3 ms·

That doesn't sound very 2 factor.

by bronson 12y ago

acveilleux 12y ago
If you chose to read an unspoken "while I use it" it's more logical and in some environment required.
stouset 12y ago
You have to physically touch the device in order for it to function.
moe 12y ago
It may not be the purest usage mode but even a permanently inserted YubiKey protects you when your password got sniffed on the network or by a keylogger. Moreover the YubiKey also acts as a PGP smartcard, giving you a private key (for e.g. SSH) that an attacker can't extract even if they obtain root on your laptop. As much as I would like a "Retina MBA", the lack of a separate USB port is a dealbreaker for me too.
- gcr 12y ago
  As long as the machine is on, can't the attacker ask the YubiKey to generate signatures on their behalf? This is similar to standard SSH agent forwarding attacks. A sysadmin connects to a malicious server via SSH. If the sysadmin turns on agent forwarding, then "malicious root" can remotely ask the sysadmin's agent (running on the sysadmin's laptop) to authenticate to any other machine that accepts the sysadmin's public key. The malicious root can log in to any other server the sysadmin has access to, as long as the sysadmin still stays connected.
  - falcolas 12y ago
    No, the yubikey can not be activated from the OS, just from the touch capacitive sensor embedded in it. It can be re-programmed, but I've not seen a way to trigger a generation, even from the re-programmer. It's a slick device.
  - moe 12y ago
    As long as the machine is on, can't the attacker ask the YubiKey to generate signatures on their behalf? For the 2FA OTP portion: No. The button needs to be physically touched. For the PGP (ssh) portion: Yes. (but again, the attacker can not obtain a copy of the private key, that's the critical difference to your scenario) That's why (at least for critical servers) you should combine the two. That way an attacker can at most piggyback your connections. He can not initiate his own because he can not touch the button.
rconti 12y ago
It's still something you have, even if it's glued into your USB port.

That doesn't sound very 2 factor.

by bronson 12y ago

That doesn't sound very 2 factor.

acveilleux 12y ago

If you chose to read an unspoken "while I use it" it's more logical and in some environment required.

stouset 12y ago

You have to physically touch the device in order for it to function.

moe 12y ago

It may not be the purest usage mode but even a permanently inserted YubiKey protects you when your password got sniffed on the network or by a keylogger. Moreover the YubiKey also acts as a PGP smartcard, giving you a private key (for e.g. SSH) that an attacker can't extract even if they obtain root on your laptop. As much as I would like a "Retina MBA", the lack of a separate USB port is a dealbreaker for me too.

gcr 12y ago
As long as the machine is on, can't the attacker ask the YubiKey to generate signatures on their behalf? This is similar to standard SSH agent forwarding attacks. A sysadmin connects to a malicious server via SSH. If the sysadmin turns on agent forwarding, then "malicious root" can remotely ask the sysadmin's agent (running on the sysadmin's laptop) to authenticate to any other machine that accepts the sysadmin's public key. The malicious root can log in to any other server the sysadmin has access to, as long as the sysadmin still stays connected.
- falcolas 12y ago
  No, the yubikey can not be activated from the OS, just from the touch capacitive sensor embedded in it. It can be re-programmed, but I've not seen a way to trigger a generation, even from the re-programmer. It's a slick device.
- moe 12y ago
  As long as the machine is on, can't the attacker ask the YubiKey to generate signatures on their behalf? For the 2FA OTP portion: No. The button needs to be physically touched. For the PGP (ssh) portion: Yes. (but again, the attacker can not obtain a copy of the private key, that's the critical difference to your scenario) That's why (at least for critical servers) you should combine the two. That way an attacker can at most piggyback your connections. He can not initiate his own because he can not touch the button.

rconti 12y ago

It's still something you have, even if it's glued into your USB port.