4 ms·

Because the vast majority of users don't want to bring a yubikey with them everywhere they go.

nijave 2y ago
I'm curious if that's really true. I've had a Yubikey in my keyring for years and it's pretty convenient. It's smaller than my car key and isn't very noticeable. I have the NFC enabled variant so it can be used with a mobile phone
- mebizzle 2y ago
  I don't have a keyring or a car key anymore so any additional physical object to carry is less convenient.
- dymk 2y ago
  Yes, it's really true. How many of your friends and family members carry around a yubikey?
  - nijave 2y ago
    The technically savvy do. The others don't but not because they don't want to--they don't know they exist. Everyone I know carries around NFC devices--either work badges or credit cards. I don't see how having an extra NFC device in addition to the multiple ones you already have is a burden.
    - doublerabbit 2y ago
      I'm technically savvy. I don't nor want to own one. Why should I be forced to pay for a YubiKey? €60 is a fair chunk of money. Maybe buy me one I'll consider it otherwise I'm not convinced. I will once corporate gives me free open-source hardware.
      - superfrank 2y ago
        I'm an EM at a large tech company. Spent a decade as a developer. I have a Yubikey for work and I hate it. I understand why I need it and the value it provides, but I hate having to cary around one more thing. The fact that this user thinks the average person would be happy to have to cary one around is wildly out of touch.
    - dymk 2y ago
      > The technically savvy do. That's my point. Yubikey doesn't pass the grandma test. Your everyday user isn't going to be carrying one around anytime soon.
      - wkat4242 2y ago
        It's actually a LOT easier to explain to your grandma than a recent MFA app like Microsoft authenticator that requires a smartphone, the user to unlock it, choose the notification, to enter a code from a list and confirm with fingerprint. With passkeys via yubikey it's insert key, enter pincode (just like at the atm), touch and go. You don't even have to enter your account name or email because that's derived automatically. Anyone who can get cash out can use a yubikey. Very different for MFA apps.
- superfrank 2y ago
  I also have a Yubikey for work, so I know how they work and how small they are. I still stand by the idea that most users wouldn't be happy having to cary it around. We can't even get most users to use password managers which are built into their phones (1 in 3) and there was a collective meltdown when Apple removed the headphone jack which required people to cary a dongle for wired headphones. Telling people they need to cary around a yubikey for anything they want to log into just isn't going to fly. https://www.security.org/digital-safety/password-manager-annual-report/ https://www.security.org/digital-safety/password-manager-ann...
  - water-data-dude 2y ago
    I’m trying to get people at my workplace to use yubikeys. I would have thought it’d be easy, since “touch the blinking green circle on your yubikey” is a way less obnoxious form of 2FA than “pull out your phone, wait for a text, type in the number” or “pull out your phone, open up the 2FA app, scroll to the service, type in the number”. I was wrong though, it’s like pulling teeth and I’m not sure why! I think you’re right, any change has to fight against the “this is how I do it already” inertia.
    - bsder 2y ago
