4 ms·

I also have a Yubikey for work, so I know how they work and how small they are. I still stand by the idea that most users wouldn't be happy having to cary it a

I also have a Yubikey for work, so I know how they work and how small they are. I still stand by the idea that most users wouldn't be happy having to cary it around. We can't even get most users to use password managers which are built into their phones (1 in 3) and there was a collective meltdown when Apple removed the headphone jack which required people to cary a dongle for wired headphones. Telling people they need to cary around a yubikey for anything they want to log into just isn't going to fly. https://www.security.org/digital-safety/password-manager-annual-report/ https://www.security.org/digital-safety/password-manager-ann...

water-data-dude 2y ago
I’m trying to get people at my workplace to use yubikeys. I would have thought it’d be easy, since “touch the blinking green circle on your yubikey” is a way less obnoxious form of 2FA than “pull out your phone, wait for a text, type in the number” or “pull out your phone, open up the 2FA app, scroll to the service, type in the number”. I was wrong though, it’s like pulling teeth and I’m not sure why! I think you’re right, any change has to fight against the “this is how I do it already” inertia.
- bsder 2y ago
  For me, the problem with YubiKeys is not the normal usage. That works great. The problems are the "corner" cases: enrolling new keys, removing old keys, handling unintentional destruction of the key. The last one, in particular, is really problematic. Some of the security mechanisms that a YubiKey provides are an extreme inconvenience. For example, I want to be able to clone my key via some mechanism in case it gets destroyed. I don't want to have to enroll 3 separate keys in every service on the planet just in case I put one in the wash accidentally. That's not possible with a YubiKey--for good reason--but it's a significant annoyance. We consider "duplicating a physical key" such a common need that we have automated machines to do it at 7 Eleven. The fact that we don't have the same consideration of digital ones is problematic.
  - lxgr 2y ago
    Yubikey was even planning working on a FIDO extension that would allow that for a while, but I don't think it went anywhere. It's a real shame, as I'd also love "Yubikey twins" of which I can put one in a safe deposit box and have the other one always with me, without needing to periodically synchronize them to all services I'm using them on.
nijave 2y ago
How is a Yubikey any different than other physical keys people have been carrying for hundreds of years? It seems much more intuitive to carry a digital key for your digital accounts. Password managers have the added complexity of still needing a password themselves and all the quirks that come with auto filling and programmatically reading forms. I'm not sure Apple head phones are quite a fair comparison. Outrage was also due to proprietary connectors that were patent encumbered.
- addicted 2y ago
  Where can I call to get the Yubikey locksmith in the middle of the night to show up and let me into all my accounts if I lose my Yubikey?
  - coolspot 2y ago
    nsa.gov - they are great, 5 stars
  - ragequittah 2y ago
    I lost my yubikey once. There are always ways to recover your accounts, and it's especially easy for ones you're already signed into on multiple devices.
- superfrank 2y ago
  > How is a Yubikey any different than other physical keys people have been carrying for hundreds of years? 1. Not everyone caries keys (I don't and haven't for years) 2. Because every other existing alternative doesn't require you to cary something extra. Asking people to cary something with them to be able to sign into accounts will feel like a step backwards to most people. 3. Because most people only need to pull out their keys a few times a day. Requiring a Yubikey for every sign in means you'd now need to constantly be pulling your Yubikey out to sign into things. > Password managers have the added complexity of still needing a password themselves and all the quirks that come with auto filling and programmatically reading forms. I don't buy this. I use Lastpass which is arguably the most widely used password manager. I sign in using the master password maybe once a month and it works seamlessly on my phone. Apple and Google both have their own native solutions as well and still only 1/3 of people use them. > Outrage was also due to proprietary connectors that were patent encumbered. I think you're living in a bubble. Just go look back at the headlines from when that was announced. Almost no one gave a shit about it being a proprietary connector. People were upset because they were being forced to buy and cary a bunch of dongles. Just look at the comments on these reddit posts: https://www.reddit.com/r/funny/comments/5a6lbd/it_just_works_apple/ https://www.reddit.com/r/funny/comments/5a6lbd/it_just_works... https://www.reddit.com/r/funny/comments/5j66d4/the_world_isnt_quite_ready_for_apples_wireless/ https://www.reddit.com/r/funny/comments/5j66d4/the_world_isn... https://www.reddit.com/r/dankmemes/comments/ox3s26/apple_do_be_like_that/ https://www.reddit.com/r/dankmemes/comments/ox3s26/apple_do_...

