4 ms·

The reason hardware 2fa keys like yubikeys are unphishable is that the browser controls the usb communication with the hardware key and passes the origin of the

The reason hardware 2fa keys like yubikeys are unphishable is that the browser controls the usb communication with the hardware key and passes the origin of the page to it - the page itself can't spoof an origin. But with WebUSB a page _can_ communicate directly to a yubikey and pretend it's being asked to authenticate on a different origin. It's been fixed now but it was an interesting bypass: - https://www.yubico.com/support/issue-rating-system/security-advisories/ysa-2018-02/ https://www.yubico.com/support/issue-rating-system/security-... - https://www.wired.com/story/chrome-yubikey-phishing-webusb/ https://www.wired.com/story/chrome-yubikey-phishing-webusb/

dheera 4y ago
Hmm this might not quite be WebUSB territory but it would be interesting to put a Yubikey in the cloud so it could be accessed from anywhere.
- dsfgagdsaf 4y ago
  what is interesting about that, and what purpose would it serve?
  - dheera 4y ago
    If you're far away from home, get mugged, you have nothing left on your person, and you need to get help, what do you do? You have no cash, no wallet, no cards, no phone, no yubikey, nothing. There's a public library next door where you can use an internet terminal to log into your Google Voice and G-mail and send an e-mail for help or call your family without needing cash on hand. Those websites enforce 2FA, so this is the solution to that. (I realize this breaks the premise of 2FA, but it will get you back safely, which is probably more important on your Maslow hierarchy than some infosec policy.)
- djbeadle 4y ago
  I've written this comment before bu what you need is a remotely controlled finger for pressing YubiKeys: https://bert.org/2020/10/01/pressing-yubikeys/ https://bert.org/2020/10/01/pressing-yubikeys/
  - LecroJS 4y ago
    This is hilarious. The “final thoughts” section really hit home for me. Thanks for sharing
- mrtesthah 4y ago
  Isn't that just like storing a PassKey in iCloud Keychain?
- scrollaway 4y ago
  This gets us back to TOTP seeds in password managers. IMO that's a good model; physical stuff gets lost, broken, stolen, etc (hence one reason why you should not rely on SMS: It relies on a physical SIM card, and a physical device). What is the advantage of yubikey over TOTP in that scenario though?

dheera 4y ago

Hmm this might not quite be WebUSB territory but it would be interesting to put a Yubikey in the cloud so it could be accessed from anywhere.

dsfgagdsaf 4y ago
what is interesting about that, and what purpose would it serve?
- dheera 4y ago
  If you're far away from home, get mugged, you have nothing left on your person, and you need to get help, what do you do? You have no cash, no wallet, no cards, no phone, no yubikey, nothing. There's a public library next door where you can use an internet terminal to log into your Google Voice and G-mail and send an e-mail for help or call your family without needing cash on hand. Those websites enforce 2FA, so this is the solution to that. (I realize this breaks the premise of 2FA, but it will get you back safely, which is probably more important on your Maslow hierarchy than some infosec policy.)
djbeadle 4y ago
I've written this comment before bu what you need is a remotely controlled finger for pressing YubiKeys: https://bert.org/2020/10/01/pressing-yubikeys/ https://bert.org/2020/10/01/pressing-yubikeys/
- LecroJS 4y ago
  This is hilarious. The “final thoughts” section really hit home for me. Thanks for sharing
mrtesthah 4y ago
Isn't that just like storing a PassKey in iCloud Keychain?
scrollaway 4y ago
This gets us back to TOTP seeds in password managers. IMO that's a good model; physical stuff gets lost, broken, stolen, etc (hence one reason why you should not rely on SMS: It relies on a physical SIM card, and a physical device). What is the advantage of yubikey over TOTP in that scenario though?