3 ms·

Missing from all this: a dedicated machine running Linux to set everything up. I have an old beat up Thinkpad that I use exclusively for critical stuff that wou

• lxgr 4y ago
  What's the benefit of that? The entire point of using a security key is that its security model can survive a point in time compromise of the device you are connecting it to, i.e. a compromise only persists as long as a (hopefully short-lived) session. But if a single session compromise is unacceptable to you, by the same token a security key can't protect you against that. The only instance where a "more secure" computer might be necessary that I can think of is using a GPG smartcard (which the Yubikey supports) and importing a software key to that, as opposed to generating the key on the smartcard itself.
  • twawaaay 4y ago
    Whatever security system you have there is always a problem of original sin. This is when attacker happens to be present and prepared to hijack your initialisation process. If an attacker has unrestricted access to your laptop or phone and you are trying to use this device to set up say your AWS root account, no amount of Yubikeys will help you. They can essentially craft everything you are seeing on the screen and intercept everything you are typing in. What they do with it only depends on their imagination but with the advent of AI powered tools I expect hacking tools are going to get much "smarter" very quickly. A coworker lost all money he saved for many years for the downpayment on his apartment. He used his laptop to manage his banking and his phone to receive SMS messages. He logged in to his banking from his phone JUST ONCE. That was enough. Apparently, he had some kind of malware on his phone that was waiting in hiding for this exact occasion and the moment he logged in it intercepted the credentials and was able to transfer money out of his account with the codes he got on the same phone. It wasn't even targeted attack. And it was 10 years ago. And as far as Yubikeys I would suggest they matter less than people think. They are useful concept but only if services providing MFA capability implemented it correctly. And as far as my experience goes, no large service I use at the moment implements this correctly. The biggest problems are usually defaulting to SMS/email code if you indicate you've lost your Yubikey. Even for services that don't do this, there is usually some way to recover access anyway. I have lost both my root password and two my yubikeys to my AWS account. Guess what, couple phonecalls later I got my access back. It was stupid for me to loose my credentials (but it was empty account at that time) but it is not inspiring confidence in me that anybody with just the access to my phone number and possibly couple scraps of personal information can recover full access. My strategy right now is to compartmentalise critical services that I use -- use separate device to access them, never use my other devices for this, use separate email and separate phone numbers. Never reveal to anybody the email and phone number. Never put anything that could create any interest for those services, emails, phone numbers, etc. Yubikeys are nice gimmick (that I use daily) but I honestly don't see them as doing much for my security.
    • lxgr 4y ago
      > If an attacker has unrestricted access to your laptop or phone and you are trying to use this device to set up say your AWS root account, no amount of Yubikeys will help you. They will absolutely help against a persistent compromise of my accounts. For example, I can check all registered security keys from a different machine and network. If only the ones I expect are present, I can click the (hopefully present) button "log out all sessions on all devices" and be reasonably certain that, at least from that point in time, nobody else has account access. And I can make sure that all of the ones present are in fact my keys by trying to authenticate with all of them. Registering a new key will hopefully also trigger a big scary warning email/SMS/fax to me and/or additional security contacts. > Even for services that don't do this, there is usually some way to recover access anyway. As a user, I sure hope there is – it would be genuinely frightening to know that my account is unrecoverable if I lose all security keys linked to it! Hopefully, that process involves a lot of red tape and not just an SMS-OTP or sending a blurry scan of my birth certificate to an e-notary several timezones away.
      • twawaaay 4y ago
        > Registering a new key will hopefully also trigger a big scary warning email/SMS/fax to me and/or additional security contacts If your devices are compromised you are not guaranteed to receive any emails or SMS. There are malwares known to remove emails and messages either directly or by running as man in the middle or by intercepting and modifying the UI. > As a user, I sure hope there is – it would be genuinely frightening to know that my account is unrecoverable if I lose all security keys linked to it! As a professional I am reading it the following way: "The access to the account can be regained without the super duper secure Yubikey fleet you have." Therefore it is as secure as that super expensive door lock when there is an open window right next to it. > Hopefully, that process involves a lot of red tape and not just an SMS-OTP or sending a blurry scan of my birth certificate to an e-notary several timezones away But that just does not happen. This would be super expensive and companies would rather limit their involvement with individual people to save on support cost. All I got from AWS was two phonecalls from a tired guy with obvious Indian accent.