I use it for FIDO2 MFA everywhere that supports it, which includes my email account. That makes my email credentials radically more resistant to phishing, which is huge given that email is part of the recovery story for every other account. If those aren’t enough, I guess yubikeys aren’t the right call for your threat model, which is fine.
    - iudqnolq 4y ago
      I'd love to have that setup. The only problem is insufficiently mature support for the devices I use, Linux and Android. As I mentioned in an edit Yubikey local auth on Linux relies on a personal GitHub project abandoned years ago.
      - jklfhfyhjlo 4y ago
        Bah, everything the GP described works perfectly in Linux. Yubikey local auth isn't just one Yubikey specific project. The Yubikey implements a fuckload of open protocols, the vast majority of which work perfectly in Linux. Want local authentication? pam_u2f, pam_gpg, pam_x509 are all maintained.
      - akerl_ 4y ago
        The other person who replied to this seems to have gotten up on the wrong side of the bed, but the core of their suggestion is one I’d likewise recommend. I’m doing the yubikey local auth using the yubikey’s PIV applet, which holds standard x509 certs that can be used via pkcs11. You should be able to set up PAM to use them in that way, without needing any yubikey-specific hijinks. Something like https://discourse.ubuntu.com/t/smart-card-authentication/26009 https://discourse.ubuntu.com/t/smart-card-authentication/260...
hamandcheese 4y ago
> No 2fa device has sufficient support that it could be used to unlock the lockscreen of any of my devices either. Remember, 2fa is your second factor. It’s right there in the acronym. It is there to protect against a bad actor stealing your password. By definition, a second factor won’t improve the ergonomics of logging in.
- iudqnolq 4y ago
  Not quite. A second factor would allow me to reduce the complexity of my password while retaining the same level of security. Without that the only benefit of a Yubikey over a strong password saved in a password manager is phishing protection, which I'm not willing to pay that amount of money for.
  - hamandcheese 4y ago
    Not just phishing - you could lose your password via malware, or if services store passwords in clear text and get hacked.
    - iudqnolq 4y ago
      I use different passwords for every service. Malware on a device where I'm logged into the service can use that authenticated session to access all the things I want protected. If the service is hacked, the hacker probably has direct access to everything the password was protecting.
      - hamandcheese 4y ago
        > Malware on a device where I'm logged into the service can use that authenticated session to access all the things I want protected. Any well-secured service should protect critical actions with 2fa. “oh, are you sure you want to transfer all your funds? Please re-authenticate first”
        snadal 4y ago
traceroute66 4y ago
> I can't figure out why I'd want a Yubikey. Do you use SSH ? Yubikeys are a fabulous way to store SSH keys. Also bear in mind that aside from a secure storage mechanism, Yubkeys can also be configured to require pin and/or touch. Therefore no matter what gets onto your computer, the Yubikey won't provide the answer unless touched.
- iudqnolq 4y ago
  > Do you use SSH Yes, but not for anything where keeping the SSH private key more secure than my AWS/DigitalOcean credentials would be useful. And I store those credentials in 1Password, which doesn't have a sufficiently mature integration with Yubikey on Linux or Android.
  - LelouBil 4y ago
    Use Bitwarden, it's a great password manager and it works with yubikey. You can also self host it fully.
wyager 4y ago
I use it for github, cloudflare, login.gov, etc.
themagician 4y ago
I love the Yubikey even if it only locks down a few important accounts. For me, that's Google Accounts and Microsoft Accounts. These are the accounts I worry about this most because they are linked to so many other things. I wish 1Password offered a high security, security key ONLY mode.
- waynesonfire 4y ago
  I agree, I wish 1password had more native yubikey support.
nick__m 4y ago
I use 1Password and 2 Yubikey. Both yubikeys are configured to enter the same impossible to memorize password on a press to unlock 1Password, hid mode is supported by every device with a USB ports. I also use them as an otp second factor when a site requires it. Finally, they are configured with a x509 certificate that I use as my ssh keys. I generate one key per devices that way the secret never leaves it and I require a pin to unlock the key. For convenience, I use an ssh agent to cache the pin I could also use them for pgp signature and encryption but I have no use case for that.
- taubek 4y ago
  How do you configure Yubikey to enter password for unlocking 1password? Is this a Yubikey feature or 1password feature? Does this also work with mobile devices (phones)?
  - loulouxiv 4y ago
    That is the hid mode parent is mentionning. With ykman you can configure the Yubikey to simulate being a USB keyboard (Human Interface Device) and then "type" a static password. The default setting is to type a Yubico specific OTP that can be checked by calling an API. The issue with the static password is that anybody getting near the yubikey with a device having a USB port can steal the password in seconds.
    - taubek 4y ago
      Thank you for explanation! I wasn't aware of this feature.
    - sig-io 4y ago
      And any accidental button-press while in a chat-app or website will leak your password. I've seen many yubikey otp's accidentally pasted into irc, if you set it to password, you just posted that. I'd never recommend using that mode.
      - 4y ago
Ferret7446 4y ago
Your phrasing is odd. 2FA devices do not support websites. Websites support 2FA options. The problem isn't 2FA devices, but services not supporting 2FA. U2F/FIDO are standard at this point and many tech-related services support them; certainly, effectively all 2FA devices support them. 2FA is redundant for unlocking physical devices. Access to the device itself is already a second factor. The point of 2FA is that someone MUST physically take something from you to gain access, which greatly limits attack vectors. If you use 2FA properly, the only thing you need to worry about for account security is whether you still have your 2FA key on you.
5d8767c68926 4y ago
The thing that trips me up is the ability to make backups in the event it is lost/stolen. Seemingly not all services allow registering an additional key, and even if they do, the practicalities of juggling redundant fobs would be cumbersome.
- Semaphor 4y ago
  > Seemingly not all services allow registering an additional key I’ve only ever encountered that braindead design with AWS, every other place allows multiple keys. And I can’t say I find multiple keys cumbersome, it’s simply the same procedure again: Click add, insert key and tap the button. Just twice instead of once.
  - 5d8767c68926 4y ago
    Specifically, I want a backup key off-site. Anytime I enroll a new service, I need to retrieve my backup key from storage for the purposes of enrolling. Depending on how/where the backup is stored (bank box, parent's house across the country, etc) that would make the system less workable in practice.
vertis 4y ago
I've found the Yubikey to be an incredibly easy way to do 2FA. I use a usb-c nano version and it pretty much never leaves my mac (and the mac never leaves me). I've found it faster to do 2FA on a large number of tech websites. Just touch the key and you're done. I know 1Password can fill TOTP for you, but I like having my security spread across 1Password and Yubikey. In the unlikely event 1Password gets compromised they still need physical access to my computer. I don't log onto the mac with Yubikey and it has full-disk encryption turned on, so I'm pretty happy with the attack surface.
ranguna 4y ago
> There is a way to use a Yubikey to decrypt Linux full-disk encryption. It relies on an abandoned personal GitHub project Abandoned? You do know luks supports FIDO, right? Here's a small guide on how to do it: https://prose.bentopais.pt/setting-up-trezor-on-arch#luks-unlock https://prose.bentopais.pt/setting-up-trezor-on-arch#luks-un... You'll also find how to use your key to login to the tty, authenticate to sudo commands and much more.
deleted 4y ago
[deleted]
xani_ 4y ago
You can use Yubikeys(most of them, the cheapest ones don't have that feature IIRC) as smartcards in addition to other features. You can use smartcard in linux as both GPG key, and SSH key (via GPG SSH agent). Which means leaking your private key for SSH is essentially impossible, as key can be generated on device which means it never leaves it, even if your machine gets compromised
waynesonfire 4y ago
I use it to store my gpg keys among other use-cases. The key provides a permanence and isolation. I can't accidentally delete it without trying and the button needs to be pressed to access the key. I like these trait.

