3 ms·

The whole point of a YubiKey is that it can produce inextractable keys so it cannot be forged/cloned. Without that property, might as well use a < 1$ Arduino c

by nh2 2y ago

The whole point of a YubiKey is that it can produce inextractable keys so it cannot be forged/cloned. Without that property, might as well use a < 1$ Arduino clone that's 100x cheaper.

GoblinSlayer 2y ago
It's a matter of safeguards. If the arduino clone is remotely extractable, then you're not saving much.
- thanksgiving 2y ago
  That's the point. Yubikey can charge a premium on the assumption that what it sells is secure. If it sells old stock with known issues, what's the point? Also I returned my yubikey to my $work when my contract ended so I know at least Microsoft reuses these keys.
  - chrisjj 2y ago
    > Also I returned my yubikey to my $work when my contract ended so I know at least Microsoft reuses these keys. Or destroys them.
cuu508 2y ago
Are there < 1$ Arduino clones? How compatible are they with yubikeys? Are there any from trusted manufacturers? Any pointers?
- deleted 2y ago
  [deleted]
- drhuseynov 2y ago
  Not $1, but you can get a JavaCardOS card and upload a FIDO applet yourself https://github.com/token2/pin_plus_firmware https://github.com/token2/pin_plus_firmware https://github.com/BryanJacobs/FIDO2Applet https://github.com/BryanJacobs/FIDO2Applet Probably will cost 5USD
  - cuu508 2y ago
    Interesting, but "card" sounds like a different form factor, and Yubikeys do a fair but more than just FIDO2!
    - drhuseynov 2y ago
      JavaCardOS can run in a USB-form factor as well. But that will not be 5USD. https://usasmartcard.com/usb-token/?page=1 https://usasmartcard.com/usb-token/?page=1 In addition to FIDO2, you can add java applet for OpenPGP (also open source), TOTP (https://github.com/JavaCardOS/Oath-Applet https://github.com/JavaCardOS/Oath-Applet) and PIV/smartcard (open source as well). I tell you more - there are tons of JavaCardOS compatible applets available on github etc.
      - fmajid 2y ago
        The Yubikeys also support NFC, which is necessary for U2F authentication on Lightning iPhones.
        drhuseynov 2y ago
        Sorry I was not clear. Cards have NFC in any case. What is missing in cards is USB
- nh2 2y ago
  Note I'm talking "clone of the Arduino", not "Arduino-based clone of the YubiKey". My point was that if you don't need protection against key extraction, you can just get an ultra-cheap microcontroler and write code to do the crypto operations on them. This thread talks about sub-1$ Arduinos: https://old.reddit.com/r/arduino/comments/dixa9x/awesome_sub_1delivered_arduino_ide_compatible/ https://old.reddit.com/r/arduino/comments/dixa9x/awesome_sub... I can't speak to the quality of those, but my friend got some sub-1$ Arduionos in the past (not sure which) and said they worked.
palata 2y ago
Is it the whole point? My understanding is that this attack requires physical access to the key. Would a compromised computer be able to extract the key without physically having the key? My understanding is that it wouldn't. So having my private key on the Yubikey plugged into my computer is still safer than having the private key directly on the computer, right?
- nh2 2y ago
  Yes, but my point is you could also have any ultra-cheap device plugged into your computer that can run general-purpose crypto software and talk via USB, or your phone. You wouldn't have to pay > 50$ for a Yubikey.
  - palata 2y ago
    > my point is you could also have any ultra-cheap device plugged into your computer that can run general-purpose crypto software and talk via USB, But you would need this ultra-cheap device plugged into your computer to be resistant to your computer being compromised. Do you know such an off-the-shelf device? > or your phone Well your phone has a very large attack surface as compared to a Yubikey. > You wouldn't have to pay > 50$ for a Yubikey. Are you sure about that? I have a Nitrokey 3C NFC that cost more than my Yubikey, and the Nitrokey can be flashed from my computer. Meaning that if my computer is compromised, then my Nitrokey is compromised. It's not clear to me that 50$ is expensive for a product that is not used by half the world and doesn't collect the private data of its users. I understand the frustration with the security issue, but I find it unfair to say "I would do better for < 1$".

by nh2 2y ago

The whole point of a YubiKey is that it can produce inextractable keys so it cannot be forged/cloned. Without that property, might as well use a < 1$ Arduino clone that's 100x cheaper.

