3 ms·

> also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... May I humbly suggest you RT

> also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... May I humbly suggest you RTFM before posting FUD. You can set a PIN on the Yubikey (or on the Yubikey Bio's, your fingerprint). Further, the PIN will block after three failed attempts, requiring the PUK to reset the PIN. Key loggers are of course defeated by the Yubikey's touch requirement (which you can make mandatory for all actions irrespective of time between actions, i.e. a no temporary cache policy). Hence your "security risk" is non-existent.

throwaway290 4y ago
Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? if so keyloggers would work as before
- fooker 4y ago
  One of the modes of operations does go in as keyboard inputs, so yes. The other mode is like a smart card afaik.
- hamandcheese 4y ago
  For FIDO, I don't think so. That said, if someone can install a key logger, they can probably just steal all your session cookies.
- traceroute66 4y ago
  > Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? It only uses the keyboard in the OTP mode[1] (which you don't have to use, and you can even configure to completely disable). I guess OTP mode is probably the one you were thinking of ? To be honest other than the Yubico demo website, I've never come across a resource in the wild that uses Yubikey OTP mode login anyway. :) I'm not familiar with the technicalities of OTP mode but I'm guessing its resilient to replay attacks, so key loggers could still be limited that way. For all other modes (PIV, FIDO, PGP) it doesn't. I believe there is an option to store a static string in the Yubikey and replay that on-demand when you touch it ... but, well, I'd say you're on your own if you choose that option ! [1] https://developers.yubico.com/OTP/OTPs_Explained.html https://developers.yubico.com/OTP/OTPs_Explained.html
  - quacksilver 4y ago
    Anecdotal, though about half of services that I have used only support Yubikeys with OTP mode. PingID does and I think Lastpass does too. I don't use either of them through choice though...
  - estebank 4y ago
    > To be honest other than the Yubico demo website, I've never come across a resource in the wild that uses Yubikey OTP mode login anyway. :) I've seen it used in terminal applications.
  - philsnow 4y ago
    > To be honest other than the Yubico demo website, I've never come across a resource in the wild that uses Yubikey OTP mode login anyway. :) A company I worked at years ago used Pritunl as its VPN (which uses OpenVPN under the hood), with Yubico OTP configured. It was a good-enough UX, and the user enrollment procedure downloads a certificate for connecting to OpenVPN which only works for one user, so when people inevitably spammed their Yubico OTPs into Slack, you couldn't use those to log in to the VPN as them since you wouldn't have their certificate. A keylogger would probably be able to access the certificate. To get around that you'd need to do something completely out of band like acknowledge a push notification on an authenticator app on the user's phone.
xracy 4y ago
Sorry... but... like... How is that not 2FA? You moved one of the factors. The possible factors are: Something you know Something you are Something you have Choose 2. A PIN would be something you know A fingerprint would be something you are. The key is something you have. I'm saying in the post that we're never going to just a passkey for this. And the yubikeys I have used in the past have all been just "something you have".

throwaway290 4y ago

Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? if so keyloggers would work as before

fooker 4y ago
One of the modes of operations does go in as keyboard inputs, so yes. The other mode is like a smart card afaik.
hamandcheese 4y ago
For FIDO, I don't think so. That said, if someone can install a key logger, they can probably just steal all your session cookies.
traceroute66 4y ago
> Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? It only uses the keyboard in the OTP mode[1] (which you don't have to use, and you can even configure to completely disable). I guess OTP mode is probably the one you were thinking of ? To be honest other than the Yubico demo website, I've never come across a resource in the wild that uses Yubikey OTP mode login anyway. :) I'm not familiar with the technicalities of OTP mode but I'm guessing its resilient to replay attacks, so key loggers could still be limited that way. For all other modes (PIV, FIDO, PGP) it doesn't. I believe there is an option to store a static string in the Yubikey and replay that on-demand when you touch it ... but, well, I'd say you're on your own if you choose that option ! [1] https://developers.yubico.com/OTP/OTPs_Explained.html https://developers.yubico.com/OTP/OTPs_Explained.html
- quacksilver 4y ago
  Anecdotal, though about half of services that I have used only support Yubikeys with OTP mode. PingID does and I think Lastpass does too. I don't use either of them through choice though...
- estebank 4y ago
  > To be honest other than the Yubico demo website, I've never come across a resource in the wild that uses Yubikey OTP mode login anyway. :) I've seen it used in terminal applications.
- philsnow 4y ago
  > To be honest other than the Yubico demo website, I've never come across a resource in the wild that uses Yubikey OTP mode login anyway. :) A company I worked at years ago used Pritunl as its VPN (which uses OpenVPN under the hood), with Yubico OTP configured. It was a good-enough UX, and the user enrollment procedure downloads a certificate for connecting to OpenVPN which only works for one user, so when people inevitably spammed their Yubico OTPs into Slack, you couldn't use those to log in to the VPN as them since you wouldn't have their certificate. A keylogger would probably be able to access the certificate. To get around that you'd need to do something completely out of band like acknowledge a push notification on an authenticator app on the user's phone.

xracy 4y ago

Sorry... but... like... How is that not 2FA? You moved one of the factors. The possible factors are: Something you know Something you are Something you have Choose 2. A PIN would be something you know A fingerprint would be something you are. The key is something you have. I'm saying in the post that we're never going to just a passkey for this. And the yubikeys I have used in the past have all been just "something you have".