9 ms·

Discord Rolled Out Yubikeys for All Employees

84 points by tjwds 3y ago

throwaway1777 3y ago
Ok… Thought they would’ve already done this by now.
- xvector 3y ago
  I have worked for some big tech companies that don't bother to use YubiKeys or hardware tokens for some of their most security-critical systems.
  - er4hn 3y ago
    Case in point: Microsoft recently losing a critical signing key that definitely wasn't in an HSM.
xvector 3y ago
> We also instruct corporate users to set up Okta Verify for use only as a fallback MFA in the event that all their authenticators fail at once. This way, we never have user accounts lacking at least one strong form of multi-factor authentication. Might as well not use a YubiKey at all. This just eliminates the benefits a YubiKey would provide. This reminds me of the banks that offer TOTP with fallback to SMS - just turns the "security improvement" into a waste of time and effort. > We chose [Yubikey C NFC] for a few reasons: [...] 3. It doesn’t support OTP mode, so there’s no “Yubispam” to deal with I think it does support OTP mode? Using one of these right now and it definitely supports OTP. You can turn it off, but that's not particular to the C NFC. An aside: YubiKeys are great, I love them... but they need to have a display to show what, precisely, you're authenticating with, or signing, etc. You can never trust your computer's display - Ledger/Trezor's hardware wallets have the right idea. IMO current standards fall short in not providing this information to the hardware authenticator.
- bombcar 3y ago
  If there is a recovery mechanism that isn’t horribly annoying and secure, the yubikey is worthless.
  - xvector 3y ago
    If your recovery mechanism completely bypasses the benefits of using the YubiKey, that recovery mechanism is what your attackers will use. At this point the YubiKeys only provide some measure of convenience. It's disingenuous for the blogpost to paint this as some meaningful security improvement if Okta Verify is the fallback. Feels like such a waste of time and effort to build something worthwhile and then undermine it just like that.
    - bombcar 3y ago
      They want to have the ease of use AND the benefits - which can’t really happen. You need to have a reliable and secure backup if you want to deploy yubikeys - or limit accounts that have been recovered until they’re revert fixed.
    - netheril96 3y ago
      > If your recovery mechanism completely bypasses the benefits of using the YubiKey, that recovery mechanism is what your attackers will use. I don't use any methods other than YubiKey when I do have my keys. So attackers cannot trick me. If I see a choice without Yubikeys I immediately know I'm being phished.
      - bombcar 3y ago
        We’re talking about what happens if you lose your keys. If all I need to do is call and say “this is netheril96” and they’ll give me access, the yubikey is theatre.
- anotherhue 3y ago
  You can just turn off the OTP configuration. Alas IIRC they ship with it 'on' out of the box so you get the 'cccjgjgkhcbbirdrfdnlnghhfgrtnnlgedjlftrbdeut' nonsense (with a newline for real fun win chat) whenever you brush against your laptop while reaching for a coffee.
say_it_as_it_is 3y ago
> Step 1: get everyone and every app* (it’s never every app) into Okta You don't need to spend millions of dollars tethering your organization to a security identity provider to accomplish no more than what you already are doing without them. WebAuthn is not curing cancer. It's just another marketing scheme for authentication.
- mnd999 3y ago
  Okta seems super-dubious anyway. Didn’t it come out that they store passwords in plaintext and have internal superusers with access to multiple customers internal systems?
  - TheNewsIsHere 3y ago
    Unaffiliated with Okta. As I recall, they had some internal support people that had access to some extraordinary privileges given their role at Okta. I understood through the grapevine that could potentially negotiate it so their support teams didn’t have any kind of standing access or non-US-based access over your Okta deployment, but only if you paid enough money.
- kriops 3y ago
  WebAuthn makes you unphishable, so there’s that. But that’s not to say Okta needs to be in the loop.
  - slt2021 3y ago
    attackers are now creating fake Okta pages with <client name>.okta.com landing page and steal Okta user/pw
- androidbishop 3y ago