warent 4y ago

I think a huge benefit of 2fa, one of the main purposes of it, was for securing accounts with weak passwords. Back in the days before password managers etc. I think these days password managers actually deprecate the need for 2fa

TrueGeek 4y ago
Every now and then you hear about a leak at some company that was storing passwords in clear text. Thanks to password managers this only affects that one site, but it still makes me thankful for 2FA.
- iudqnolq 4y ago
  I don't understand the threat model there. Wouldn't nearly all hacks that lead to plain text passwords also allow the hacker to access all the login-protected data, making a more secure login process pointless?
  - bb88 4y ago
    Not necessarily. It's common practice for a hacker to break into a site, grab the passwords, then sell them or release them on the dark web. The methods they used to break into the site are often considered "trade secrets".
askvictor 4y ago
Multiple layers are always better. If your computer or browser is compromised, then your password manager's secrets have been pwned, but with 2FA your accounts are still safe (assuming the 2FA is on a separate device, which it really should be) There's also non-tech users to consider. It's pretty hard to convince users to use a password manager; plenty of people still re-use the same password across sites. It's impossible to prevent that. But it is possible to enforce 2FA for _your_ site.
- iudqnolq 4y ago
  Your first example is interesting, but it's much more limited than you describe. The attacker can't use your credentials to authenticate their own session, but they have complete control over the authenticated session on your laptop. I can't think of an account I have where that would be meaningfully less bad.
  - askvictor 4y ago
    The attacker has access to all of your authenticated sessions on your compromised laptop. They don't have access to any un-authenticated accounts which have 2FA enabled.
    - bb88 4y ago
      Further because 2FA is simpler, a session can time out in a shorter amount of time.
dilyevsky 4y ago
Wrong - mfa is to prevent credentials stuffing mostly
bb88 4y ago
Passwords are an antipattern. Password managers are just a crutch to make it less painful. Password recovery is often done through the phone via SMS (health care/banking) when a 2FA hardware key would be safer. And since you're implementing 2FA, just remove the password, and ask the user to use the 2FA key.
- smeej 4y ago
  I think my favorite example of using SMS in the least sane way possible is PayPal. I have a hardware key AND an authenticator app active for the account, but they STILL won't let me send transactions without entering a code sent to my phone number. And actually, not even then, because even though I receive the code fine, they say they can't authenticate me and don't give me a chance to enter it. Yes, it's a VOIP number, but it's been the same VOIP number for the 10 years I've had the account. It's not like it's new.
  - bb88 4y ago
    I needed to recover my user account / password through Voya recently for a corporate 401k. They needed to send me 3(!) SMS messages in the process. One to get the username (with a valid email address). One more to request to change the password. And one more to actually change the password.

