4 ms·

Part of the problem is that right now the most convenient use of things like yubikeys is that the most convenient use of them is just leave them in your compute

by xracy 3y ago

Part of the problem is that right now the most convenient use of things like yubikeys is that the most convenient use of them is just leave them in your computer wherever they may be. That makes them a pretty hard sell for any workplace environment, but also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... Seems like 2FA is the future...

Helmut10001 3y ago
I also decided against yubikey and for Password manager + 2FA (TOTP), for this reason.
trollied 3y ago
Passkey can also use biometrics, if supported by the OS/browser.
hackernewds 3y ago
The weakest link in security system will always be the humans expected to keep them secure
md_ 3y ago
This is an extraordinarily bad take. :) - The biggest threat almost all users face is in the form of remote attackers: password phishing, database leaks + password reuse, tricking users into installing malware, etc. Local attackers are so far down the list of concerns that, really, using unique passwords and storing them on Post-Its is, for most people, an improvement in security! - Leaving a Yubikey in the computer is, in fact, the normal, intended mode of operation--that's why Yubico makes low-profile keys that you can just leave in your USB port. Yes, an attacker can just steal the key, but the key alone is insufficient to authenticate in most uses; almost all relying parties using keys that don't support user verification will also require a password. - The article was about passkeys, not FIDO security keys. Subtle difference, but, importantly, passwordless authn using passkeys requires the authenticator to support "user verification" mode (like a PIN/screenlock/biometric).
- swiftcoder 3y ago
  > The biggest threat almost all users face is in the form of remote attackers I'm not sure what users you interact with most on a regular basis, but for a pretty significant portion of the population, the most likely threats to their online (and offline) safety are jealous boyfriends/spouses/parents
  - brazzy 3y ago
    Actually a valid point, but if you're gonna be that condescending about someone not considering that part of the population you should have something better than weasel words to argue how big it is.
    - ghaff 3y ago
      You certainly have to consider your situation. If you live alone or with someone you trust (who you want to have access to your accounts if something happens to you), writing down passwords on paper and sticking that in a drawer or in some book on a bookshelf somewhere is likely pretty reasonable. Maybe have them backed up in an encrypted file in the cloud someplace as well. Live in a house with a bunch of other people out of school? Extended family some of which you don't get along with in and out of the house a lot? Certainly for work stuff in an office. Probably not so much. The risk may not be that great in absolute terms but I'd absolutely think twice.
    - swiftcoder 3y ago
      > if you're gonna be that condescending about someone not considering that part of the population We're talking about somewhere around 65% of the overall population. Entirely ignoring women and children from your target market warrants a little condescention
- xracy 3y ago
  It's possible that I'm just missing the distinction here between passkeys and FIDO security keys. Because all of the things I'm seeing in this space fall into just one factor of authentication. I will point out that I explicitly called out 2FA as being necessary. And any of PIN/Biometric (not sure what screenlock is), seems like that 2nd factor to me. So if these are different things, then the rollout is going really rocky (on par with Wii vs. Wii U), and they should probably come up with a better naming schema.
traceroute66 3y ago
> also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... May I humbly suggest you RTFM before posting FUD. You can set a PIN on the Yubikey (or on the Yubikey Bio's, your fingerprint). Further, the PIN will block after three failed attempts, requiring the PUK to reset the PIN. Key loggers are of course defeated by the Yubikey's touch requirement (which you can make mandatory for all actions irrespective of time between actions, i.e. a no temporary cache policy). Hence your "security risk" is non-existent.
- throwaway290 3y ago
  Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? if so keyloggers would work as before
  - fooker 3y ago
    One of the modes of operations does go in as keyboard inputs, so yes. The other mode is like a smart card afaik.
  - hamandcheese 3y ago
    For FIDO, I don't think so. That said, if someone can install a key logger, they can probably just steal all your session cookies.
  - traceroute66 3y ago
    > Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? It only uses the keyboard in the OTP mode[1] (which you don't have to use, and you can even configure to completely disable). I guess OTP mode is probably the one you were thinking of ? To be honest other than the Yubico demo website, I've never come across a resource in the wild that uses Yubikey OTP mode login anyway. :) I'm not familiar with the technicalities of OTP mode but I'm guessing its resilient to replay attacks, so key loggers could still be limited that way. For all other modes (PIV, FIDO, PGP) it doesn't. I believe there is an option to store a static string in the Yubikey and replay that on-demand when you touch it ... but, well, I'd say you're on your own if you choose that option ! [1] https://developers.yubico.com/OTP/OTPs_Explained.html https://developers.yubico.com/OTP/OTPs_Explained.html
jeroenhd 3y ago
For most digital services, physical theft is one of your least concerns. Someone can just take your laptop and extract your session token, who even needs a Yubikey? The problem these keys solve is that humans suck at managing passwords. Password managers are nice, but they're also protected by passwords, and humans suck at using those protective passwords. I'm all for 2FA, but I'd like to see websites switch to key-then-password rather than password-then-key. Most people won't turn on 2FA and physical keys are a lot safer in today's world of leaked passwords galore than passwords. If you don't enable 2FA and default to using a key, you can still do the whole "forgot password" (or rather, "lost my key") routine to reset your authentication through email.
wkat4242 3y ago
It's not the same kind of risk. You need to enter a pin for most uses (limited number of attempts) and touch it to avoid remote exploitation. Using a keylogger and then stealing the key will work but it requires a lot more than stealing a password

by xracy 3y ago

Helmut10001 3y ago

I also decided against yubikey and for Password manager + 2FA (TOTP), for this reason.

