4 ms·
> You can inspect a yubikeys identity with Who's going to do that? Most of the time, when I use my Yubikey, I'm using it in a text field in a website. But, to
by gwbas1c 2y ago
> You can inspect a yubikeys identity with
Who's going to do that? Most of the time, when I use my Yubikey, I'm using it in a text field in a website.
But, to quote https://news.ycombinator.com/item?id=41439400 https://news.ycombinator.com/item?id=41439400
> Seriously, it's trivial to fry a key and swap it with the working spare if you have access to it
So all an attacker needs to do is swap my Yubikey with a fried one. Maybe someone will figure it out if they're tracking the numbers written on the outside.
- SahAssar 2y ago> Who's going to do that? The point is that if you require more security there are tools to check it. For me I'm comfortable enough that an attack requires physical access to my keys, so I don't. > Maybe someone will figure it out if they're tracking the numbers written on the outside. So if your opsec requires it keep track of which keys you have and their identities. If one is fried remove it from all the services you authenticate with. I'm not saying its perfect but you can create practices/procedures that protect (or at least let you know it happened) from most realistic attacks.