ivanhoe 4y ago

Can you define what do you mean by sufficient support?

iudqnolq 4y ago
Sure: Enough support so that my life becomes sufficiently easier or more secure to be worth the cost. I know that's a bit wishy-washy, but for example I think I could replace my memorized 1password password with something longer if I never had to enter it from memory, which would only be the case if I could use the Yubikey on all my devices.
- akerl_ 4y ago
  I use a yubikey with x509 cert and PIN for local auth to my Mac, and I use it for FIDO2 MFA everywhere that supports it, which includes my email account. That makes my email credentials radically more resistant to phishing, which is huge given that email is part of the recovery story for every other account. If those aren’t enough, I guess yubikeys aren’t the right call for your threat model, which is fine.
  - iudqnolq 4y ago
    I'd love to have that setup. The only problem is insufficiently mature support for the devices I use, Linux and Android. As I mentioned in an edit Yubikey local auth on Linux relies on a personal GitHub project abandoned years ago.
    - jklfhfyhjlo 4y ago
      Bah, everything the GP described works perfectly in Linux. Yubikey local auth isn't just one Yubikey specific project. The Yubikey implements a fuckload of open protocols, the vast majority of which work perfectly in Linux. Want local authentication? pam_u2f, pam_gpg, pam_x509 are all maintained.
    - akerl_ 4y ago
      The other person who replied to this seems to have gotten up on the wrong side of the bed, but the core of their suggestion is one I’d likewise recommend. I’m doing the yubikey local auth using the yubikey’s PIV applet, which holds standard x509 certs that can be used via pkcs11. You should be able to set up PAM to use them in that way, without needing any yubikey-specific hijinks. Something like https://discourse.ubuntu.com/t/smart-card-authentication/26009 https://discourse.ubuntu.com/t/smart-card-authentication/260...

hamandcheese 4y ago

> No 2fa device has sufficient support that it could be used to unlock the lockscreen of any of my devices either. Remember, 2fa is your second factor. It’s right there in the acronym. It is there to protect against a bad actor stealing your password. By definition, a second factor won’t improve the ergonomics of logging in.

iudqnolq 4y ago
Not quite. A second factor would allow me to reduce the complexity of my password while retaining the same level of security. Without that the only benefit of a Yubikey over a strong password saved in a password manager is phishing protection, which I'm not willing to pay that amount of money for.
- hamandcheese 4y ago
  Not just phishing - you could lose your password via malware, or if services store passwords in clear text and get hacked.
  - iudqnolq 4y ago
    I use different passwords for every service. Malware on a device where I'm logged into the service can use that authenticated session to access all the things I want protected. If the service is hacked, the hacker probably has direct access to everything the password was protecting.
    - hamandcheese 4y ago
      > Malware on a device where I'm logged into the service can use that authenticated session to access all the things I want protected. Any well-secured service should protect critical actions with 2fa. “oh, are you sure you want to transfer all your funds? Please re-authenticate first”
      - snadal 4y ago

traceroute66 4y ago

> I can't figure out why I'd want a Yubikey. Do you use SSH ? Yubikeys are a fabulous way to store SSH keys. Also bear in mind that aside from a secure storage mechanism, Yubkeys can also be configured to require pin and/or touch. Therefore no matter what gets onto your computer, the Yubikey won't provide the answer unless touched.

iudqnolq 4y ago
> Do you use SSH Yes, but not for anything where keeping the SSH private key more secure than my AWS/DigitalOcean credentials would be useful. And I store those credentials in 1Password, which doesn't have a sufficiently mature integration with Yubikey on Linux or Android.
- LelouBil 4y ago
  Use Bitwarden, it's a great password manager and it works with yubikey. You can also self host it fully.