trollied 3y ago

Passkey can also use biometrics, if supported by the OS/browser.

hackernewds 3y ago

The weakest link in security system will always be the humans expected to keep them secure

md_ 3y ago

This is an extraordinarily bad take. :) - The biggest threat almost all users face is in the form of remote attackers: password phishing, database leaks + password reuse, tricking users into installing malware, etc. Local attackers are so far down the list of concerns that, really, using unique passwords and storing them on Post-Its is, for most people, an improvement in security! - Leaving a Yubikey in the computer is, in fact, the normal, intended mode of operation--that's why Yubico makes low-profile keys that you can just leave in your USB port. Yes, an attacker can just steal the key, but the key alone is insufficient to authenticate in most uses; almost all relying parties using keys that don't support user verification will also require a password. - The article was about passkeys, not FIDO security keys. Subtle difference, but, importantly, passwordless authn using passkeys requires the authenticator to support "user verification" mode (like a PIN/screenlock/biometric).

swiftcoder 3y ago
> The biggest threat almost all users face is in the form of remote attackers I'm not sure what users you interact with most on a regular basis, but for a pretty significant portion of the population, the most likely threats to their online (and offline) safety are jealous boyfriends/spouses/parents
- brazzy 3y ago
  Actually a valid point, but if you're gonna be that condescending about someone not considering that part of the population you should have something better than weasel words to argue how big it is.
  - ghaff 3y ago
    You certainly have to consider your situation. If you live alone or with someone you trust (who you want to have access to your accounts if something happens to you), writing down passwords on paper and sticking that in a drawer or in some book on a bookshelf somewhere is likely pretty reasonable. Maybe have them backed up in an encrypted file in the cloud someplace as well. Live in a house with a bunch of other people out of school? Extended family some of which you don't get along with in and out of the house a lot? Certainly for work stuff in an office. Probably not so much. The risk may not be that great in absolute terms but I'd absolutely think twice.
  - swiftcoder 3y ago
    > if you're gonna be that condescending about someone not considering that part of the population We're talking about somewhere around 65% of the overall population. Entirely ignoring women and children from your target market warrants a little condescention
xracy 3y ago
It's possible that I'm just missing the distinction here between passkeys and FIDO security keys. Because all of the things I'm seeing in this space fall into just one factor of authentication. I will point out that I explicitly called out 2FA as being necessary. And any of PIN/Biometric (not sure what screenlock is), seems like that 2nd factor to me. So if these are different things, then the rollout is going really rocky (on par with Wii vs. Wii U), and they should probably come up with a better naming schema.

traceroute66 3y ago

> also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... May I humbly suggest you RTFM before posting FUD. You can set a PIN on the Yubikey (or on the Yubikey Bio's, your fingerprint). Further, the PIN will block after three failed attempts, requiring the PUK to reset the PIN. Key loggers are of course defeated by the Yubikey's touch requirement (which you can make mandatory for all actions irrespective of time between actions, i.e. a no temporary cache policy). Hence your "security risk" is non-existent.

throwaway290 3y ago
Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? if so keyloggers would work as before
- fooker 3y ago
  One of the modes of operations does go in as keyboard inputs, so yes. The other mode is like a smart card afaik.
- hamandcheese 3y ago
  For FIDO, I don't think so. That said, if someone can install a key logger, they can probably just steal all your session cookies.
- traceroute66 3y ago
  > Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? It only uses the keyboard in the OTP mode[1] (which you don't have to use, and you can even configure to completely disable). I guess OTP mode is probably the one you were thinking of ? To be honest other than the Yubico demo website, I've never come across a resource in the wild that uses Yubikey OTP mode login anyway. :) I'm not familiar with the technicalities of OTP mode but I'm guessing its resilient to replay attacks, so key loggers could still be limited that way. For all other modes (PIV, FIDO, PGP) it doesn't. I believe there is an option to store a static string in the Yubikey and replay that on-demand when you touch it ... but, well, I'd say you're on your own if you choose that option ! [1] https://developers.yubico.com/OTP/OTPs_Explained.html https://developers.yubico.com/OTP/OTPs_Explained.html

jeroenhd 3y ago

For most digital services, physical theft is one of your least concerns. Someone can just take your laptop and extract your session token, who even needs a Yubikey? The problem these keys solve is that humans suck at managing passwords. Password managers are nice, but they're also protected by passwords, and humans suck at using those protective passwords. I'm all for 2FA, but I'd like to see websites switch to key-then-password rather than password-then-key. Most people won't turn on 2FA and physical keys are a lot safer in today's world of leaked passwords galore than passwords. If you don't enable 2FA and default to using a key, you can still do the whole "forgot password" (or rather, "lost my key") routine to reset your authentication through email.

wkat4242 3y ago

It's not the same kind of risk. You need to enter a pin for most uses (limited number of attempts) and touch it to avoid remote exploitation. Using a keylogger and then stealing the key will work but it requires a lot more than stealing a password