  Uh, what? 1. There are pretty damned good reasons to use a single sign on (SSO) authentication across all company resources. Managing multiple accounts for every employee across every service is a prohibitively burdensome and messy affair, error-prone, inconsistent in policy enforcement and quality of security, features that would difficult to roll out on your own, the list goes on. SSO is an absolute must in any modern organization. 2. WebAuthn just a marketing scheme? It's a pretty big jump forward in authentication security, protocol, user experience, etc. It eliminates passwords, the cornerstone of authentication for as long as computers have even had authentication, and the #1 cause for security breaches by far. It does away with the need for 2FA. It allows users to use a range of devices to easily authenticate themselves without the need to juggle credentials for every account they have. It uses public/private key cryptography, a robust standard for security for years, uniquely for each site, attested to prevent fake hosts from registering keys, and all automatically managed behind the scenes so nobody has to go through the painful song and dance of creating and managing their own keys anymore. And it does all of this with a universal and open protocol that is currently already baked into most browsers. Seems like a pretty big deal to me, and certainly a big enough deal for huge companies and services like Google, Github, Microsoft, etc. to have prioritized its development and rollout.
kwanbix 3y ago
What happens if a Yubikey breaks?
- lijok 3y ago
  You always issue 2
  - MadsRC 3y ago
    Do you though? It’s been my understanding that for corporate use, only a single one should be issued because: 1: There’s an establish support team in your org that can always issue a new one (except for a few edge cases, super critical things) 2: You can’t trust users with 2 devices For private use, nr. 1 would not be true so the recommendation rightly is to issue 2.
    - DANmode 3y ago
      Your manager holds your backup. If you're their number two, possibly you hold theirs.
      - eropple 3y ago
        I've never heard of this practice and would throw the book at anyone who implemented it in a shop I worked at. You keep both your keys, one securely and one at-the-ready.
        DANmode 3y ago
        This is fair, but I have to note, a little out of date for startups which can be 100% remote to the point of founders not having a home city, let alone one stable, secure place to stash a backup. Yes, safety deposit boxes. Yes, family, yes friends. Yes, attorneys. But also what I said initially.
    - darthwalsh 3y ago
      At Google the IT desk had a jar of Yubikey. You could just take and enroll however many you wanted.
birdyrooster 3y ago
Why not just use Touch-ID? I’m sure all of their employees use Macs anyways.
- AlphaCerium 3y ago
  > Here at Discord, we’ve got a healthy blend of MacOS, Windows, and Linux devices. Some users are on portable laptops; some are permanently docked. Some are even on desktops! Did you even read the article?
  - slabity 3y ago
    > Here at Discord, we’ve got a healthy blend of ... Linux devices. Given how long certain core functionality in Discord has been completely broken on Linux, I find this a little hard to believe.
    - askiiart 3y ago
      FWIW, with a Discord install from a .rpm made with RPM Outpost's discord rpm maker[1], Discord works perfectly for me on Fedora. The only issues I've had is when I used the flatpak. Though I do suppose Discord should take some flak for only providing .deb files. [1] https://github.com/RPM-Outpost/discord https://github.com/RPM-Outpost/discord P.S. I run a repo that provides Discord, ArmCord, th-ch/youtube-music, and appimagelauncher for Fedora: https://askiiart.net/repos/fedora/x86_64/askiiart.repo https://askiiart.net/repos/fedora/x86_64/askiiart.repo Well, it provides whatever I feel like adding. I'm a pretty bad maintainer, but Discord is always up-to-date, at least.
      - Macha 3y ago
        Does screen sharing with desktop audio work?
        askiiart 3y ago
        Yep, works perfectly. I had issues at some point, but it's fixed now.
pipe_connector 3y ago
How do you authenticate from a machine that isn't local to you? I don't do any work on my work-issued laptop, I use a powerful remote machine instead.
- visualphoenix 3y ago
  If the remote host is trusted, you just forward the gpg-agent over ssh to your remote host.
  - pipe_connector 3y ago
    Sorry, I think I missed something because the article doesn't mention GPG at all. How can you make a webauthn client defer to gpg-agent?
    - pxc 3y ago