wyager 4y ago

I use it for github, cloudflare, login.gov, etc.

themagician 4y ago

I love the Yubikey even if it only locks down a few important accounts. For me, that's Google Accounts and Microsoft Accounts. These are the accounts I worry about this most because they are linked to so many other things. I wish 1Password offered a high security, security key ONLY mode.

waynesonfire 4y ago
I agree, I wish 1password had more native yubikey support.

nick__m 4y ago

I use 1Password and 2 Yubikey. Both yubikeys are configured to enter the same impossible to memorize password on a press to unlock 1Password, hid mode is supported by every device with a USB ports. I also use them as an otp second factor when a site requires it. Finally, they are configured with a x509 certificate that I use as my ssh keys. I generate one key per devices that way the secret never leaves it and I require a pin to unlock the key. For convenience, I use an ssh agent to cache the pin I could also use them for pgp signature and encryption but I have no use case for that.

taubek 4y ago
How do you configure Yubikey to enter password for unlocking 1password? Is this a Yubikey feature or 1password feature? Does this also work with mobile devices (phones)?
- loulouxiv 4y ago
  That is the hid mode parent is mentionning. With ykman you can configure the Yubikey to simulate being a USB keyboard (Human Interface Device) and then "type" a static password. The default setting is to type a Yubico specific OTP that can be checked by calling an API. The issue with the static password is that anybody getting near the yubikey with a device having a USB port can steal the password in seconds.
  - taubek 4y ago
    Thank you for explanation! I wasn't aware of this feature.
  - sig-io 4y ago
    And any accidental button-press while in a chat-app or website will leak your password. I've seen many yubikey otp's accidentally pasted into irc, if you set it to password, you just posted that. I'd never recommend using that mode.
    - 4y ago

Ferret7446 4y ago

Your phrasing is odd. 2FA devices do not support websites. Websites support 2FA options. The problem isn't 2FA devices, but services not supporting 2FA. U2F/FIDO are standard at this point and many tech-related services support them; certainly, effectively all 2FA devices support them. 2FA is redundant for unlocking physical devices. Access to the device itself is already a second factor. The point of 2FA is that someone MUST physically take something from you to gain access, which greatly limits attack vectors. If you use 2FA properly, the only thing you need to worry about for account security is whether you still have your 2FA key on you.

5d8767c68926 4y ago

The thing that trips me up is the ability to make backups in the event it is lost/stolen. Seemingly not all services allow registering an additional key, and even if they do, the practicalities of juggling redundant fobs would be cumbersome.

Semaphor 4y ago
> Seemingly not all services allow registering an additional key I’ve only ever encountered that braindead design with AWS, every other place allows multiple keys. And I can’t say I find multiple keys cumbersome, it’s simply the same procedure again: Click add, insert key and tap the button. Just twice instead of once.
- 5d8767c68926 4y ago
  Specifically, I want a backup key off-site. Anytime I enroll a new service, I need to retrieve my backup key from storage for the purposes of enrolling. Depending on how/where the backup is stored (bank box, parent's house across the country, etc) that would make the system less workable in practice.

vertis 4y ago

I've found the Yubikey to be an incredibly easy way to do 2FA. I use a usb-c nano version and it pretty much never leaves my mac (and the mac never leaves me). I've found it faster to do 2FA on a large number of tech websites. Just touch the key and you're done. I know 1Password can fill TOTP for you, but I like having my security spread across 1Password and Yubikey. In the unlikely event 1Password gets compromised they still need physical access to my computer. I don't log onto the mac with Yubikey and it has full-disk encryption turned on, so I'm pretty happy with the attack surface.

ranguna 4y ago

> There is a way to use a Yubikey to decrypt Linux full-disk encryption. It relies on an abandoned personal GitHub project Abandoned? You do know luks supports FIDO, right? Here's a small guide on how to do it: https://prose.bentopais.pt/setting-up-trezor-on-arch#luks-unlock https://prose.bentopais.pt/setting-up-trezor-on-arch#luks-un... You'll also find how to use your key to login to the tty, authenticate to sudo commands and much more.

deleted 4y ago

[deleted]

xani_ 4y ago

You can use Yubikeys(most of them, the cheapest ones don't have that feature IIRC) as smartcards in addition to other features. You can use smartcard in linux as both GPG key, and SSH key (via GPG SSH agent). Which means leaking your private key for SSH is essentially impossible, as key can be generated on device which means it never leaves it, even if your machine gets compromised

waynesonfire 4y ago

I use it to store my gpg keys among other use-cases. The key provides a permanence and isolation. I can't accidentally delete it without trying and the button needs to be pressed to access the key. I like these trait.