      For me, the problem with YubiKeys is not the normal usage. That works great. The problems are the "corner" cases: enrolling new keys, removing old keys, handling unintentional destruction of the key. The last one, in particular, is really problematic. Some of the security mechanisms that a YubiKey provides are an extreme inconvenience. For example, I want to be able to clone my key via some mechanism in case it gets destroyed. I don't want to have to enroll 3 separate keys in every service on the planet just in case I put one in the wash accidentally. That's not possible with a YubiKey--for good reason--but it's a significant annoyance. We consider "duplicating a physical key" such a common need that we have automated machines to do it at 7 Eleven. The fact that we don't have the same consideration of digital ones is problematic.
      - lxgr 2y ago
- lxgr 2y ago
  I used to do that for a while, and it got annoying very quickly. It still requires grabbing my keychain when e.g. sitting on the couch or lying in bed, NFC doesn't always read (there's very little UX feedback on whether I'm holding it in the right place and there is possibly an application layer problem or I'm not even close), and most of all it doesn't work on my computer, where I need to plug it in to the USB-C port (much less seamless than tapping). Now I only have the Yubikey as a backup authenticator for my most valuable accounts and use a software solution for most low-value things.
- kjs3 2y ago
  My mother will not learn to use a Yubikey, or remember to carry one. You may not believe that (or simply dismiss anyone who won't/can't as unworthy to join in on modern life), but I can assure you it's true.
  - acdha 2y ago
    Have you actually tried this? I’ve found yhe Yubikey model is much easier for normal people because they’re used to using physical keys or cards. What’s hard is a) the cost and b) the hassle of having to pair multiple keys, which is where the biometric phone/laptop based solutions are better since it’s one tap for a familiar prompt.
    - kjs3 2y ago
      Yes, as a matter of fact I am painfully aware of my mothers limitations with respect to technology and gadgets, as well as her extensive peer group who I somehow get roped into supporting. Your condescension is noted.
lxgr 2y ago
The much bigger problem is that you also need to enroll a second Yubikey into every service you use, but also safely store that backup key somewhere, ideally outside your own house. That's just not realistic. Yubico had some ideas around "paired Yubikeys" which shared the same root secret, but I believe that model won't work anymore with FIDO/CTAP2 due to some counter value that was added there over U2F. (It might be possible for them to just not have a security counter; I'm not sure.)
wkat4242 2y ago
I have mine on my keyring. Not sure what the big problem is there. The bigger issue with yubikeys is that you need more than one in case you lose one. And most sites only allow one passkey per account because all the mobile implementations can sync the private key. Yubikeys can't and that's actually a good thing because it makes them unique and eliminates the whole sync mechanism as an attack plane.
- iggldiggl 2y ago
  > And most sites only allow one passkey per account because all the mobile implementations can sync the private key. Even when/if sites do allow multipe passkeys per account, the fundamental contradiction remains: Your backup key(s) are supposed to be kept somewhere secure where they won't get lost, stolen or destroyed, which ideally means some sort of off-site backup (at your bank or whereever), but at the same time every time you register for a new service you do need to register all your backup keys, too.
  - wkat4242 2y ago
    True. That is a problem. Especially because with Webauthn you can't just enrol a public key. It's one of the reasons I like openpgp for authentication e.g. over SSH. I can just give it a list of public keys to accept without having all those keys actually to hand.