      When GPG is your ssh agent, you can use RSA or ed25519 keys stored on a smartcard (like a Yubikey) to authenticate via SSH. It's generally preferable to use a `-sk` key type, though, by which the remote server can essentially enforce that you're using a smartcard and not a normal keypair backed by a file.
      - pipe_connector 3y ago
        Sure, I understand how to authenticate to my remote machine with a smartcard (and already do use this setup). I'm wondering how to authenticate to resources (over HTTP) from my remote machine while using webauthn.
        walth 3y ago
        Just -D 8080 on your SSH connection and use the local SOCKS5 proxy to tunnel all local web traffic via remote machine.
- deleted 3y ago
  [deleted]
hinata08 3y ago
> And, if you’re somebody who has a product that could support WebAuthn and/or passkeys better: please do! (we might even be building/planning this ourselves )! It's ironic, as users have been requesting that feature for years, and discord has been pushing back the whole time. https://support.discord.com/hc/en-us/community/posts/360031304832-Add-support-for-webauthn-authentication-Yubikeys-and-the-like https://support.discord.com/hc/en-us/community/posts/3600313... Instead, they did the infamous qr code, the new font, the new id that's often similar to the old one but without the #, and the like. The overly popular support page isn't even cited or mentioned in the article ! I can't understand the disconnect between the teams at discord and the users. For me, the teams are doing this blog post like they had the idea first because they're the best (when they have actually pushed back for so long). And not even acknowledging users is just disrespectful. It shows that Discord only involves them in the payment process, and ignore their suggestions whether they're good or bad (because they come from the users). At the same time, for any change, they post they're visionaries. And I'm sure their CVs go on about how they disrupted their workplace. (while they really did push back on this feature)
- jhgg 3y ago
  Yubikey support is coming soon to users and is being internally tested on staff right now. Also, I'm not sure what's given you the impression that there has been any push-back on the feature?
  - hinata08 3y ago
    the aforementioned feedback, that had close to 250 upvotes and stayed active for 3-4 years, actually never got a reply from Discord. It's in the 90 most upvoted stories, and in the 50 most commented stories of all times under Account & Server Management. And overall, only 15 of the 120 most upvoted stories on this board got a reply from Discord (including the 8 that were completed). (the top story is even funnier, as Discord didn't even reply to it, but comments were closed because there were too many.) When the board about yubikey was the most active, Discord maybe somehow replied to it by doing the opposite. Instead of increasing their security as users asked, they decided they would fancy lowering it and introduced QR codes, because services are no fun if they don't experience of wave of hacks. And now, they're not referring to anything from the past, but are cluelessly posting generic talk and external links on a blog post. Also, as throwaway1777 mentioned, hardware tokens for staff is definitely something that had to be done before the second half of the last decade. It's the standard in any company I work with nowadays. So, IMO, OP's blog post doesn't show how Discord is being innovative, it's just a statement of "sorry, we're catching up on security" and "was this a topic before ?" Thanks for the reply, anyway.
hnbear 3y ago
Did exactly this at my previous employer as part of a large plan to become effectively unphishable. With all auth requiring something physical, and no OTP anywhere. We deployed Yubikeys to every employee (5 Nanos), which went into a USB port on their MBPs and were told never to remove them. We rolled out Okta as well (similarly moving from GSuite). Definitely took some training initially, but after that employees are used to Okta + a Yubikey touch to authenticate to all the systems we used. Internal SSH as well used certs deployed onto the Yubis, to ensure SSH was physically backed. With hardware devices all remote managed through MDM, and enforcing access policies, and full disk encryption, along with the Yubis, you can end up with an incredible amount of protection again phishing and other remote attacks. Even lost hardware is protected, and can be remote wiped. After building all that infra, now I wish I had more Yubi support at home. So few serious services (eg. banking) that I care about support it. I can lock my Github with 2FA supporting Yubi keys,but not my bank, broker, mortgage, etc.

