12 ms·
I used to be very pro yubikey for a long time but have mostly concluded it doesn't really solve any of the problems people think it solves. It basically just pr
by foobiekr 4y ago
I used to be very pro yubikey for a long time but have mostly concluded it doesn't really solve any of the problems people think it solves. It basically just provides a (1) a means to prove that you have access to a key, which isn't actually yubikey dependent, and (2) a way to demonstrate that said key is bound to a hardware device that makes it hard to steal/exfiltrate.
People are incredibly laissez faire about their yubikeys - leaving them plugged in, leaving them on their keys, etc. They are an obvious DOS vulnerability.
Another basic issue that key theft is actually mostly not a real attack that matters for most people.
Spearphishing and faked sites are handled by any password manager worth using. If your threat is protection from key loggers, either don't use a wired keyboard or you are likely in a place where your local device is assumed to be already compromised (by the logger and probably a RAT) so now things like session cookies theft, TOCTOU swapping between authenticated operations, etc. are all in scope and the yubikey offers essentially nothing.
On top of that, most sites that "support FIDO", including google, will almost always be configured to fall back to other means.
It does allow one to make a clever device into a shibboleth, though.
- Hamuko 4y agoWhat's wrong with having your Yubikeys on your keys?
- foobiekr 4y agoEvil maid attacks for pin theft, stolen YubiKey and denial of service, etc. it depends on whether you’re one of the people who leaves their keys sitting on their desk.
- konha 4y ago> People are incredibly laissez faire about their yubikeys - leaving them plugged in, leaving them on their keys, etc. You can (should) protect your YubiKey with a pin. They will lock/reset after a couple of failed attempts. > On top of that, most sites that "support FIDO", including google, will almost always be configured to fall back to other means. Google accounts can be configured to require hardware tokens for 2FA without fallback to less secure methods. [0] Apple has a similar program. [1] [0] https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ [1] https://support.apple.com/en-us/HT212520 https://support.apple.com/en-us/HT212520
- trompetenaccoun 4y agoFair enough but at that point, why not just use a software based PW manager?
- foobiekr 4y agoYes, you can configure google that way. People mostly don’t, however. Yes, you can (and should) configure a pin. Now you have a DOS problem.