I'm curious if that's really true. I've had a Yubikey in my keyring for years and it's pretty convenient. It's smaller than my car key and isn't very noticeable. I have the NFC enabled variant so it can be used with a mobile phone

mebizzle 2y ago
I don't have a keyring or a car key anymore so any additional physical object to carry is less convenient.
dymk 2y ago
Yes, it's really true. How many of your friends and family members carry around a yubikey?
- nijave 2y ago
  The technically savvy do. The others don't but not because they don't want to--they don't know they exist. Everyone I know carries around NFC devices--either work badges or credit cards. I don't see how having an extra NFC device in addition to the multiple ones you already have is a burden.
  - doublerabbit 2y ago
    I'm technically savvy. I don't nor want to own one. Why should I be forced to pay for a YubiKey? €60 is a fair chunk of money. Maybe buy me one I'll consider it otherwise I'm not convinced. I will once corporate gives me free open-source hardware.
    - superfrank 2y ago
      I'm an EM at a large tech company. Spent a decade as a developer. I have a Yubikey for work and I hate it. I understand why I need it and the value it provides, but I hate having to cary around one more thing. The fact that this user thinks the average person would be happy to have to cary one around is wildly out of touch.
  - dymk 2y ago
    > The technically savvy do. That's my point. Yubikey doesn't pass the grandma test. Your everyday user isn't going to be carrying one around anytime soon.
    - wkat4242 2y ago
      It's actually a LOT easier to explain to your grandma than a recent MFA app like Microsoft authenticator that requires a smartphone, the user to unlock it, choose the notification, to enter a code from a list and confirm with fingerprint. With passkeys via yubikey it's insert key, enter pincode (just like at the atm), touch and go. You don't even have to enter your account name or email because that's derived automatically. Anyone who can get cash out can use a yubikey. Very different for MFA apps.
superfrank 2y ago
I also have a Yubikey for work, so I know how they work and how small they are. I still stand by the idea that most users wouldn't be happy having to cary it around. We can't even get most users to use password managers which are built into their phones (1 in 3) and there was a collective meltdown when Apple removed the headphone jack which required people to cary a dongle for wired headphones. Telling people they need to cary around a yubikey for anything they want to log into just isn't going to fly. https://www.security.org/digital-safety/password-manager-annual-report/ https://www.security.org/digital-safety/password-manager-ann...
- water-data-dude 2y ago
  I’m trying to get people at my workplace to use yubikeys. I would have thought it’d be easy, since “touch the blinking green circle on your yubikey” is a way less obnoxious form of 2FA than “pull out your phone, wait for a text, type in the number” or “pull out your phone, open up the 2FA app, scroll to the service, type in the number”. I was wrong though, it’s like pulling teeth and I’m not sure why! I think you’re right, any change has to fight against the “this is how I do it already” inertia.
  - bsder 2y ago
    For me, the problem with YubiKeys is not the normal usage. That works great. The problems are the "corner" cases: enrolling new keys, removing old keys, handling unintentional destruction of the key. The last one, in particular, is really problematic. Some of the security mechanisms that a YubiKey provides are an extreme inconvenience. For example, I want to be able to clone my key via some mechanism in case it gets destroyed. I don't want to have to enroll 3 separate keys in every service on the planet just in case I put one in the wash accidentally. That's not possible with a YubiKey--for good reason--but it's a significant annoyance. We consider "duplicating a physical key" such a common need that we have automated machines to do it at 7 Eleven. The fact that we don't have the same consideration of digital ones is problematic.
    - lxgr 2y ago
lxgr 2y ago
I used to do that for a while, and it got annoying very quickly. It still requires grabbing my keychain when e.g. sitting on the couch or lying in bed, NFC doesn't always read (there's very little UX feedback on whether I'm holding it in the right place and there is possibly an application layer problem or I'm not even close), and most of all it doesn't work on my computer, where I need to plug it in to the USB-C port (much less seamless than tapping). Now I only have the Yubikey as a backup authenticator for my most valuable accounts and use a software solution for most low-value things.
kjs3 2y ago
My mother will not learn to use a Yubikey, or remember to carry one. You may not believe that (or simply dismiss anyone who won't/can't as unworthy to join in on modern life), but I can assure you it's true.
- acdha 2y ago
  Have you actually tried this? I’ve found yhe Yubikey model is much easier for normal people because they’re used to using physical keys or cards. What’s hard is a) the cost and b) the hassle of having to pair multiple keys, which is where the biometric phone/laptop based solutions are better since it’s one tap for a familiar prompt.
  - kjs3 2y ago
    Yes, as a matter of fact I am painfully aware of my mothers limitations with respect to technology and gadgets, as well as her extensive peer group who I somehow get roped into supporting. Your condescension is noted.

lxgr 2y ago

The much bigger problem is that you also need to enroll a second Yubikey into every service you use, but also safely store that backup key somewhere, ideally outside your own house. That's just not realistic. Yubico had some ideas around "paired Yubikeys" which shared the same root secret, but I believe that model won't work anymore with FIDO/CTAP2 due to some counter value that was added there over U2F. (It might be possible for them to just not have a security counter; I'm not sure.)

wkat4242 2y ago

I have mine on my keyring. Not sure what the big problem is there. The bigger issue with yubikeys is that you need more than one in case you lose one. And most sites only allow one passkey per account because all the mobile implementations can sync the private key. Yubikeys can't and that's actually a good thing because it makes them unique and eliminates the whole sync mechanism as an attack plane.

iggldiggl 2y ago
> And most sites only allow one passkey per account because all the mobile implementations can sync the private key. Even when/if sites do allow multipe passkeys per account, the fundamental contradiction remains: Your backup key(s) are supposed to be kept somewhere secure where they won't get lost, stolen or destroyed, which ideally means some sort of off-site backup (at your bank or whereever), but at the same time every time you register for a new service you do need to register all your backup keys, too.
- wkat4242 2y ago
  True. That is a problem. Especially because with Webauthn you can't just enrol a public key. It's one of the reasons I like openpgp for authentication e.g. over SSH. I can just give it a list of public keys to accept without having all those keys actually to hand.