4 ms·
> At that point, the victim will merely believe that their Yubikey is broken; and/or the attacker will have enough time to use the Yubikey. For example, I have
by SahAssar 2y ago
> At that point, the victim will merely believe that their Yubikey is broken; and/or the attacker will have enough time to use the Yubikey. For example, I have two Yubikeys. Someone could sneak into my house, swap my spare, and I wouldn't figure it out until I go to use my spare.
You can inspect a yubikeys identity with `ykman list` so you can easily have checks to check if a yubikey is broken or actually swapped. If you have high security requirements you can do this periodically and/or have the physical location of the spare be physically secured.
> use something a little more secure than a Yubikey
For a hardware authenticator what would that be?
- gwbas1c 2y ago> You can inspect a yubikeys identity with Who's going to do that? Most of the time, when I use my Yubikey, I'm using it in a text field in a website. But, to quote https://news.ycombinator.com/item?id=41439400 https://news.ycombinator.com/item?id=41439400 > Seriously, it's trivial to fry a key and swap it with the working spare if you have access to it So all an attacker needs to do is swap my Yubikey with a fried one. Maybe someone will figure it out if they're tracking the numbers written on the outside.
- SahAssar 2y ago> Who's going to do that? The point is that if you require more security there are tools to check it. For me I'm comfortable enough that an attack requires physical access to my keys, so I don't. > Maybe someone will figure it out if they're tracking the numbers written on the outside. So if your opsec requires it keep track of which keys you have and their identities. If one is fried remove it from all the services you authenticate with. I'm not saying its perfect but you can create practices/procedures that protect (or at least let you know it happened) from most realistic attacks.