84 points by tjwds 3y ago

throwaway1777 3y ago

Ok… Thought they would’ve already done this by now.

xvector 3y ago
I have worked for some big tech companies that don't bother to use YubiKeys or hardware tokens for some of their most security-critical systems.
- er4hn 3y ago
  Case in point: Microsoft recently losing a critical signing key that definitely wasn't in an HSM.

xvector 3y ago

> We also instruct corporate users to set up Okta Verify for use only as a fallback MFA in the event that all their authenticators fail at once. This way, we never have user accounts lacking at least one strong form of multi-factor authentication. Might as well not use a YubiKey at all. This just eliminates the benefits a YubiKey would provide. This reminds me of the banks that offer TOTP with fallback to SMS - just turns the "security improvement" into a waste of time and effort. > We chose [Yubikey C NFC] for a few reasons: [...] 3. It doesn’t support OTP mode, so there’s no “Yubispam” to deal with I think it does support OTP mode? Using one of these right now and it definitely supports OTP. You can turn it off, but that's not particular to the C NFC. An aside: YubiKeys are great, I love them... but they need to have a display to show what, precisely, you're authenticating with, or signing, etc. You can never trust your computer's display - Ledger/Trezor's hardware wallets have the right idea. IMO current standards fall short in not providing this information to the hardware authenticator.

bombcar 3y ago
If there is a recovery mechanism that isn’t horribly annoying and secure, the yubikey is worthless.
- xvector 3y ago
  If your recovery mechanism completely bypasses the benefits of using the YubiKey, that recovery mechanism is what your attackers will use. At this point the YubiKeys only provide some measure of convenience. It's disingenuous for the blogpost to paint this as some meaningful security improvement if Okta Verify is the fallback. Feels like such a waste of time and effort to build something worthwhile and then undermine it just like that.
  - bombcar 3y ago
    They want to have the ease of use AND the benefits - which can’t really happen. You need to have a reliable and secure backup if you want to deploy yubikeys - or limit accounts that have been recovered until they’re revert fixed.
  - netheril96 3y ago
    > If your recovery mechanism completely bypasses the benefits of using the YubiKey, that recovery mechanism is what your attackers will use. I don't use any methods other than YubiKey when I do have my keys. So attackers cannot trick me. If I see a choice without Yubikeys I immediately know I'm being phished.
    - bombcar 3y ago
      We’re talking about what happens if you lose your keys. If all I need to do is call and say “this is netheril96” and they’ll give me access, the yubikey is theatre.
anotherhue 3y ago
You can just turn off the OTP configuration. Alas IIRC they ship with it 'on' out of the box so you get the 'cccjgjgkhcbbirdrfdnlnghhfgrtnnlgedjlftrbdeut' nonsense (with a newline for real fun win chat) whenever you brush against your laptop while reaching for a coffee.

say_it_as_it_is 3y ago

> Step 1: get everyone and every app* (it’s never every app) into Okta You don't need to spend millions of dollars tethering your organization to a security identity provider to accomplish no more than what you already are doing without them. WebAuthn is not curing cancer. It's just another marketing scheme for authentication.

