3 ms·
> All YubiKey 5 Series (with firmware version below 5.7) are impacted by the attack … Oh, so I just need to update the firmware on the physical hardware token.
by xyst 2y ago
> All YubiKey 5 Series (with firmware version below 5.7) are impacted by the attack …
Oh, so I just need to update the firmware on the physical hardware token.
> YubiKey Firmware is Not Upgradable
https://support.yubico.com/hc/en-us/articles/360013708760-YubiKey-Firmware-is-Not-Upgradable https://support.yubico.com/hc/en-us/articles/360013708760-Yu...
L. So, Yubico is providing _free_ replacements, right?
I have a handful of these Yubikeys…
- hi-v-rocknroll 2y ago5.4.3 5C Nano here. > L. So, Yubico is providing _free_ replacements, right? Nope, mitigations. :( https://support.yubico.com/hc/en-us/articles/15705749884444-Infineon-ECDSA-Private-Key-Recovery-Customer-Resources https://support.yubico.com/hc/en-us/articles/15705749884444-...
- gwbas1c 2y agoYubikeys are intended to block phishing. This attack requires physical access. IE: If you're "worth it" to target IRL, you shouldn't use a Yubikey to begin with. Someone can swap your spare and you won't realize it until too late.
- anilakar 2y agoThe last time Infineon chips had a crypto-breaking bug, Estonians got new ID cards for free. Meanwhile my less than two months old Yubikey 4 stopped working as a hardware attested PIV smartcard.
- SahAssar 2y ago> Meanwhile my less than two months old Yubikey 4 stopped working as a hardware attested PIV smartcard. As in that the hardware broke? Or software stopped supporting it?
- anilakar 2y agoSoftware that keeps revocation lists (or whatever they are called) up to date stopped accepting keys generated on that hardware. The Yubikey itself continued to work just fine, but I had to switch to externally generated keys.
- SahAssar 2y agoUnless the software is maintained by yubico I don't think its fair to say that the key "stopped working".