water-data-dude 2y ago

I’m trying to get people at my workplace to use yubikeys. I would have thought it’d be easy, since “touch the blinking green circle on your yubikey” is a way less obnoxious form of 2FA than “pull out your phone, wait for a text, type in the number” or “pull out your phone, open up the 2FA app, scroll to the service, type in the number”. I was wrong though, it’s like pulling teeth and I’m not sure why! I think you’re right, any change has to fight against the “this is how I do it already” inertia.

bsder 2y ago
For me, the problem with YubiKeys is not the normal usage. That works great. The problems are the "corner" cases: enrolling new keys, removing old keys, handling unintentional destruction of the key. The last one, in particular, is really problematic. Some of the security mechanisms that a YubiKey provides are an extreme inconvenience. For example, I want to be able to clone my key via some mechanism in case it gets destroyed. I don't want to have to enroll 3 separate keys in every service on the planet just in case I put one in the wash accidentally. That's not possible with a YubiKey--for good reason--but it's a significant annoyance. We consider "duplicating a physical key" such a common need that we have automated machines to do it at 7 Eleven. The fact that we don't have the same consideration of digital ones is problematic.
- lxgr 2y ago
  Yubikey was even planning working on a FIDO extension that would allow that for a while, but I don't think it went anywhere. It's a real shame, as I'd also love "Yubikey twins" of which I can put one in a safe deposit box and have the other one always with me, without needing to periodically synchronize them to all services I'm using them on.

nijave 2y ago

How is a Yubikey any different than other physical keys people have been carrying for hundreds of years? It seems much more intuitive to carry a digital key for your digital accounts. Password managers have the added complexity of still needing a password themselves and all the quirks that come with auto filling and programmatically reading forms. I'm not sure Apple head phones are quite a fair comparison. Outrage was also due to proprietary connectors that were patent encumbered.

addicted 2y ago
Where can I call to get the Yubikey locksmith in the middle of the night to show up and let me into all my accounts if I lose my Yubikey?
- coolspot 2y ago
  nsa.gov - they are great, 5 stars
- ragequittah 2y ago
  I lost my yubikey once. There are always ways to recover your accounts, and it's especially easy for ones you're already signed into on multiple devices.
superfrank 2y ago
> How is a Yubikey any different than other physical keys people have been carrying for hundreds of years? 1. Not everyone caries keys (I don't and haven't for years) 2. Because every other existing alternative doesn't require you to cary something extra. Asking people to cary something with them to be able to sign into accounts will feel like a step backwards to most people. 3. Because most people only need to pull out their keys a few times a day. Requiring a Yubikey for every sign in means you'd now need to constantly be pulling your Yubikey out to sign into things. > Password managers have the added complexity of still needing a password themselves and all the quirks that come with auto filling and programmatically reading forms. I don't buy this. I use Lastpass which is arguably the most widely used password manager. I sign in using the master password maybe once a month and it works seamlessly on my phone. Apple and Google both have their own native solutions as well and still only 1/3 of people use them. > Outrage was also due to proprietary connectors that were patent encumbered. I think you're living in a bubble. Just go look back at the headlines from when that was announced. Almost no one gave a shit about it being a proprietary connector. People were upset because they were being forced to buy and cary a bunch of dongles. Just look at the comments on these reddit posts: https://www.reddit.com/r/funny/comments/5a6lbd/it_just_works_apple/ https://www.reddit.com/r/funny/comments/5a6lbd/it_just_works... https://www.reddit.com/r/funny/comments/5j66d4/the_world_isnt_quite_ready_for_apples_wireless/ https://www.reddit.com/r/funny/comments/5j66d4/the_world_isn... https://www.reddit.com/r/dankmemes/comments/ox3s26/apple_do_be_like_that/ https://www.reddit.com/r/dankmemes/comments/ox3s26/apple_do_...