mnd999 3y ago
Okta seems super-dubious anyway. Didn’t it come out that they store passwords in plaintext and have internal superusers with access to multiple customers internal systems?
- TheNewsIsHere 3y ago
  Unaffiliated with Okta. As I recall, they had some internal support people that had access to some extraordinary privileges given their role at Okta. I understood through the grapevine that could potentially negotiate it so their support teams didn’t have any kind of standing access or non-US-based access over your Okta deployment, but only if you paid enough money.
kriops 3y ago
WebAuthn makes you unphishable, so there’s that. But that’s not to say Okta needs to be in the loop.
- slt2021 3y ago
  attackers are now creating fake Okta pages with <client name>.okta.com landing page and steal Okta user/pw
androidbishop 3y ago
Uh, what? 1. There are pretty damned good reasons to use a single sign on (SSO) authentication across all company resources. Managing multiple accounts for every employee across every service is a prohibitively burdensome and messy affair, error-prone, inconsistent in policy enforcement and quality of security, features that would difficult to roll out on your own, the list goes on. SSO is an absolute must in any modern organization. 2. WebAuthn just a marketing scheme? It's a pretty big jump forward in authentication security, protocol, user experience, etc. It eliminates passwords, the cornerstone of authentication for as long as computers have even had authentication, and the #1 cause for security breaches by far. It does away with the need for 2FA. It allows users to use a range of devices to easily authenticate themselves without the need to juggle credentials for every account they have. It uses public/private key cryptography, a robust standard for security for years, uniquely for each site, attested to prevent fake hosts from registering keys, and all automatically managed behind the scenes so nobody has to go through the painful song and dance of creating and managing their own keys anymore. And it does all of this with a universal and open protocol that is currently already baked into most browsers. Seems like a pretty big deal to me, and certainly a big enough deal for huge companies and services like Google, Github, Microsoft, etc. to have prioritized its development and rollout.

kwanbix 3y ago

What happens if a Yubikey breaks?

lijok 3y ago
You always issue 2
- MadsRC 3y ago
  Do you though? It’s been my understanding that for corporate use, only a single one should be issued because: 1: There’s an establish support team in your org that can always issue a new one (except for a few edge cases, super critical things) 2: You can’t trust users with 2 devices For private use, nr. 1 would not be true so the recommendation rightly is to issue 2.
  - DANmode 3y ago
    Your manager holds your backup. If you're their number two, possibly you hold theirs.
    - eropple 3y ago
      I've never heard of this practice and would throw the book at anyone who implemented it in a shop I worked at. You keep both your keys, one securely and one at-the-ready.
      - DANmode 3y ago
        This is fair, but I have to note, a little out of date for startups which can be 100% remote to the point of founders not having a home city, let alone one stable, secure place to stash a backup. Yes, safety deposit boxes. Yes, family, yes friends. Yes, attorneys. But also what I said initially.
  - darthwalsh 3y ago
    At Google the IT desk had a jar of Yubikey. You could just take and enroll however many you wanted.

birdyrooster 3y ago

Why not just use Touch-ID? I’m sure all of their employees use Macs anyways.

AlphaCerium 3y ago
> Here at Discord, we’ve got a healthy blend of MacOS, Windows, and Linux devices. Some users are on portable laptops; some are permanently docked. Some are even on desktops! Did you even read the article?
- slabity 3y ago
  > Here at Discord, we’ve got a healthy blend of ... Linux devices. Given how long certain core functionality in Discord has been completely broken on Linux, I find this a little hard to believe.
  - askiiart 3y ago
    FWIW, with a Discord install from a .rpm made with RPM Outpost's discord rpm maker[1], Discord works perfectly for me on Fedora. The only issues I've had is when I used the flatpak. Though I do suppose Discord should take some flak for only providing .deb files. [1] https://github.com/RPM-Outpost/discord https://github.com/RPM-Outpost/discord P.S. I run a repo that provides Discord, ArmCord, th-ch/youtube-music, and appimagelauncher for Fedora: https://askiiart.net/repos/fedora/x86_64/askiiart.repo https://askiiart.net/repos/fedora/x86_64/askiiart.repo Well, it provides whatever I feel like adding. I'm a pretty bad maintainer, but Discord is always up-to-date, at least.
    - Macha 3y ago
      Does screen sharing with desktop audio work?
      - askiiart 3y ago
        Yep, works perfectly. I had issues at some point, but it's fixed now.

pipe_connector 3y ago

How do you authenticate from a machine that isn't local to you? I don't do any work on my work-issued laptop, I use a powerful remote machine instead.