GoblinSlayer 2y ago

It's a matter of safeguards. If the arduino clone is remotely extractable, then you're not saving much.

thanksgiving 2y ago
That's the point. Yubikey can charge a premium on the assumption that what it sells is secure. If it sells old stock with known issues, what's the point? Also I returned my yubikey to my $work when my contract ended so I know at least Microsoft reuses these keys.
- chrisjj 2y ago
  > Also I returned my yubikey to my $work when my contract ended so I know at least Microsoft reuses these keys. Or destroys them.

cuu508 2y ago

Are there < 1$ Arduino clones? How compatible are they with yubikeys? Are there any from trusted manufacturers? Any pointers?

deleted 2y ago
[deleted]
drhuseynov 2y ago
Not $1, but you can get a JavaCardOS card and upload a FIDO applet yourself https://github.com/token2/pin_plus_firmware https://github.com/token2/pin_plus_firmware https://github.com/BryanJacobs/FIDO2Applet https://github.com/BryanJacobs/FIDO2Applet Probably will cost 5USD
- cuu508 2y ago
  Interesting, but "card" sounds like a different form factor, and Yubikeys do a fair but more than just FIDO2!
  - drhuseynov 2y ago
    JavaCardOS can run in a USB-form factor as well. But that will not be 5USD. https://usasmartcard.com/usb-token/?page=1 https://usasmartcard.com/usb-token/?page=1 In addition to FIDO2, you can add java applet for OpenPGP (also open source), TOTP (https://github.com/JavaCardOS/Oath-Applet https://github.com/JavaCardOS/Oath-Applet) and PIV/smartcard (open source as well). I tell you more - there are tons of JavaCardOS compatible applets available on github etc.
    - fmajid 2y ago
      The Yubikeys also support NFC, which is necessary for U2F authentication on Lightning iPhones.
      - drhuseynov 2y ago
        Sorry I was not clear. Cards have NFC in any case. What is missing in cards is USB
nh2 2y ago
Note I'm talking "clone of the Arduino", not "Arduino-based clone of the YubiKey". My point was that if you don't need protection against key extraction, you can just get an ultra-cheap microcontroler and write code to do the crypto operations on them. This thread talks about sub-1$ Arduinos: https://old.reddit.com/r/arduino/comments/dixa9x/awesome_sub_1delivered_arduino_ide_compatible/ https://old.reddit.com/r/arduino/comments/dixa9x/awesome_sub... I can't speak to the quality of those, but my friend got some sub-1$ Arduionos in the past (not sure which) and said they worked.

palata 2y ago

Is it the whole point? My understanding is that this attack requires physical access to the key. Would a compromised computer be able to extract the key without physically having the key? My understanding is that it wouldn't. So having my private key on the Yubikey plugged into my computer is still safer than having the private key directly on the computer, right?

nh2 2y ago
Yes, but my point is you could also have any ultra-cheap device plugged into your computer that can run general-purpose crypto software and talk via USB, or your phone. You wouldn't have to pay > 50$ for a Yubikey.
- palata 2y ago
  > my point is you could also have any ultra-cheap device plugged into your computer that can run general-purpose crypto software and talk via USB, But you would need this ultra-cheap device plugged into your computer to be resistant to your computer being compromised. Do you know such an off-the-shelf device? > or your phone Well your phone has a very large attack surface as compared to a Yubikey. > You wouldn't have to pay > 50$ for a Yubikey. Are you sure about that? I have a Nitrokey 3C NFC that cost more than my Yubikey, and the Nitrokey can be flashed from my computer. Meaning that if my computer is compromised, then my Nitrokey is compromised. It's not clear to me that 50$ is expensive for a product that is not used by half the world and doesn't collect the private data of its users. I understand the frustration with the security issue, but I find it unfair to say "I would do better for < 1$".