3 ms·

The attack surface of yubikey vs a laptop you carry around is interesting. Nobody seems to reflect that if you physically steal the laptop, guess what, the usb

The attack surface of yubikey vs a laptop you carry around is interesting. Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen. Anybody using USB locks? If you are focussing on FIDO for password management, I am assuming you are protected against HID emulating devices, like a rubberducky or teensy flashed with some malware installing HID emulator. And you do use USB locks on your laptop, right? Right? Because if not then all that added layer of secure feelings is pointless from an operational security perspective, other than preventing shoulder surfing. And if you are using a FIDO key, you usually have to enter a password to use it anyways, so it does not really protect against that either. You could've just used a password manager with a LUKS encrypted system and you have the identical attack surface from an operational perspective.

wink 4y ago
That's only for the nano ones which I personally have never used. My large USB A Yubikey is in my pocket, with my keys. So unless someone is mugging me or also stealing my pants, nope.
p410n3 4y ago
That implies people leave it plugged in, which is not advisable. Also ignores the fact that these keys have certain phishing protections. 2fa will fail when you're on a cloned phishing page, so you can't enter your totp code in a fake site. I use mine ALONGSIDE a traditional encrypted pw manager
- nulbyte 4y ago
  Some people do leave then in. The Nanos are designed for exactly this behavior.
9dev 4y ago
I have one Yubikey tucked away at home, and another at my mothers a few hunder kilometres away; these are „last resort“ keys to my core accounts. For daily usage, I rely on iCloud Keychain with FaceID/TouchID and encrypted file systems on my devices. I’m pretty confident in this setup: You’d need to steal my laptop and my phone, get my fingerprint or face, or my password; yet you still can’t lock me out entirely, and chances are if I’m robbed, I’m going to reset everything right away.
nulbyte 4y ago
> Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen. I think that largely misses the point of having such a key. I have one, and I'm well aware that if my laptop is stolen, so is that key. But the point of it is not to protect the laptop from the outside; that's why my drive is encrypted. The point of that particular Yubikey is to secure passwords and authenticate to some websites, all of which requires either a PIN or more passwords, even after breaking the encryption of the drive itself. Then there's the fact that, if you steal my laptop, you're probably looking to sell it for cash. That is to say, threat models matter. If your a journalist in a hostile country, maybe other steps should be taken. But most of us here on a site called Hacker News aren't under such threats, romantic as they may be.
krisoft 4y ago
> Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen. Not in how I use it. I only connect my yubikey when I need it (rarely at that). > right? Right? Just generally don't do this. It comes of as unnecessarily aggressive. Instead you could say "Do use USB locks on your laptop, because ....". The "right? Right?" is not making your point more persuasive. > Because if not then all that added layer of secure feelings is pointless from an operational security perspectiv You are assuming all kind of things about the threat environment and the concerns the person has.
- InCityDreams 4y ago
  > Just generally don't do this. It comes of as unnecessarily aggressive. Instead you could say "Do use USB locks on your laptop, because ....". The "right? Right?" is not making your point more persuasive. Pot, kettle situation?
  - krisoft 4y ago
    I don't see it that way, but happy to be corrected. Please tell me which part do you feel is unnecessarily aggressive? Just the general concept of asking someone to communicate differently, or a particular part of my message?
pydry 4y ago
I had the same thought. HOTP or TOTP with a phone seem like a better bet for 2FA these days.
TacticalCoder 4y ago
> The attack surface of yubikey vs a laptop you carry around is interesting. If you use the term "Yubikey" to describe the simplest model of Yubikey and not as a generic term to describe these security keys. Both Yubikey and their competitors are offering more advanced models: models which aren't simply unlocked by a tap on the device. Then the attack surface compared to a laptop you carry around certainly becomes very interesting. The security key I use most (I've got several models) have their own tiny screen and are protected by a PIN and won't work anymore after three wrong PINs (and let's not shift the goalpost by discussing what happens if you forget your PIN, that's another subject). A friend of mine and his colleagues, sysadmins at a major ISP, all use "OnlyKey". They're protected by a PIN too (no screen but six digits on the security key). One PIN to register the security key, another PIN to auth. Then there are security keys, including Yubikeys, only unlocked by fingerprints: now we're talking about Ethan Hawke stealing your laptop, your security key and recreating your fingerprints from a glass he stole at the bar (it's not impossible, but we're very far from "we stole your laptop while the session was unlocked"). > like a rubberducky or teensy flashed with some malware installing HID emulator. Wait, what would a teensy used for nefarious purposes do here? You can't sniff what's inside the Yubikey. It's kinda the whole point: it's a challenge/response only answered by knowing a secret protected by the HSM on the Yubikey. There's nothing to sniff. If you didn't intercept and modify the key while the person registered on a service, you'll never be able to auth without unlocking the actual key which was used to register to the service. You may be able to sniff and relay the auth but you'd still not be able to extract the secret out of the security key. > Because if not then all that added layer of secure feelings is pointless from an operational security perspective I don't know: all the big security hacks we saw recently would all been stopped cold dead in their tracks had U2F/webauthn been used (like the, supposedly, Plex related on where one dev had a years old, compromised, version of Plex which was used to exploit his home computer, which then allowed to get inside the company's network for all was needed to log in to the company's network was to sniff a password). Google reports there have been zero break ins since years, since when they moved all their employees to mandatory U2F (then switched to webauthn and I take it now to passkeys?). I'm overall confused by your comment... What kind of attacks are you exactly talking about? Someone stealing your laptop then installing a teensy in your laptop and putting the laptop back in place, without you noticing? Or just someone stealing your laptop while the Yubikey is in it? Are you actually saying that because some Yubikey aren't protected by a PIN and because some people leave this model of Yubikey in their laptop at all times, all security keys don't offer any additional protection compared to a laptop being stolen?