visualphoenix 3y ago
If the remote host is trusted, you just forward the gpg-agent over ssh to your remote host.
- pipe_connector 3y ago
  Sorry, I think I missed something because the article doesn't mention GPG at all. How can you make a webauthn client defer to gpg-agent?
  - pxc 3y ago
    When GPG is your ssh agent, you can use RSA or ed25519 keys stored on a smartcard (like a Yubikey) to authenticate via SSH. It's generally preferable to use a `-sk` key type, though, by which the remote server can essentially enforce that you're using a smartcard and not a normal keypair backed by a file.
    - pipe_connector 3y ago
      Sure, I understand how to authenticate to my remote machine with a smartcard (and already do use this setup). I'm wondering how to authenticate to resources (over HTTP) from my remote machine while using webauthn.
      - walth 3y ago
        Just -D 8080 on your SSH connection and use the local SOCKS5 proxy to tunnel all local web traffic via remote machine.
deleted 3y ago
[deleted]

hinata08 3y ago

> And, if you’re somebody who has a product that could support WebAuthn and/or passkeys better: please do! (we might even be building/planning this ourselves )! It's ironic, as users have been requesting that feature for years, and discord has been pushing back the whole time. https://support.discord.com/hc/en-us/community/posts/360031304832-Add-support-for-webauthn-authentication-Yubikeys-and-the-like https://support.discord.com/hc/en-us/community/posts/3600313... Instead, they did the infamous qr code, the new font, the new id that's often similar to the old one but without the #, and the like. The overly popular support page isn't even cited or mentioned in the article ! I can't understand the disconnect between the teams at discord and the users. For me, the teams are doing this blog post like they had the idea first because they're the best (when they have actually pushed back for so long). And not even acknowledging users is just disrespectful. It shows that Discord only involves them in the payment process, and ignore their suggestions whether they're good or bad (because they come from the users). At the same time, for any change, they post they're visionaries. And I'm sure their CVs go on about how they disrupted their workplace. (while they really did push back on this feature)

jhgg 3y ago
Yubikey support is coming soon to users and is being internally tested on staff right now. Also, I'm not sure what's given you the impression that there has been any push-back on the feature?
- hinata08 3y ago
  the aforementioned feedback, that had close to 250 upvotes and stayed active for 3-4 years, actually never got a reply from Discord. It's in the 90 most upvoted stories, and in the 50 most commented stories of all times under Account & Server Management. And overall, only 15 of the 120 most upvoted stories on this board got a reply from Discord (including the 8 that were completed). (the top story is even funnier, as Discord didn't even reply to it, but comments were closed because there were too many.) When the board about yubikey was the most active, Discord maybe somehow replied to it by doing the opposite. Instead of increasing their security as users asked, they decided they would fancy lowering it and introduced QR codes, because services are no fun if they don't experience of wave of hacks. And now, they're not referring to anything from the past, but are cluelessly posting generic talk and external links on a blog post. Also, as throwaway1777 mentioned, hardware tokens for staff is definitely something that had to be done before the second half of the last decade. It's the standard in any company I work with nowadays. So, IMO, OP's blog post doesn't show how Discord is being innovative, it's just a statement of "sorry, we're catching up on security" and "was this a topic before ?" Thanks for the reply, anyway.

hnbear 3y ago

Did exactly this at my previous employer as part of a large plan to become effectively unphishable. With all auth requiring something physical, and no OTP anywhere. We deployed Yubikeys to every employee (5 Nanos), which went into a USB port on their MBPs and were told never to remove them. We rolled out Okta as well (similarly moving from GSuite). Definitely took some training initially, but after that employees are used to Okta + a Yubikey touch to authenticate to all the systems we used. Internal SSH as well used certs deployed onto the Yubis, to ensure SSH was physically backed. With hardware devices all remote managed through MDM, and enforcing access policies, and full disk encryption, along with the Yubis, you can end up with an incredible amount of protection again phishing and other remote attacks. Even lost hardware is protected, and can be remote wiped. After building all that infra, now I wish I had more Yubi support at home. So few serious services (eg. banking) that I care about support it. I can lock my Github with 2FA supporting Yubi keys,but not my bank, broker, mortgage, etc.