4 ms·
Is it the whole point? My understanding is that this attack requires physical access to the key. Would a compromised computer be able to extract the key without
by palata 2y ago
Is it the whole point? My understanding is that this attack requires physical access to the key. Would a compromised computer be able to extract the key without physically having the key? My understanding is that it wouldn't.
So having my private key on the Yubikey plugged into my computer is still safer than having the private key directly on the computer, right?
- nh2 2y agoYes, but my point is you could also have any ultra-cheap device plugged into your computer that can run general-purpose crypto software and talk via USB, or your phone. You wouldn't have to pay > 50$ for a Yubikey.
- palata 2y ago> my point is you could also have any ultra-cheap device plugged into your computer that can run general-purpose crypto software and talk via USB, But you would need this ultra-cheap device plugged into your computer to be resistant to your computer being compromised. Do you know such an off-the-shelf device? > or your phone Well your phone has a very large attack surface as compared to a Yubikey. > You wouldn't have to pay > 50$ for a Yubikey. Are you sure about that? I have a Nitrokey 3C NFC that cost more than my Yubikey, and the Nitrokey can be flashed from my computer. Meaning that if my computer is compromised, then my Nitrokey is compromised. It's not clear to me that 50$ is expensive for a product that is not used by half the world and doesn't collect the private data of its users. I understand the frustration with the security issue, but I find it unfair to say "I would do better for < 1$".