6 ms·

So I’ve been thinking about this for a good long while now and I’m not really sure whether this increases the security of your account or not. On one hand, you

So I’ve been thinking about this for a good long while now and I’m not really sure whether this increases the security of your account or not. On one hand, you can’t accidentally or absent-mindedly approve a request from someone else on your phone with a YubiKey. On the other hand, with device 2FA you generally need to be present (Face or Touch). If someone were to steal your yubikey then they’d be able to perform a step that previously you’d have needed to be there for. I’m guessing MFA (password + presence + YubiKey) is too much of a catastrophic lockout risk to be supported.

kube-system 4y ago
You could get the bio version of the Yubikey. Or some other FIDO2 key with biometrics.
TacticalCoder 4y ago
> If someone were to steal your yubikey then they’d be able to perform a step that previously you’d have needed to be there for. Several security keys are protected themselves with an additional factor. There are, for example, Yubikeys which are unlocked by your fingerprint: this now requires the thief to not only steal your Yubikey but also have the skills required to reproduce your fingerprint. There are also several U2F devices protected by a PIN. The "Only key" uses one PIN to register a service (which you do once per service) and another PIN to authenticate to the service (so you cannot easily be tricked into registering instead of authenticating). The Ledger Nano U2F app is also protected by a PIN and has its own little screen so it displays the name (or the identifier) of the service you're either registering or authenticating to (and tells you if you're actually going to register or authenticate), is protected by a HSM and factory resets itself after three wrong PIN. I'm using the later to SSH now (requires a moderately recent version of OpenSSH: latest Debian stable is sufficient for example).
- jay-barronville 4y ago
  > this now requires the thief to not only steal your Yubikey but also have the skills required to reproduce your fingerprint. Or the thief can “steal” a couple of your fingers too and have unlimited access to your fingerprints. Oh, wait, is that just a movie thing?
  - nighthawk454 4y ago
    There's always a bigger threat model... but yeah in general that's probably not the weakest link. https://xkcd.com/538/ https://xkcd.com/538/
acdha 4y ago
If your Yubikey is configured to use a PIN, you have to unlock it to use it for this service. You can use a number tools such as this one to set a PIN: https://www.yubico.com/support/download/yubikey-manager/ https://www.yubico.com/support/download/yubikey-manager/
ecesena 4y ago
All FIDO keys support a PIN. It’s off by default when using them as 2FA because you already insert a password, but you can turn it on. It’s also required for passkeys or generally when using security keys as single factor.
- dwaite 4y ago
  > All FIDO keys support a PIN CTAP 2 compatible keys, e.g. FIDO 2 (certified or not). Older U2F-only keys won't support a PIN.
HyperSane 4y ago
Yubico makes a key with a fingerprint sensor. And you can use a PIN. https://www.yubico.com/product/yubikey-c-bio/ https://www.yubico.com/product/yubikey-c-bio/
- 8fingerlouie 4y ago
  I wish people would understand that biometrics are great for identification, but not for authentification. In the case of fingerprints, you leave them on pretty much everything you touch, meaning obtaining a copy of your fingerprint in most cases is just a question of stealing the glass you were drinking from at the bar. It's the equivalent of leaving little notes with your password everywhere you go.
  - actualwitch 4y ago
    It is there for convenience, if you need something more secure you can set up pin on your key, apple uses it.
  - HyperSane 4y ago
    Some of the most secure fingerprint sensors check for the temperature of the finger and/or detect the pulse.

kube-system 4y ago

You could get the bio version of the Yubikey. Or some other FIDO2 key with biometrics.

TacticalCoder 4y ago

> If someone were to steal your yubikey then they’d be able to perform a step that previously you’d have needed to be there for. Several security keys are protected themselves with an additional factor. There are, for example, Yubikeys which are unlocked by your fingerprint: this now requires the thief to not only steal your Yubikey but also have the skills required to reproduce your fingerprint. There are also several U2F devices protected by a PIN. The "Only key" uses one PIN to register a service (which you do once per service) and another PIN to authenticate to the service (so you cannot easily be tricked into registering instead of authenticating). The Ledger Nano U2F app is also protected by a PIN and has its own little screen so it displays the name (or the identifier) of the service you're either registering or authenticating to (and tells you if you're actually going to register or authenticate), is protected by a HSM and factory resets itself after three wrong PIN. I'm using the later to SSH now (requires a moderately recent version of OpenSSH: latest Debian stable is sufficient for example).

jay-barronville 4y ago
> this now requires the thief to not only steal your Yubikey but also have the skills required to reproduce your fingerprint. Or the thief can “steal” a couple of your fingers too and have unlimited access to your fingerprints. Oh, wait, is that just a movie thing?
- nighthawk454 4y ago
  There's always a bigger threat model... but yeah in general that's probably not the weakest link. https://xkcd.com/538/ https://xkcd.com/538/

acdha 4y ago

If your Yubikey is configured to use a PIN, you have to unlock it to use it for this service. You can use a number tools such as this one to set a PIN: https://www.yubico.com/support/download/yubikey-manager/ https://www.yubico.com/support/download/yubikey-manager/

ecesena 4y ago

All FIDO keys support a PIN. It’s off by default when using them as 2FA because you already insert a password, but you can turn it on. It’s also required for passkeys or generally when using security keys as single factor.

dwaite 4y ago
> All FIDO keys support a PIN CTAP 2 compatible keys, e.g. FIDO 2 (certified or not). Older U2F-only keys won't support a PIN.

HyperSane 4y ago

Yubico makes a key with a fingerprint sensor. And you can use a PIN. https://www.yubico.com/product/yubikey-c-bio/ https://www.yubico.com/product/yubikey-c-bio/

8fingerlouie 4y ago
I wish people would understand that biometrics are great for identification, but not for authentification. In the case of fingerprints, you leave them on pretty much everything you touch, meaning obtaining a copy of your fingerprint in most cases is just a question of stealing the glass you were drinking from at the bar. It's the equivalent of leaving little notes with your password everywhere you go.
- actualwitch 4y ago
  It is there for convenience, if you need something more secure you can set up pin on your key, apple uses it.
- HyperSane 4y ago
  Some of the most secure fingerprint sensors check for the temperature of the finger and/or detect the pulse.