4 ms·

Thanks for sharing! The main limitation of the Yubikey is that the firmware is closed source and potentially even backdoored. Otherwise the construction and f

• wkat4242 4y ago
  The Yubikey firmware is open but the problem is that you can't overwrite it anymore. They did this during the Yubikey NEO age, the first ones could still be updated. They say they did it to avoid authentication bypass attacks which makes sense but there should be other ways to do that. And the updatability keeps it current and also allows for verified builds. About a year after they changed it though there was a huge vulnerability in the Yubikey where it failed to actually check the pincode making the security useless. Which proved locking the firmware was a bad idea IMO. They ended up having to replace tons of them which could have been updated. I was hoping they'd bring updatable firmware back but they didn't.
  • aborsy 4y ago
    Yeah, the thought that Yubikey may not require PIN in some cases is scary. It’s like a GPG key without a password in home directory. Not only it will be useless, but actually harmful. For such reasons, I have been searching for alternatives. It seems other products have other issues.