3 ms·

The problem here is that depending on your threat model it might be important for customers to trust Yubico not to sell out against rich/powerful attackers. Thi

by atoav 2y ago

The problem here is that depending on your threat model it might be important for customers to trust Yubico not to sell out against rich/powerful attackers. This behavior adds a datapoint that speaks against them, even if they are technically correct. I do not expect a manufacturer of such hardware to be like: "Eh it is okay" when skipping the fix to their IC manufacturers fuckup saves them money, I expect them to go out of their way to protect their customers. Seen like this their refusal to replace compromised keys was already brazen, them selling compromised keys constitutes a breach of trust. I am already researching for alternatives.

palata 2y ago
> Seen like this their refusal to replace compromised keys was already brazen, Does it really sound crazy that they would not replace all the keys they ever sold? At that price, it feels like it's obviously part of the deal. If you want to buy a security key that will get audited every day by 10 experts and receive new versions delivered in your hands by approved staff, I guess you should expect to pay more than 50 bucks, right? > them selling compromised keys constitutes a breach of trust. Some anonymous reader of some blog claims it. It doesn't mean it's true, does it? For what I can see, it says on the Yubico store which version of the firmware I am getting. Can anyone confirm that they ordered the new version, received the old version and Yubico refused to exchange that?
- atoav 2y ago
  Of course they would like to avoid replacing every (affected) key they ever sold if they don't absolutely have to. But if they sold cars and this was a defective airbag they would have been forced to replace them. You as a manufacturer are responsible for the products you bring to market — don't want to recall your products? Then ensure they work and you don't put all your eggs in one basket. In this case Yubico is very likely not legally bound to recall, but I made a case how this is an issue of trust. You know what would have been a good move? A deal where you can order a new one at strongly reduced prices if you can show you had an affected device, or something among those lines. Or selling the affected ones for cheap and give the customers the choice. There are many ways to deal with that situation in a better way than they did and they decided to choose the one that helped their very short term bottom line the most. As a owner of an affected Yubikey I have to saybthat the whole episode put an questionmark behind thir product for me. Not because it was affected, because of how they dealt with it.
  - palata 2y ago
    > in a better way than they did What did they do? What I see is that I can't choose to order a key with an older firmware, and it explicitly says "firmware 5.7" everywhere I look. > But if they sold cars and this was a defective airbag they would have been forced to replace them. New cars have those electronic keys that work remotely (automatically close the door when you leave, automatically open when you arrive). There has been an increase of car thefts from those keys, because they are objectively less secure. Have you ever tried asking the car manufacturer to change the key for free? Or to sell you a new car at a strongly reduced price?
- matheusmoreira 2y ago
  For the record, they've replaced defective vulnerable keys before. https://www.yubico.com/support/security-advisories/ysa-2017-01/ https://www.yubico.com/support/security-advisories/ysa-2017-... I had one of the affected keys. I requested a replacement via their key replacement program and got a new one in the mail.

by atoav 2y ago

palata 2y ago

> Seen like this their refusal to replace compromised keys was already brazen, Does it really sound crazy that they would not replace all the keys they ever sold? At that price, it feels like it's obviously part of the deal. If you want to buy a security key that will get audited every day by 10 experts and receive new versions delivered in your hands by approved staff, I guess you should expect to pay more than 50 bucks, right? > them selling compromised keys constitutes a breach of trust. Some anonymous reader of some blog claims it. It doesn't mean it's true, does it? For what I can see, it says on the Yubico store which version of the firmware I am getting. Can anyone confirm that they ordered the new version, received the old version and Yubico refused to exchange that?

atoav 2y ago
Of course they would like to avoid replacing every (affected) key they ever sold if they don't absolutely have to. But if they sold cars and this was a defective airbag they would have been forced to replace them. You as a manufacturer are responsible for the products you bring to market — don't want to recall your products? Then ensure they work and you don't put all your eggs in one basket. In this case Yubico is very likely not legally bound to recall, but I made a case how this is an issue of trust. You know what would have been a good move? A deal where you can order a new one at strongly reduced prices if you can show you had an affected device, or something among those lines. Or selling the affected ones for cheap and give the customers the choice. There are many ways to deal with that situation in a better way than they did and they decided to choose the one that helped their very short term bottom line the most. As a owner of an affected Yubikey I have to saybthat the whole episode put an questionmark behind thir product for me. Not because it was affected, because of how they dealt with it.
- palata 2y ago
  > in a better way than they did What did they do? What I see is that I can't choose to order a key with an older firmware, and it explicitly says "firmware 5.7" everywhere I look. > But if they sold cars and this was a defective airbag they would have been forced to replace them. New cars have those electronic keys that work remotely (automatically close the door when you leave, automatically open when you arrive). There has been an increase of car thefts from those keys, because they are objectively less secure. Have you ever tried asking the car manufacturer to change the key for free? Or to sell you a new car at a strongly reduced price?
matheusmoreira 2y ago
For the record, they've replaced defective vulnerable keys before. https://www.yubico.com/support/security-advisories/ysa-2017-01/ https://www.yubico.com/support/security-advisories/ysa-2017-... I had one of the affected keys. I requested a replacement via their key replacement program and got a new one in the mail.