3 ms·
Relevant bit: > Update: Ist sogar noch krasser, wie ein Leser anmerkt: > zu der Yubikey-Geschichte sei noch angemerkt, dass die aktuell sogar so dreist sind e
by SushiHippie 2y ago
Relevant bit:
> Update: Ist sogar noch krasser, wie ein Leser anmerkt:
> zu der Yubikey-Geschichte sei noch angemerkt, dass die aktuell sogar so dreist sind erstmal ihre Lagerbestände mit verwundbaren Keys abzuverkaufen anstatt die zu verschrotten. Hab neulich zwei von den Dingern bestellt (die teure FIPS-Variante!) und was bekomme ich geliefert? Die Keys mit der alten, verwundbaren Firmware. Hintergrund soll wohl sein, dass die zunächst Behörden und andere "priorisierte" Kunden mit den Keys mit der neuen Firmware beliefern.
Machine Translation:
> Update: It's even more extreme, as a reader points out:
> Regarding the Yubikey story, it should be noted that they are currently so brazen as to sell off their stock of vulnerable keys instead of scrapping them. I recently ordered two of those things (the expensive FIPS version!) and what do I get delivered? The keys with the old, vulnerable firmware. The background seems to be that they are initially supplying authorities and other "prioritized" customers with the keys that have the new firmware.
- snvzz 2y agowtf. And these YubiKey aren't exactly cheap. You'd expect the price to cover whatever they have to do on their end so that you do not receive a known vulnerable device.
- consp 2y agoAFAIK key extraction is not allowed by 140-2. Weird to call it FIPS approved.
- wlonkly 2y agoFIPS certified, which means a validation certificate exists. (And it does: https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3907 https://csrc.nist.gov/projects/cryptographic-module-validati..., issued 2021.)
- guenthert 2y agooff topic, but I'm so mesmerized, I can't help it -- the translation is just perfect, even though the original is ripe with colloquialism. Not too long ago, this was SciFi.
- SushiHippie 2y agoSame didn't want to shill, but I used Kagi Translate https://news.ycombinator.com/item?id=42080012 https://news.ycombinator.com/item?id=42080012
- palata 2y agoI agree that it would look bad if Yubico pretended to send patched keys and instead sent the vulnerable ones (which this anonymous reader seems to claim). But I think it would deserve more than an anonymous, unverified claim. For what I see, on Yubico's store it says which version of the firmware I am ordering.
- MaKey 2y agoThe product page of the FIPS series shows firmware 5.4. However, it doesn't say that this is a firmware with a known vulnerability.
- wlonkly 2y agoOh, this is even more complicated -- getting FIPS certification is not a fast process, so the only FIPS-certified Yubikeys at present are the vulnerable ones. Their FIPS 140-3 certificaton process started... huh, yesterday, apparently: https://www.yubico.com/blog/yubico-submits-yubikey-5-fips-series-for-fips-140-3-validation/ https://www.yubico.com/blog/yubico-submits-yubikey-5-fips-se... FIPS certification is never the thing you want if you don't specifically need that certificate number. There are two certified firmware versions, 5.4.2 and 5.4.3, and if you get a FIPS key that's what you're getting. https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3907 https://csrc.nist.gov/projects/cryptographic-module-validati...