4 ms·
The vulnerability allows extracting the secret key from a vulnerable device. If I remember correctly, it's after a successful auth / sign flow, which requires t
by Sayrus 2y ago
The vulnerability allows extracting the secret key from a vulnerable device. If I remember correctly, it's after a successful auth / sign flow, which requires the login/password of the target website.
I could give you my security key and you'll be able to login once. If you can extract the key, then you could login without the security key. In the context of a targeted attack, that could heavily change the impact.
- Y_Y 2y agoIf you're paranoid, of course, you're not going to trust a key that's left your possession, even if you get it back later. One it's gone it should be revoked permanently.
- chrisjj 2y agoThat presumes you'd know.
- Y_Y 2y agoIt does. If you can get my yubikey off my keyring while it's in my pocket and put it back on without my noticing then I don't know how I can defend against that.
- nativeit 2y agoSort of like how several plot points of the last Mission: Impossible movie could have been thwarted by a zipper.
- chrisjj 2y ago... in hindsight :)
- chrisjj 2y ago> If you can get my yubikey off my keyring while it's in my pocket and put it back on without my noticing Yubikey security advisory: "Due to software vulnerability, always store in pocket". :)
- GoblinSlayer 2y agoWhat is your job where you need to give your key to lieutenant Chang daily?
- water-data-dude 2y agoAnd you can store things like your PGP keys on there. I use mine for code signing, ssh, and encryption. For me it’d just be a PITA, since I don’t operate in a very sensitive or valuable area, but it could be a nightmare for someone who signs code a lot of people use, for example.