3 ms·
If your recovery mechanism completely bypasses the benefits of using the YubiKey, that recovery mechanism is what your attackers will use. At this point the Yu
by xvector 3y ago
If your recovery mechanism completely bypasses the benefits of using the YubiKey, that recovery mechanism is what your attackers will use.
At this point the YubiKeys only provide some measure of convenience. It's disingenuous for the blogpost to paint this as some meaningful security improvement if Okta Verify is the fallback. Feels like such a waste of time and effort to build something worthwhile and then undermine it just like that.
- bombcar 3y agoThey want to have the ease of use AND the benefits - which can’t really happen. You need to have a reliable and secure backup if you want to deploy yubikeys - or limit accounts that have been recovered until they’re revert fixed.
- netheril96 3y ago> If your recovery mechanism completely bypasses the benefits of using the YubiKey, that recovery mechanism is what your attackers will use. I don't use any methods other than YubiKey when I do have my keys. So attackers cannot trick me. If I see a choice without Yubikeys I immediately know I'm being phished.
- bombcar 3y agoWe’re talking about what happens if you lose your keys. If all I need to do is call and say “this is netheril96” and they’ll give me access, the yubikey is theatre.