wink 4y ago

That's only for the nano ones which I personally have never used. My large USB A Yubikey is in my pocket, with my keys. So unless someone is mugging me or also stealing my pants, nope.

p410n3 4y ago

That implies people leave it plugged in, which is not advisable. Also ignores the fact that these keys have certain phishing protections. 2fa will fail when you're on a cloned phishing page, so you can't enter your totp code in a fake site. I use mine ALONGSIDE a traditional encrypted pw manager

nulbyte 4y ago
Some people do leave then in. The Nanos are designed for exactly this behavior.

9dev 4y ago

I have one Yubikey tucked away at home, and another at my mothers a few hunder kilometres away; these are „last resort“ keys to my core accounts. For daily usage, I rely on iCloud Keychain with FaceID/TouchID and encrypted file systems on my devices. I’m pretty confident in this setup: You’d need to steal my laptop and my phone, get my fingerprint or face, or my password; yet you still can’t lock me out entirely, and chances are if I’m robbed, I’m going to reset everything right away.

nulbyte 4y ago

> Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen. I think that largely misses the point of having such a key. I have one, and I'm well aware that if my laptop is stolen, so is that key. But the point of it is not to protect the laptop from the outside; that's why my drive is encrypted. The point of that particular Yubikey is to secure passwords and authenticate to some websites, all of which requires either a PIN or more passwords, even after breaking the encryption of the drive itself. Then there's the fact that, if you steal my laptop, you're probably looking to sell it for cash. That is to say, threat models matter. If your a journalist in a hostile country, maybe other steps should be taken. But most of us here on a site called Hacker News aren't under such threats, romantic as they may be.

krisoft 4y ago

> Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen. Not in how I use it. I only connect my yubikey when I need it (rarely at that). > right? Right? Just generally don't do this. It comes of as unnecessarily aggressive. Instead you could say "Do use USB locks on your laptop, because ....". The "right? Right?" is not making your point more persuasive. > Because if not then all that added layer of secure feelings is pointless from an operational security perspectiv You are assuming all kind of things about the threat environment and the concerns the person has.

InCityDreams 4y ago
> Just generally don't do this. It comes of as unnecessarily aggressive. Instead you could say "Do use USB locks on your laptop, because ....". The "right? Right?" is not making your point more persuasive. Pot, kettle situation?
- krisoft 4y ago
  I don't see it that way, but happy to be corrected. Please tell me which part do you feel is unnecessarily aggressive? Just the general concept of asking someone to communicate differently, or a particular part of my message?

pydry 4y ago

I had the same thought. HOTP or TOTP with a phone seem like a better bet for 2FA these days.

TacticalCoder 4y ago

> The attack surface of yubikey vs a laptop you carry around is interesting. If you use the term "Yubikey" to describe the simplest model of Yubikey and not as a generic term to describe these security keys. Both Yubikey and their competitors are offering more advanced models: models which aren't simply unlocked by a tap on the device. Then the attack surface compared to a laptop you carry around certainly becomes very interesting. The security key I use most (I've got several models) have their own tiny screen and are protected by a PIN and won't work anymore after three wrong PINs (and let's not shift the goalpost by discussing what happens if you forget your PIN, that's another subject). A friend of mine and his colleagues, sysadmins at a major ISP, all use "OnlyKey". They're protected by a PIN too (no screen but six digits on the security key). One PIN to register the security key, another PIN to auth. Then there are security keys, including Yubikeys, only unlocked by fingerprints: now we're talking about Ethan Hawke stealing your laptop, your security key and recreating your fingerprints from a glass he stole at the bar (it's not impossible, but we're very far from "we stole your laptop while the session was unlocked"). > like a rubberducky or teensy flashed with some malware installing HID emulator. Wait, what would a teensy used for nefarious purposes do here? You can't sniff what's inside the Yubikey. It's kinda the whole point: it's a challenge/response only answered by knowing a secret protected by the HSM on the Yubikey. There's nothing to sniff. If you didn't intercept and modify the key while the person registered on a service, you'll never be able to auth without unlocking the actual key which was used to register to the service. You may be able to sniff and relay the auth but you'd still not be able to extract the secret out of the security key. > Because if not then all that added layer of secure feelings is pointless from an operational security perspective I don't know: all the big security hacks we saw recently would all been stopped cold dead in their tracks had U2F/webauthn been used (like the, supposedly, Plex related on where one dev had a years old, compromised, version of Plex which was used to exploit his home computer, which then allowed to get inside the company's network for all was needed to log in to the company's network was to sniff a password). Google reports there have been zero break ins since years, since when they moved all their employees to mandatory U2F (then switched to webauthn and I take it now to passkeys?). I'm overall confused by your comment... What kind of attacks are you exactly talking about? Someone stealing your laptop then installing a teensy in your laptop and putting the laptop back in place, without you noticing? Or just someone stealing your laptop while the Yubikey is in it? Are you actually saying that because some Yubikey aren't protected by a PIN and because some people leave this model of Yubikey in their laptop at all times, all security keys don't offer any additional protection compared to a laptop being stolen?